Skip to main content

School Meals in a Primary School Setting Privacy Notice

Privacy notice relating to the processing of personal data by Rhondda Cynon Taf County Borough Council for the provision of School Meals in a Primary school setting


School Meals Provision

Under the Healthy Eating in Schools (Nutritional Standards & Requirements) (Wales) Regulations 2013, Local Authorities and Governing Bodies have a statutory duty to promote healthy eating to all children who go a primary school which is maintained by a Local Authority.

In Rhondda Cynon Taf, school meals are provided to pupils by the Local Authority’s (Rhondda Cynon Taf Country Borough Council (RCTCBC)) Catering Service, who work in conjunction with the school to deliver the provision.

In relation to the personal data processed for the provision of school meals, the Local Authority is the ‘data controller’ and the school is the ‘data processor’. This privacy notice is therefore provided by RCTCBC via the School. Any queries regarding this privacy notice or the use of personal data for School Meals provision should be directed to the Council (contact details of which are provided below).


This privacy notice is intended to provide information about how Rhondda Cynon Taf County Borough Council (‘RCTCBC’, ‘Council’, ‘Local Authority’ ‘we’) will use (or ‘process’) personal data about individuals including its current, past and prospective pupils and their parents, carers or guardians (referred to in the notice as ‘parents’) for the provision of School Meals at the School.

It does not cover the processing of personal data relating to applications for Free School Meals.

When processing the personal data, only the minimum amount necessary in relation to the purpose is processed.

This privacy notice should be read in conjunction with the Councils general data protection privacy notice which can be found on the Council’s website;

The personal data we process

We process the following categories of personal data in the course of providing School Meals at the School.

Pupil personal data;

  • School the pupil attends, year, class etc.
  • Name
  • Date of birth
  • Dietary needs, allergies, relevant health information etc.
  • Free school meal status and information (if applicable)
  • School meal register (detailing whether the pupil was in school and received a school meal etc.)

Parent personal data;

  • Contact details such as name, address, email address, telephone number
  • Financial details (such as amounts paid / owed, payment information etc.)

Why we process the personal data

We process the personal data in order undertake our statutory functions in the course of providing School Meals at the school. This includes but is not limited to;

  • Administration relating to school meals provision
  • Processing of payments for school meals
  • Recovery of outstanding payments in respect of school meals
  • Managing dietary, health needs of the pupil (if applicable)
  • Working in conjunction with the school to deliver school meal provision
  • Planning school meals provision within the school and RCT

Our lawful basis for processing the personal data

Under the UK General Data Protection Regulation (UK GDPR), our lawful basis for processing personal data to undertake our statutory function relating to the provision of School Meals is;

  • Legal Obligation Article(c) – processing is necessary for compliance with a legal obligation to which the controller is subject. 
  • Public Task - Article 6 (e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
  • Substantial public interest - Article 9 (2) (g) - processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

The primary legislation, regulations and guidance that supports this includes;

  • Education Act 1996
  • School Standards and Organisation (Wales) Act 2013
  • Healthy Eating in Schools (Nutritional Standards & Requirements) (Wales) Regulations 2013
  • WG guidance - Charging for food and drink provided in maintained schools (2013)

Who and where we get the personal data from

We may receive the personal data from;

  • Parents
  • Pupils
  • School
  • Other Local Authority Services such as Finance, Free School Meals (Revenues)

Who we share personal data with;



The School



  • Provision of school meals
  • General administration
  • Maintain school meal register
  • Financial administration and accounting - payments and arrears etc.

Other Local Authority Services


  • Revenues – Free School Meals status and information.
  • Finance – billing, financial administration and accounting.

System Providers 

The personal data processed for School Meals purposes is stored securely within the Council’s and School’s ICT systems. Some of these systems and applications are provided and hosted by trusted 3rd party ICT providers.

The main system used to store personal data relating to School Meals is:

  • CapitaOne - SIMS Dinner Money
  • Civica Financials

How long we retain the personal data;

The Council will retain the following data:

Information relating to Special Dietary requirements

Until the pupil leaves school plus 1 year

Information relating to Free School Meals

7 years

The School will retain the following records on behalf of the Council:

School meals register


Current year + 3 years

School meals summary sheet

Current year + 3 years

Following the retention period expiry, personal data will be permanently and securely destroyed.

NOTE: In keeping with the General Data Protection Regulation storage limitation principle records are periodically reviewed. Only key information that is relevant to the record is retained for the entire retention period. Information that has no long term or evidential value is routinely destroyed in the normal course of business.  

Your Information Rights

The General Data Protection Regulation (GDPR) gives you important rights.

Please refer to the ‘Your Information Rights’ section of the Councils general privacy notice for further information on your information rights and how to exercise them.


If you would like to discuss anything in this privacy notice, please contact the Council directly as the Data Controller;

School Meals & Special dietary requirements -