The short version
- MyJFS is run by JFS. It keeps track of House Points, Chesed (volunteering) and house events.
- It uses information the school already has, like your name, form and house, plus what teachers, parents and carers add in MyJFS.
- Students see their own records. Parents and carers see only their own children. Staff see what they need for their job.
- We don't sell your information, show adverts or track you around the internet.
- You can ask to see your information, or to have it corrected if it's wrong.
Who we are
MyJFS is run by JFS (“the school”, “we”). The school is the data controller for the information in MyJFS. That means it decides what is collected and how it's used, and it's responsible for looking after it.
You can reach the school's Data Protection Officer through the myJFS team: .
This notice is about MyJFS. It adds to the school's main privacy notices for pupils, parents and staff, which explain how the school handles information more generally (see the school website).
What we hold
About students
- Name and preferred name, school email address, year group, form and house, and when these changed
- Whether you're at JFS now, and the date you left if you have
- The code on your lanyard, so staff can scan you in at house events
- Your school photo, if the school has one. If photo consent has been declined, or the school has hidden your photo, only MyJFS administrators can see it.
House Points
Each award: how many points, the reason the teacher wrote, who gave it and when. Also any requests to correct an award and what was decided.
Chesed
What the student did, the organisation, the date and the minutes, details of the person who supervised them, and the photos or documents sent in as evidence. Also the Chesed team's decision and any note sent to the family.
House events
The events, who took part or came to support, how they were added (lanyard scan, search or list) and the results.
About parents and carers
- Name, title and email address
- Your relationship to each child (for example, mother or carer) and whether that link is active
- Your password, stored in a scrambled form that can't be turned back into the password
About staff
Name, title, work email address, job title and your roles in MyJFS.
For everyone with an account
- How you sign in (school Microsoft account or password) and when you last signed in
- The devices you're signed in on: the type of device and the browser or app
- Notifications we've sent you, whether you've read them, and your notification settings
- A log of important actions, such as signing in, awarding or correcting points, reviewing Chesed and opening evidence
Safeguarding
If the school's records show a contact restriction for a parent or carer, or a link has been referred to the school's Designated Safeguarding Lead, MyJFS records this. That link then can't be used until an administrator has checked it.
MyJFS doesn't save IP addresses with your records. They're used briefly to slow down repeated sign-in attempts, then forgotten.
Where it comes from
- The school's information system (Arbor). Student, staff and parent or carer details, family relationships, school photos and photo consent. MyJFS checks for changes every night. It never sends anything back to Arbor.
- Microsoft. When students and staff sign in with their school account, Microsoft tells MyJFS the account's ID and email address.
- Staff. Points, house events, Chesed decisions, and staff lists or photos that administrators add.
- Parents and carers. Chesed submissions and evidence, and the password you choose.
- Students. House Captains can propose house events.
How we use it
We use this information to:
- run the house system: record points and show how each house is doing
- run Chesed: receive volunteering, review it and show progress towards the target
- plan house events and record who took part and the results
- keep students and families up to date with notifications and emails
- set up accounts, sign people in and keep accounts secure
- keep records accurate and fair, and correct mistakes
- help keep children safe
Why we're allowed to. The school uses this information to carry out its public task of educating and caring for its students (UK GDPR Article 6(1)(e)). Information about safeguarding is used to meet the school's legal duties to keep children safe. Student photos come from the school's records, and MyJFS follows the photo consent the school holds. Some things are your choice, like turning on notifications on your phone or adding an event to your calendar, and you can change your mind about them at any time.
No automatic decisions. MyJFS doesn't make decisions about anyone by itself. When the app reads a name from a lanyard, it only suggests a student and a member of staff confirms it. Chesed minutes only count once a person on the Chesed team has approved them.
Who can see it
- Students see their own points, Chesed and events, and the standings for every house.
- Parents and carers see only the children the school's records link them to, while that link is active.
- Staff can look up any student's record, because any teacher can award points and run events.
- The Chesed team see Chesed submissions and evidence for the year groups they look after. Each time a member of staff opens evidence, it's recorded.
- MyJFS administrators can see everything in MyJFS, including the log of actions, so they can run it and help people.
We never sell information or share it for marketing.
Services that help run MyJFS
Some companies provide services that MyJFS relies on. They act on the school's instructions and may not use the information for their own purposes.
| Service | What it does | What it receives |
|---|---|---|
| The school's information system | Nothing: MyJFS only reads from it | |
| School account sign-in for students and staff | Your sign-in, on Microsoft's own pages | |
| Sends emails such as invitations and password resets | Your name, email address and the email | |
| Deliver notifications to phones | Your device's notification code and the notification text | |
| Runs MyJFS and stores its database and uploaded files | Everything in MyJFS, stored securely |
- ArborWhat it doesThe school's information systemWhat it receivesNothing: MyJFS only reads from it
- MicrosoftWhat it doesSchool account sign-in for students and staffWhat it receivesYour sign-in, on Microsoft's own pages
- ResendWhat it doesSends emails such as invitations and password resetsWhat it receivesYour name, email address and the email
- Expo, Apple and GoogleWhat it doesDeliver notifications to phonesWhat it receivesYour device's notification code and the notification text
- Hosting and file storageWhat it doesRuns MyJFS and stores its database and uploaded filesWhat it receivesEverything in MyJFS, stored securely
Some of these companies are based outside the UK or may handle information outside it, for example in the United States. When that happens, the school uses the safeguards UK data protection law requires.
