Commercial Activities Privacy Notice
St James Schools
October 2020
St James Schools
Commercial Activities Privacy Notice
2
Introduction
This notice explains how we use your personal information in relation to St James Enterprises Limited. It also explains the decisions that you can make about your information. This notice applies to the following services:
• The hire and use of our facilities:
o for short term non-residential hires and for non-sports-related hires (for example, where a hirer is a company or individual hiring our facilities for a conference or a wedding); and
o for sports hires, where a hirer uses our facilities for sports or physical recreation.
• Conferences
• Summer schools / holiday clubs
These facilities, activities and services are referred to in this notice as the "services".
St James Enterprises Limited is operated by Independent Education Association Limited (the "Company"). The Company has been set up by St James Schools (the "School") in order to run the services and to make them available to the public.
The Company is responsible for your personal information, or to use data protection terminology, the Company is a "controller" or "data controller" of your personal information.
Often the Company will need to share personal information with the School. In these circumstances, the School will also be a controller of your personal information. Please see the section called "The relationship between the School and the Company" immediately below for more information. Accordingly, this notice applies to both parties' use of personal information in relation to the services. This means that references in this notice to words such as "us" or "we" or "our", is a reference to both the Company and the School.
The purpose of this notice is to help you understand how and why your personal information is collected in relation to the services and what we do with that information. It also explains the decisions that you can make about your information.
If you are a pupil, parent, staff member or governor at the School, please see our other privacy notices applicable to you. A link to these can be found on the School website.
This notice applies to children as well as to their parents. If your child is aged 12 years or older, they are usually considered to have the understanding to exercise their own data protection rights, and we should be grateful if you would please show this notice to your child.
If you have any questions about this notice, please contact the External Events Manager whose contact details are events@stjamesenterprises.co.uk or 01784 266 935. If the External Events Manager is not available, you can contact the Chief Operating Officer on 0207 348 1700 or by email to: coo@stjamesschools.co.uk, in relation to any of the matters set out in this notice.
St James Schools
Commercial Activities Privacy Notice
3
The relationship between the School and the Company
The School is heavily involved in the Company's activities and accordingly, the Company will, where appropriate, share any of the information it holds about you with the School in connection with any of the purposes described in this notice. For example:
• If you make a complaint, the Company would share details of that complaint with the School so that the School can assist the Company in responding to the complaint. The School will also check to see if the complaint is relevant to the School's own activities. For example, if the complaint concerned a safeguarding issue, this would also be relevant to the School's safeguarding duties.
• If you take part in one of our activities and you are also a pupil at the School, then we will share information about your participation in that activity with your teachers if relevant.
• The School has its own legal obligations as a charity and a school, which means that it may also need to use your personal information for its own purposes (for example, reporting to the relevant authorities if something has gone wrong) and may share your personal information with external agencies such as the local authority.
How we use your information
Our main reason for using your personal information is to enable the Company to provide its services to you and others.
We collect personal information direct from you when you enquire about the services. If you are a customer of the Company then we will collect and use your name, email address, telephone number, address, payment details and information about your requirements so that the Company can provide the services.
If you have a contract with the Company, for example, if you have booked the use of our facilities then we will use your information in order to:
• Provide the services you have booked. We will keep a record of your booking, including the facilities you have booked, and any specific requirements. This is to help ensure that we provide the services you have booked.
• To inform you about circumstances which may affect your use of the services, for example unexpected closures.
• Ensure that you comply with your obligations under the booking. For example, we will take payment details from you to make sure we get paid for the use of the services.
Using your personal information in this way is necessary for the performance of the contract between you and the Company. We may also need to use your personal information in order to take steps prior to entering into a contract, for example where you ask us to clarify something before you make your booking.
We also use personal information for other purposes related to your use of the services. This applies whether or not you have a contract with us. For example, it applies to both our customers and also to anyone else who uses the services (for example, any guest that a customer has brought onto site and
St James Schools
Commercial Activities Privacy Notice
4
children whose parents have paid for them to attend a holiday activity). These other purposes are as follows:
• To enable the Company to provide the services. For example, we will keep a record of your booking, and any specific requirements.
• To improve the services for you and other users. For example, we may keep a record of your preferences and interests to enable us to deliver a better service. If you give us feedback, we will use that in order to improve. This is necessary for our legitimate interest in managing what we offer and improving the services.
