Privacy and data protection

What Datastream is and who runs it

Datastream is the internal data platform of the Blessed Christopher Wharton Catholic Academy Trust (BCWCAT). It brings together information about the trust's schools (attendance, behaviour, outcomes, SEND and staffing) so that staff can see how pupils and schools are doing, along with a set of staff tools.

It is run by the trust's central team on servers that the trust manages. It is for trust and school staff only: you sign in with your school Microsoft account. The trust is responsible for the personal data in Datastream, as set out in the trust's privacy notices (see Your rights).

Where the data comes from

Datastream mostly shows information that schools already hold in their own systems. It does not replace those systems: if something is wrong, it needs correcting at the source.

• Arbor, the schools' management information system (MIS), through the trust's Arbor data connector. This is the main source: pupils, attendance, behaviour, assessment, SEN, exclusions and staff records. It is refreshed overnight, and a few items, such as today's attendance, are updated during the day.
• Arbor's own connection for apps, for a small number of items such as pastoral notes, interventions and guardian contact email addresses.
• Arbor Insight, for statutory assessment results.
• CPOMS, the safeguarding record system, through its reporting export.
• Exam results and Alps, for GCSE, A level and sixth-form value-added analysis.
• Published government data from the Department for Education and Get Information About Schools, for national and local comparisons.
• Microsoft 365: when you sign in, your name, email address and the Microsoft groups you belong to.
• Information staff add in Datastream, for example notes, uploaded documents and settings.

Who can see what

• You only see your own schools. When you sign in, Datastream reads your Microsoft group memberships from your school's Microsoft account. The trust maps groups (and, occasionally, individual accounts) to one or more schools, and Datastream shows you only the schools you have been given.
• Central trust staff who have been given trust-wide access see all schools.
• No access unless granted. If your account has not been given any schools, you will see an "Access denied" page.
• Some areas are restricted further. For example, per-pupil safeguarding detail from CPOMS is shown only to the designated safeguarding leads named for it (trust-wide access does not include it); managing access is limited to a small number of system administrators; and several staff tools have their own named reviewers or administrators.
• Access can be paused. For example, staff with a close family member sitting exams can be blocked from Datastream until results are published.
• Sessions last 12 hours. After that you sign in again, and your group memberships are checked afresh, so removing someone from a group removes their access when they next sign in.
• Use is recorded. Datastream logs each sign-in and page visit (your email address, the time, your IP address and browser) so that access can be checked. Only system administrators can see this log.

The anonymise option

The Anon button at the top of the dashboard replaces pupil and staff names on screen with codes such as "Pupil 7F2A". It is meant for presenting or sharing your screen, for example in a governors' meeting. The same name always gets the same code.

Staff tools and AI

Most of Datastream's AI runs on the trust's own AI server (an NVIDIA DGX Spark on the trust's network), with a second on-site computer as a backup. When AI runs there, what you type or upload does not leave the trust.

AI inside the dashboard

• Always on the trust's own servers, never sent outside: Ask Datastream, walkout analysis, the Seating Planner, the weekly attendance analysis and the working-hours summary. If the on-site servers are unavailable, these features stop rather than use an outside service.
• On the trust's own servers first: Attendance Stars write-ups, exam results commentary, Pupil Premium analysis, policy and governance compliance reviews, and the board report. If both on-site servers are unavailable, these can fall back to Claude, an AI service run by Anthropic.
• Using Claude (Anthropic): the KPI Tracker analysis and the Desktop Backgrounds designer.

Staff tools

Whichever tool you use, only put in what the task needs, and check AI output before relying on it or sharing it.

How long things are kept

• School data is a copy of what is in the source systems and is refreshed from them, so when a record changes or is removed in Arbor, Datastream follows at the next refresh.
• Your sign-in session ends after 12 hours.
• The access log is kept on a rolling basis: older entries are removed automatically as it grows.
• Staff tools keep uploads for the times shown in Staff tools and AI.
• Backups: encrypted nightly backups are kept for 14 days, for recovery if something goes wrong.
• Otherwise, records are kept in line with the trust's retention schedule, which follows the IRMS Academies Toolkit.

Your rights

Under UK GDPR you have rights over your personal data, including the right to see it, to have it corrected, and in some cases to have it erased or its use restricted or objected to. The trust's privacy notices explain how the trust uses personal data and how to use these rights:

• Privacy notice for pupils and families (Word document)
• Privacy notice for staff and governors (Word document)
• Data protection policy (Word document)
• All trust policies

To ask for a copy of your information, or with any question about data protection, contact the trust's Data Protection Officer at DPO@bywaterkent.co.uk or the Governance Administrator at Governance@bcwcat.co.uk. You can also complain to the Information Commissioner's Office, though the trust asks that you raise concerns with it first.

Reporting a problem

• If you can see information you should not, such as a school or pupil outside your role, stop, do not share it, and email chris.jakubowski@bcwcat.co.uk straight away so access can be fixed.
• If you think personal data has been lost or shared wrongly, follow the trust's data protection policy and tell the Data Protection Officer at DPO@bywaterkent.co.uk as soon as you can.
• If a figure or record looks wrong, check it in Arbor first and ask your school's data lead to correct it there. For anything else, email chris.jakubowski@bcwcat.co.uk.