How long we keep it
While you're at JFS, your MyJFS record is kept up to date from the school's records. When someone leaves, their access is switched off straight away. For students that happens the night the school records that they've left. Parents and carers lose access when they no longer have a child at JFS, and staff when they leave the school. Records are then kept and deleted in line with the school's records retention policy.
Some things are removed sooner:
- Chesed photos or documents that were uploaded but never sent in are deleted after 24 hours
- Copies of emails are cleared once they've been sent, and the delivery record is deleted after 7 days
- Invitation links stop working after 14 days, and password reset links after 30 minutes
- You stay signed in for up to 30 days without using MyJFS, then you'll need to sign in again
Keeping it safe
- Everything travels over encrypted connections
- Passwords are stored scrambled, and accounts are locked for a while after repeated wrong passwords
- People only see what their role needs, and important actions are logged
- Location and camera details are removed from Chesed evidence photos (JPEG, PNG and WebP) and from school photos
- On the website, the sign-in cookie can't be read by scripts on the page. In the app, sign-in is kept in your phone's secure storage.
The MyJFS app
The app asks before using any of these. You can say no and still use MyJFS, just without that feature.
| Permission | What it's for |
|---|---|
| Scanning lanyards at house events (staff), and photographing Chesed evidence (parents and carers) | |
| Choosing a photo to send as Chesed evidence. The app only sees the photos you pick. | |
| Adding a house event or volunteering to your calendar. You confirm each one, and MyJFS never reads your calendar. | |
| Telling you about new points, Chesed decisions and events |
- CameraWhat it's forScanning lanyards at house events (staff), and photographing Chesed evidence (parents and carers)
- PhotosWhat it's forChoosing a photo to send as Chesed evidence. The app only sees the photos you pick.
- CalendarWhat it's forAdding a house event or volunteering to your calendar. You confirm each one, and MyJFS never reads your calendar.
- NotificationsWhat it's forTelling you about new points, Chesed decisions and events
Lanyard scanning. The phone reads the printed name itself. The picture is deleted straight away. Only the text is sent to MyJFS to suggest a match, and that text isn't saved.
Notifications. These show what happened, which can include a child's name. Turn off “Show details on the lock screen” in notification settings and they'll only say there's something new, with the details kept inside MyJFS.
On your phone. The app keeps a copy of your recent information for up to 7 days so it opens quickly, and removes it when you sign out. On Android, MyJFS isn't included in phone backups.
Cookies and storage
The MyJFS website sets one cookie and keeps a few small settings in your browser. All of them are needed for the site to work, or remember a choice you made. That's why there's no cookie banner: the law doesn't require us to ask first for these.
| Name | What it does | How long it lasts |
|---|---|---|
| Cookie that keeps you signed in. It's only sent to MyJFS's sign-in service, and scripts on the page can't read it. | 30 days, renewed when you use MyJFS. Removed when you sign out. | |
| Remembers whether you chose System, Light or Dark (browser storage) | Until you clear it | |
| Staff only: remembers whether the side menu is collapsed (browser storage) | Until you clear it | |
| Holds a one-time code while you sign in with a school account (browser storage) | Removed as soon as sign-in finishes, or when you close the tab |
myjfs_rtWhat it doesCookie that keeps you signed in. It's only sent to MyJFS's sign-in service, and scripts on the page can't read it.How long it lasts30 days, renewed when you use MyJFS. Removed when you sign out.myjfs-themeWhat it doesRemembers whether you chose System, Light or Dark (browser storage)How long it lastsUntil you clear itmyjfs-staff-sidebarWhat it doesStaff only: remembers whether the side menu is collapsed (browser storage)How long it lastsUntil you clear itmyjfs.microsoft.pkceWhat it doesHolds a one-time code while you sign in with a school account (browser storage)How long it lastsRemoved as soon as sign-in finishes, or when you close the tab
MyJFS doesn't use analytics, advertising or tracking cookies, and the website loads nothing from other companies. When you sign in with a school account, Microsoft's sign-in pages set their own cookies, which Microsoft's privacy statement covers. The app doesn't use cookies.
Your rights
You have the right to:
- ask for a copy of the information MyJFS holds about you
- have information corrected if it's wrong
- ask for information to be deleted. The school may need to keep some records, and will explain why if so.
- ask us to limit how we use your information, or object to how we use it
- change your mind about anything you chose, like notifications
Students can make these requests themselves. Parents and carers can make them for their child. For older students, the school may check with the student first, because the information is theirs.
To make a request, . It's free, and we'll reply within one month.
Questions and complaints
If you have a question or you're unhappy with how your information has been handled, please first, and we'll try to put it right.
You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this notice
We'll update this notice when MyJFS changes how it uses information, and change the date at the top. If a change affects you, we'll tell you in MyJFS.