• To make any adjustments, for example, if you ask us to change how you access the services because of a disability you have. We also use personal information in order to help make sure that the services are used in an appropriate way and to reduce and manage the risks to you and other users. As part of this we will use information concerning your health, condition, and any disability you may have. We, and the other users of our services, have a legitimate interest in ensuring that the services are used appropriately and safely. In addition, we have a legal obligation under health and safety laws to make sure that our services are used appropriately.
• To make sure that you are complying with our rules and using the services appropriately. If we stop you using any services (for example, because of your bad behaviour) we will keep a record of that and we may prevent you from using the services in future. As with the above, we, and the other users of our services have a legitimate interest in ensuring that the services are used appropriately and safely.
• If you attend one of our holiday clubs / summer schools we have a legitimate interest in processing information concerning your participation, including your progress and attainment.
• If there is a problem, for example, if you or someone else has made a complaint then we have a legitimate interest in using personal information in connection with that complaint, for example, so that we can find out what happened and put things right.
• We have a legitimate interest in using CCTV to make sure the site is safe and so that we can investigate if there is a problem.
• We may also take photographs of you when you take part in our activities or use our services. The photographs will be used in connection with our publicity, for example, they may appear on our websites, promotional material and on social media. We have a legitimate interest in publicising our activities. We may ask for your consent before taking or using some photographs and videos if the photograph or video is more intrusive and we cannot rely on legitimate interests. If we ask for your consent to use your personal information you can take back this consent at any time. Please speak to the External Events Manager if you would like to withdraw any consent that you have given.
We also have a legitimate interest in using your personal information in other ways as follows:
• Regardless of the relationship we have with you, we may need to use your personal information for legal reasons such as fraud prevention and to check that you are complying with our rules or terms and conditions and to enforce our legal rights. In addition to this
St James Schools
Commercial Activities Privacy Notice
5
being in our legitimate interests, if we have a contract with you such use is necessary for the performance of that contract. • We may need to use your information in order to protect our interests, for example, if you post a comment on a review website then we may provide a response to that comment or contact you directly to discuss your feedback. This is necessary for our legitimate interest in protecting our reputation and in order to help us improve.
• We may share information about you with our professional advisors, and our insurers, for example, where there is a serious incident. We may share your personal information with our legal advisors or insurers.
• In limited circumstances we may use your information to protect your vital interests or the vital interests of someone else (for example, if you or they are seriously hurt).
• We may perform due diligence on those we contract with. This can include in the form of credit checks on companies, including checking photographic identification and proof of address of directors and, in some cases, your shareholders, and verification of the company registration details. We do this to comply with our legal obligations, and as necessary for our legitimate interests of checking that the entities we contract with are financially viable and would not cause us reputational damage.
• We may share your information with debt recovery suppliers if you do not pay any fees owed to us. In addition to legitimate interests, this is also necessary for the performance of the contract between us.
We use contractors to handle personal information on our behalf for the following purposes:
o If we use outside caterers, we may share information about dietary needs and requirements;
o IT consultants who might access information about you when checking the security of our IT network;
o we use a company to assist us with our marketing emails; and
o we also use a service provider for processing online payments.
• Where you are an employee of a customer or contractor, we process your name, job title and business contact details in connection with performing our contract with your employer. This is for our legitimate interest in providing the services to your employer.
Please note that we may process your personal information without your knowledge or consent where this is required or permitted by law.
If you have any questions about any of the above, please speak to the External Events Manager.
How we use information about children and family members
We have additional obligations because children use our services. This includes children who are pupils at the School.
St James Schools
Commercial Activities Privacy Notice
6
We may share information about you with others in your family, such as a parent or step-parent. For example, where this is part of our obligation to take care of you or your child, as part of our wider legal and regulatory obligations.
We may share your information with others as set out below where there is a legal obligation to do so:
• With local authorities, the Independent Schools Inspectorate and the Department for Education.
• With the Health and Safety Executive if there has been a health and safety incident.
• With the Charity Commission, for example, in the event of a serious incident. This is because the School is a charity.
• With the police for the prevention and investigation of crime and the prosecution of offenders. This will only be done in specific circumstances to assist the police with their investigations.
