PRIVACY NOTICE

The General Data Protection Regulation (GDPR) comes into effect on 25th May 2018. It has been agreed that SALLY WALSH, will be appointed as Data Protection Officer (DPO) and is therefore responsible for the safe storage of information relating to our students and parents. This Notice will provide information on how we,THE WALSH ACADEMY are complying with this Regulation.

Purpose and Statement:

THE WALSH ACADEMY is committed to ensuring the data processed by our charity remains safe and secure.

This policy has been written in line with legislative change, including both the Data Protection Act (1998) and the EU’s General Data Protection Regulation (GDPR).

THE WALSH ACADEMY has determined the lawful reasons with which it processes personal data:

Legal obligation – GDPR Article 6(1)(c)

Legitimate interest – GDPR Article 6(1)(f)

Contract – GDPR Article 6(1)(b)

There is also some limited data we process with consent from the Data Subject; Consent – GDPR Article 6(1)(a).  

While THE WALSH ACADEMY avoids sharing data with third parties at most times, some data is shared in accordance with our business practices. The sharing of data with third parties will always be consensual with the data subject and/or their parent/guardian, and only if [V is satisfied that their Data Protection policy is GDPR compliant.

Main Aims for the policy:

·       Specify the dataTHE WALSH ACADEMY collect, how it is stored/protected and the reason for collecting it

·       State howTHE WALSH ACADEMYuse personal data in processing

·       Disclose who has access to the data and how long we retain information for

·       Explain Data Subject’s rights withTHE WALSH ACADEMY] data including access, rectification and erasure

The GDPR includes the following rights for individuals:

·       the right to be informed

·       the right of access

·       the right to rectification

·       the right to erasure

·       the right to restrict processing

·       the right to data portability

·       the right to object

·       the right not to be subject to automated decision-making including profilin

General Principles

THE WALSH ACADEMY is committed to providing fair and understandable privacy policies in relation to personal data.

THE WALSH ACADEMYwill, at all times, keep data in secure locations (including, but not limited to, encrypted and access restricted files) and not retain data unnecessarily or past the retention length as set out in this policy.

In the rare instance a data processor that is not anTHE WALSH ACADEMY employee is used, such as a third party, the data subject will either be asked for consent pre to supplying the data or be notified and have the right to object to processing.

THE WALSH ACADEMY  customers and participants supply their personal data when signing up for classes through our registration form either via the website, or via paper form.
This is either completed by a parent/guardian or the child themselves if they deemed able to do so.
Personal data may also come to us unsolicited via enquiries through our website and to our generic email account.

To attend any of THE WALSH ACADEMY’s activities participants/parents/guardians must agree to some processing of their personal data. This is due to Legitimate Interests – GDPR Article 6(1)(f), Legal Obligation GDPR Article 6(1)(c), Contract – Article 6(1)(b) and/or Consent – Article 6(1)(a).

Should THE WALSH ACADEMY be unable to process participant’s data, we would be contravening both our Health & Safety and Child Safeguarding policies. We would also be ignoring best practice regarding working with children/vulnerable adults.

Our participants must remain safe at all times, therefore information about participants must be collected in order to create registers and accurate student records. This information is also used to provide students with appropriate classes, including dividing students into age groups.

Special category data is only collected with the consent of the data subject. Special category data THE WALSH ACADEMY  collects includes but is not limited to: Medical/Disability information, Income information, Ethnicity, Gender and Sexuality.

As physical activity providers it is essential that this consent is given should a participant have any medical/disability needs. This allows us to incorporate participants safely into classes. It is also used in assessing if we can incorporate participants safely into classes.

Income information is only collected in instances where a participant applies to attend our classes at a concessionary price, or on a bursary. This financial support is means tested, and therefore is subject to documented proof. Proofs of entitlement to concession are shredded after the entitlement has been noted.

Ethnicity and other sensitive data is to provide information to funding bodies for statistical purposes. This data is always provided to third-parties as quantified data (i.e. cumulative numerical data only with no identifying information relating to any data subject).

Personal data and some special category is collected.

It is essential to our primary function (providing classes to participants) that we are provided, and allowed to process and store the following:

Participant Personal Data:

Full Name – GDPR Article 6(1)(f)

Date of Birth – GDPR Article 6(1)(f)

Home Address – GDPR Article 6(1)(f)

Sex – GDPR Article 6(1)(f)

Permission to go home alone – GDPR Article 6(1)(f)

School/Educational Institution – GDPR Article 6(1)(f)

Exam results (vocational exams taken through [SCHOOL NAME]  only) – GDPR Article 6(1)(f)

Classes attended/Price paid – GDPR Article 6(1)(f)

Participant Special Category Data:

Medical Information/History – GDPR Article 9 (a)

Disability Information – GDPR Article 9 (a)

Ethnicity – GDPR Article 9 (a & j) – further explicate consent sought

Gender/Sex – GDPR Article 9 (a & j) – further explicate consent sought

Sexuality – GDPR Article 9 (a & j) – further explicate consent sought

Parent/Guardian Personal Data:

Name – GDPR Article 6(1)(f)

Address – GDPR Article 6(1)(f)

Email Address – GDPR Article 6(1)(f)

Mobile Telephone Number – GDPR Article 6(1)(f)

Work/Home Number – GDPR Article 6(1)(f)

Emergency Contact Number – GDPR Article 6(1)(f)

Parent/Guardian Special Category Data:

Concession Type – further explicate consent sought

Documented proof of financial need – further explicate consent sought

Bank Details – further explicate consent sought in the instance of refunds etc.

THE WALSH ACADEMY  transports data with all due diligence. Enrolment forms are sent to THE WALSH ACADEMYthrough an encrypted email server directly from our website which has controlled access. Received enrolment forms are stored on an encrypted email server for no more than 6 months. Received paper enrolment forms are destroyed after no more than 4 weeks.

Data received through enrolment forms is uploaded manually into our database software. Our database is stored both in encrypted files on office-based hardware and backed up regularly in our encrypted cloud-based server. Access to these files is restricted through password protection and only available to authorised staff members.

Registers and emergency contact lists created from student data are stored in encrypted files on office-based hardware and backed up regularly in our encrypted cloud-based server. Access to these files is restricted through password protection and only available to authorised staff members. 

Hard copies of registers and emergency contacts are carried by authorised staff members. They are locked away while not in use. When they are no longer in use or out-dated, they are destroyed thoroughly.  

Waiting lists are stored on an encrypted cloud-based server.

Our standard retention policy (without the data subject’s right to access, rectification and erasure etc.) is THREE YEARS post final attendance.

Exceptions to our retention policy:

·       Financial records are kept for 6 years due to legal obligation

·       First Aid records are kept for 21 years due to legal obligation

·       Photo consent may be kept indefinitely

·       Child Safeguarding records are kept indefinitely on a case-by-case basis, the minimum these will stored for is 6 years due to legal obligation

·       Bank details are deleted after the action concerning them is complete

·       Enquiries that do not turn into bookings with current classes are deleted after they have been dealt with

·       [SCHOOL NAME]  does not actively share data with third parties, however there are certain instances where sharing information is crucial to our business processes.