Privacy notice - Holiday Activities and Food (HAF) Provision
Overview
This Privacy notice covers how we use the information you give us when booking places on holiday activities and food provision.
East Sussex County Council takes data protection seriously. Please be assured that your information will be used appropriately in line with data protection legislation, will be stored securely and will not be processed unless the requirements for fair and lawful processing can be met.
What information is being used?
In order to administer the HAF programme, it is necessary for us to process limited personal data about you and your child. We will only process the data we need to run the programme effectively, for example names, dates of birth, contact information and any medical details required to keep your child safe.
How will your information be used?
The data will be used by East Sussex County Council (ESCC) to confirm their eligibility for free HAF provision and for reporting to the funders. Personal data is shared with the organisation providing the funded activity to help in providing a safe environment for the attendees at their provision.
Personal data will be used for the purposes of managing bookings, checking eligibility and attendance and reporting on project delivery. This information will be collected by EEQU, either directly from the data attendee (or their parents/carers in the case of young people attending the provision) or from providers, and shared with the HAF team at ESCC. This will include a range of personal data (name, address, contact information, FSM status) as well as potentially special category data (e.g. medical, SEND, behavioural needs) as disclosed by parents/carers and relevant to the provision.
Some limited information is also required to enable us to comply with our reporting obligations to the Department for Education (DfE) and Department of Work and Pensions (DWP). This information is anonymised before sharing.
We aim to maintain high standards, adopt best practice for our record keeping and regularly check and report on how we are doing. Your information is never sold for direct marketing purposes.
Our staff are trained to handle your information correctly and protect your confidentiality and privacy.
Your information is processed in the UK or in a country with an adequacy agreement with the UK.
What is the legal basis for processing your information?
The legal basis identified for sharing this information is "public task - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official duty vested in the data controller" - UK GDPR, Article 6(1)(e).
Where necessary, we may also process your personal data on the basis of Article 6(1)(d) – Vital interests.
We will seek consent for use of photos or video and for receiving HAF updates - on the basis of Article 6(1)(a).
Where special category data is processed, this will be based on UK GDPR Substantial public interest Article 9 (2) (g), or Provision of health or social care Article 9(2)(h): where the data is needed to manage dietary needs or support children with SEND.
Processing of special category data may also be based on Data Protection Act 2018 - Schedule 1 Part 2 section 6 - Statutory and government purposes and Part 2 section 18 Safeguarding of children and Individuals at risk..
How long will your information be kept for?
EEQU will hold data in line with their retention policy. Information will be retained for no longer than necessary for a maximum of 6 years after customers stop using the platform, in line with the Limitation Act. Please see EEQU's Privacy Notice for further information.
ESCC will only retain your personal data for as long as reasonably necessary to fulfil the purpose(s) we collected it for, including for the purpose of satisfying any legal, regulatory, tax, accounting, or reporting requirements.
See the ESCC retention schedule.
Sharing your information
Personal data is shared with the organisation providing the funded activity to help in providing a safe environment for the attendees at their provision.
Anonymised information is shared with the DfE and, where required, DWP for reporting purposes.
Any sharing of personal data is always done:
- on a case-by-case basis
- using the minimum personal data necessary
- with the appropriate security controls in place
- in line with legislation.
Information is only shared with those agencies and bodies who have a "need to know" or where you have consented to the sharing of your personal data to such persons.
We may use the information we hold about you to assist in the detection and prevention of crime or fraud. We may also share this information with other bodies that inspect and manage public funds.
Use of third party organisations
East Sussex County Council may share your information with trusted external organisations to process your data on our behalf.
Information is shared with EEQU to co-ordinate and provide the Holiday Activities and Food (HAF) programme to families in East Sussex.
Any organisation commissioned by the Council will be under contractual obligation to comply with data protection legislation.
Your rights
Under data protection legislation, you have the right:
- to be informed why, where and how we use your information
- to ask for access to your information
- to ask for your information to be corrected if it is inaccurate or incomplete
- to ask for your information to be deleted or removed where there is no need for us to continue processing it
- to ask us to restrict the use of your information
- to ask us to copy or transfer your information from one IT system to another in a safe and secure way, without impacting the quality of the information
- to object to how your information is used
- to challenge any decisions made without human intervention (automated decision making)
Please visit data subject rights for further details.
How to find out more or complain
Should you have any further queries on the uses of your information, please speak directly to our service:
The HAF team
Children’s Services
East Sussex County Council
To complain about the use of your information, please contact our Customer Services Team or our Data Protection Officer.
Further information on making a complaint.
You can also contact the Information Commissioner's Office (ICO) for further information or to make a complaint:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Phone: 0303 123 1113 (local rate)