Under data protection law, individuals have a right to be informed about how Edstart uses any personal data that we hold about you or your children. We comply with this right by providing this Privacy Notice to individuals where we are processing their personal data.This privacy notice explains how we collect, store and use personal data.We, Edstart, 78 Chorley New Road, Bolton, BL1 4BY are the ‘data controller’ for the purposes of data protection law.Our data protection officer is Diane Brown (see ‘Contact us’ below).
1. The personal data we hold
Personal data that we may collect, use, store and share (when appropriate) about you or your child includes, but is not restricted to:
- Contact details, contact preferences, date of birth, identification documents
- Parent’s Bank/Payment card details
- Results of internal assessments and externally set tests
- Pupil and curricular records
- Photographs
- CCTV images captured on Edstart Premises
We may also collect, store and use information about you that falls into "special categories" of more sensitive personal data. This includes information about (where applicable):
- Attendance information
- Characteristics, such as race or ethnic background, or special educational needs
- Details of any medical conditions, including physical and mental health
- Safeguarding information
- Details of any support received and support providers
In relation to the special category, personal data that we do process we do so on the basis that:
- The processing is necessary for reasons of substantial public vital interest, on a lawful basis;
- It is necessary for the establishment, exercise or defence of legal claims;
- Based on your explicit consent
We may also hold data that we have received from other organisations, including schools, local authorities and the Department for Education.
2. Why we use this data
The table below describes main purposes for which we process your personal information, the categories of your information involved and our lawful basis for being able to do this.
Personal information used
To administer your account and manage our relationship with you, including dealing with payments, support, service or club related enquiries made by you.
All contact and registration details, transaction and payment methods, records of your interactions with us, and marketing preferences.
This is necessary to enable us to properly manage and administer your registration with us.
To send you information about the running of Edstart (such as emergency cancellations) and upcoming events.
This is necessary to enable us to properly manage and administer your account with us.
To send you other marketing information we think you might find useful or which you have requested from us, including information about accounts, events, and any other club related information.
Contact details andmarketing preferences.
Where you have given us your explicit consent to do so.
To answer your queries or complaints.
Contact details and records of your interactions with us.
We have a legitimate interest to provide complaint handling services to you in case there are any issues with your account.
All the personal information we collect.
We have a legitimate interest in retaining records whilst they may be required in relation to complaints or claims. We need to retain records for a period of 6 years in order to properly administer and manage your account and run our club and in some cases we may have legal or regulatory obligations to retain records.We process special category personal data on the basis of the “special category reasons for processing of your personal data” referred to in section 1 above.
To conduct data analytics studies to better understand event attendance and trends within Edstart Clubs.
Records of your attendance at any activities or clubs hosted by us.
We have a legitimate interest in doing so to ensure that our activities are targeted and relevant.
For the purposes of promoting our activities, clubs, fitness apps and franchises.
Images in video and/or photographic form.
Where you have given us your explicit consent to do so.
To comply with health and safety requirements.
Records of attendance, medical information about your health.
We have a legal obligation and a legitimate interest to provide you and other members of our organisation with a safe environment in which to participate in clubs and activities.We process special category personal data on the basis of the “special category reasons for processing of your personal data” referred to in section 1 above.
To use information about your disabilities, health and medical history physical (including any injuries) to ensure your health and safety.
Health and medical information.
We process special category personal data on the basis of the “special category reasons for processing of your personal data” referred to in section 1 above.
To gather evidence for possible grievance or disciplinary hearings.
All the personal information we collect.
We have a legitimate interest in doing so to provide a safe and fair environment for all members and to ensure the effective management of any disciplinary hearings, appeals and adjudications. We process special category personal data on the basis of the “special category reasons for processing of your personal data” referred to in section 2 above.
For the purposes of equal opportunities monitoring.
Name, title, date of birthgender, information about your race or ethnicity and health and medical information.
We have a legitimate interest to promote a sports environment that is inclusive, fair and accessible.We process special category personal data on the basis of the “special category reasons for processing of your personal data” referred to in section 2 above.