Sometimes we will share information as described above even if we do not have a legal obligation to do so. This is for our legitimate interest in ensuring that the services run properly and so that we can benefit from the advice and guidance from the relevant agencies. In many cases, sharing the information will also be in the public interest.
If you are an existing pupil or parent of the School, then we will use your personal information in connection with your (or your child's) education and welfare. For example, if you are a pupil we may tell your teachers if you have done especially well at an activity during a holiday camp or if you have misbehaved when taking part in one of our activities. Further information about how we use personal information of School pupils and parents can be found in the School Policies section of the website.
Keeping you updated
We may contact you with marketing material by email, telephone, post or by text message but we will only do this where we are allowed to do so under data protection law. Sometimes we will need your consent first.
For example, we may send you information about conferences, events, and activities that you and / or your children may be interested in.
If you tell us that you do not want to be contacted for any of these purposes, then we will of course respect that. Any use of your information before you withdraw your consent remains valid. Please speak to the External Events Manager if you would like to withdraw any consent that you have given.
Particularly sensitive information
We have extra obligations when we process particularly sensitive information. This includes what is called "special category" personal information under data protection law. The categories of information we are concerned about are as follows: personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information, health information, information about sex life or orientation, and information about criminal, convictions or offences. We may process "special category" personal information as follows:
St James Schools
Commercial Activities Privacy Notice
7
• We may need to use information about your health or condition, any disability you may have, or any care that you may need, so that we can make adjustments for you. For example, in respect of access or dietary requirements or in connection with the use of our services.
• We may hold health information about you so that we can take care of you if you have an accident or are unwell.
Using personal information in this way is in the substantial public interest. It may also be necessary for medical purposes.
We may only use information relating to criminal convictions and offences where the law allows us to do so. This will usually be where such processing is necessary to carry out our obligations or to exercise our rights.
Less commonly, we may use information relating to criminal convictions and offences where it is necessary in relation to legal claims, where it is necessary to protect our pupils and you are not capable of giving your consent, or where you have already made the information public.
How long will we use your personal information for?
We only retain your personal information for as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.
If you have a contract with us, then we will typically keep information for six years after the contract is finished. However, there are some exceptions to this, notably if you are an existing pupil or parent of the School.
Further information on our retention periods can be found in our Information and Records Retention Policy on the School website.
Your rights in relation to our processing of your personal information
You have the following rights:
• Correction: if information we hold about you is incorrect you can ask us to correct it.
• Access: you can also ask what information we hold about you and be provided with a copy. This is commonly known as making a subject access request. We will also give you extra information, such as why we use this information about you, where it came from and what types of people we have sent it to.
• Deletion: you can ask us to delete the information that we hold about you in certain circumstances. For example, where we no longer need the information.
St James Schools
Commercial Activities Privacy Notice
8
• Portability: you can request the transfer of your information to you or to a third party in a format that can be read by computer. This applies where (a) the information has been provided by you; (b) the basis that we are relying on to process your information is consent or contract; and (c) the information is being processed by us on computer or other automated device such as a mobile phone.
• Restriction: you can request that we restrict how we use your personal information.
• Object: you may object to us using your information where:
o we are using it for direct marketing purposes (for example, to send you marketing information about our services);
o the legal basis on which we are relying is either legitimate interests or performance of a task carried out in the public interest; and
o if we ever use your information for scientific or historical research purposes or statistical purposes.
If you fail to provide certain information when requested, we may not be able to perform our obligations under the contract we have entered into with you. We may also not be able to provide the services. We may also be prevented from complying with our legal obligations (such as to ensure the welfare of your child and their classmates). Failing to provide information may also adversely affect the education and care we are able to provide to your child.
You have a right to lodge a complaint with a data protection supervisory authority. The supervisory authority in the UK is the Information Commissioner's Office - ico.org.uk. If you do have any concerns about how we have handled your personal information we would kindly ask that you contact us in the first instance before you speak to the ICO so that we have an opportunity to put things right.
If we delete your personal information or restrict our use of it, we may not be able to provide our services to you.
If you want to exercise any of your rights, you can contact us at events@stjamesenterprises.co.uk. We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights).
St James Enterprises Limited is a company Registered in England and Wales: Company Number: 11153595 and the registered office is Earsby Street, London, W14 8SH.