To comply with legal obligations, for example, regarding people working with children or vulnerable adults to comply with our safeguarding requirements.
Information about your criminal convictions and offences.
For criminal records history we process it on the basis of legal obligations or based on your explicit consent.
3. Collecting this information
If you do not provide us with the requested personal information we may not be able to create your account, or we may not be able to comply with legal obligations which may lead to termination of your registration.
Where we have obtained consent to use personal data, this consent can be withdrawn at any time. We will make this clear when we ask for consent and explain how consent can be withdrawn.Some of the reasons listed above for collecting and using participants’ personal data overlap, and there may be several grounds which justify our use of this data.
4. How we store this data
We keep personal information about you and your child while they are participating in our services. We need to retain records for a period of 6 years in order to properly administer your account and run our club.We may also keep it beyond this if this is necessary in order to comply with our legal obligations. Our records management policy sets out how long we keep information about participants.A copy of which can be requested on contacting Edstart.
5. Direct Marketing
Email, Post, Phone and Social Media: from time to time, we may contact you by email, post, phone or social media about products and services we believe you may be interested in.We will only send marketing messages to you in accordance with the marketing preferences you set. You can then let us know at any time that you do not wish to receive marketing messages. You can also unsubscribe from our communications by clicking on the unsubscribe link in the messages we send to you.
6. Data sharing
We do not share information about participants with any third party without consent unless the law and our policies allow us to do so.Where it is legally required, or necessary (and it complies with data protection law) we may share personal information about participants with:
- Our local authority, Government departments or agencies, to meet our legal obligations to share certain information with it
- Family members and representatives - we would ask for consent to share personal data with family members or representatives unless there was an emergency situation when we would rely on the lawful basis of vital interest
- Survey and research organisations, Health and social welfare organisations and health authorities – where we are not legally obliged to share your personal data with such organisations we would always obtain explicit consent to share any personal data
- Police, Law Enforcement and Security Services: to assist with the investigation and prevention of crime and the protection of national security
7. Transferring data internationally
When we transfer personal data to a country or territory outside the European Economic Area, we will do so in accordance with data protection law.
8. Parents and participants’ rights regarding personal data
Individuals have a right to make a ‘subject access request’ to gain access to personal information that Edstart holds about them.Parents/carers can make a request with respect to their child’s data where the child is not considered mature enough to understand their rights over their own data (usually under the age of 12), or where the child has provided consent.If you make a subject access request, and if we do hold information about you or your child, we will:
- Give you a description of it
- Tell you why we are holding and processing it, and how long we will keep it for
- Explain where we got it from, if not from you or your child
- Tell you who it has been, or will be, shared with
- Let you know whether any automated decision-making is being applied to the data, and any consequences of this
- Give you a copy of the information in an intelligible form
Individuals also have the right for their personal information to be transmitted electronically to another organisation in certain circumstances.If you would like to make a request, please contact our data protection officer.
Other rights
Under data protection law, individuals have certain rights regarding how their personal data is used and kept safe, including the right to:
- Object to the use of personal data if it would cause, or is causing, damage or distress
- Prevent it being used to send direct marketing
- Object to decisions being taken by automated means (by a computer or machine, rather than by a person)
- In certain circumstances, have inaccurate personal data corrected, deleted or destroyed, or restrict processing
- Claim compensation for damages caused by a breach of the data protection regulations
To exercise any of these rights, please contact our data protection officer.
9. Changes to this Notice
We may update this privacy notice from time to time. When we change this notice in a material way, we will update the version date at the bottom of this page. For significant changes to this notice we will try to give you reasonable notice unless we are prevented from doing so. Where required by law we will seek your consent to changes in the way we use your personal information.
10. Contact us
If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact our data protection officer:
Diane Brown by email as follows d.brown@datasmartdps.com
11. Complaints
We take any complaints about our collection and use of personal information very seriously.If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our data processing, please raise this with us in the first instance.To make a complaint, please contact our data protection officer.Alternatively, you can make a complaint to the Information Commissioner’s Office:
- Report a concern online at https://ico.org.uk/concerns/
- Call 0303 123 1113
- Or write to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
