Privacy

Privacy Policy

We take your privacy seriously. Find out more about when we collect personal data, why we collect it, and what we do with it.

INTRODUCTION

Uphill Primary School PTFA (the PTFA) was established in 1977 and is registered with the UK Charity Commission, Registration 279913. As a charity, our main objectives, as set out within our constitution are:

To advance the education of pupils in the school in particular by:

  • Developing effective relationships between the staff, parents and others associated with the school
  • Engaging in activities or providing facilities or equipment which support the school and advance the education of the pupils

In order to fulfil these objectives, the PTFA needs to conduct a number of business functions, some of which require us to collect, gather and process information that is considered personal information.

The way that the PTFA stores and processes this information must comply with the requirements of the Data Protection Act (1998) (DPA) where it constitutes personal data and, from the 25th May 2018, the General Data Protection Regulations (GDPR).

This document explains how your personal information is processed and provides information about the rights you have under data protection legislation. It explains how, for our different functions, what data we collect, how we use that data and what happens to that data when it is no longer required.

The document also explains how, and in what circumstances, your data may be shared with a third parties, and when data is moved internationally.

As an organisation, we have always endeavoured to be as data-light as we can be. We also never sell your details to anyone else. Our extensive use of Facebook groups ensures that you have full visibility of your own data within those groups. Increasingly there are other parts of our operations that may require personal information and we want to ensure we are transparent with you about what data we collect and how it will be used.

An explanation of the legal terms used in this document and your rights where we process your personal data can be found in the Additional Information section.

BUSINESS FUNCTIONS

  • Additional Information
  • Website
  • School Events
  • Competitions
  • Sponsorship
  • 100 Club
  • Mailing Lists
  • Committee Communications

ADDITIONAL INFORMATION

This section provides further explanation of some of the legal terms used, together with information about the rights available to you when the PTFA processes your personal data.

Legal basis for processing

The PTFA is required to provide information to demonstrate that the way in which it is processing personal information is lawful, which includes providing information on the legal basis for processing.

To process personal information, data protection law generally requires one or more of the following to apply:

  • The PTFA has consent from the person whose personal information is being processed. This will apply where we are using your information for marketing purposes;
  • The processing is necessary for performance of a contract or to enter into a contract with the person whose personal information is being processed;
  • The PTFA is required to process personal information to comply with a legal obligation;
  • The processing is necessary to protect the vital interests of the person whose information is being processed or another person;
  • The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority. This is unlikely to apply to the work carried out by the PTFA;
  • The processing is necessary for the purposes of legitimate interests of the PTFA or a third party, unless these interests are detrimental to the interests of the person whose information is being processed. Where the PTFA are relying on this basis, we have to explain what our legitimate interest is, which is included in the relevant sections above.

The legal basis for processing personal information used for each of our activities is provided under the section ‘How will the PTFA use my information?’.

For information, any new legislation that is passed by the UK Parliament that relates to the way in which personal data is processed will automatically apply to the PTFA’s activities.

Your Rights

Under the GDPR, you have a number of rights in relation to your personal information. You have the right to:

  • request access to your personal information;
  • request rectification of your personal information which means you are able to have inaccurate personal information corrected without undue delay;
  • request erasure of your personal information when certain conditions apply;
  • restrict processing under certain circumstances;
  • object to processing;
  • data portability in some circumstances.

Requests that relate to rectification, erasure or restricting processing will be passed to any recipients of your personal information. Details of recipients can be found under the section ‘Will my information be passed to anyone else?

There may be occasions when the PTFA is unable to comply with requests to exercise the rights above. Should this apply to a request you make, it will be explained to you why the PTFA is unable to comply with the request and any options available.

Where your personal information is being processed using consent, one further right is the right to withdraw your consent at any time. You should be aware that, while the PTFA will stop using your information for that purpose with immediate effect, it may not always be possible to remove information from the public domain, for example where it has been used in hard copy publications. You should also be aware that the ability to withdraw consent only applies to information considered to be personal. It does not usually apply to information about groups or organisations. You can find out how your personal information is being lawfully processed under the section ‘How will the PTFA use my information?’

You may withdraw your consent at any time for allowing your information to be used for marketing purposes.

Complaints

Should you be unhappy with the way in which the PTFA have processed your personal data, we would like to try and resolve this directly with you in the first instance. Please contact us at contact@uphillprimaryptfa.org.uk, to discuss your complaint. If you are unhappy with our approach, ultimately you have the right to lodge a complaint with the Information Commissioner, who regulates data protection legislation across the UK. Their contact details can be found at https://ico.org.uk/.

Contact Details

Uphill Primary School PTFA is the Data Controller for information collected and processed for each of the purposes described above unless stated otherwise.

If you have any queries regarding any of the information in this privacy notice, in the first instance please contact the PTFA’s Data Compliance Lead:

Toby Blackburn
Uphill Primary School PTFA
c/o Uphill Village Academy
Old Church Road
Uphill
BS23 4XH

toby.blackburn@uphillprimaryptfa.org.uk

WEBSITE

The PTFA operates a website to enable us to signpost those associated with the school to particular resources associated with the PTFA’s activities. Our website utilises cookies (small files stored on your device that are unique to your device) to enable us to provide some functionality of the site (e.g. logins, online shopping baskets etc…) and to generate statistics to determine how the site is being used. Your cookies don’t contain any personally identifiable material and we don’t utilise the cookies to cross-track you as you visit other websites. You can delete your cookies at any time and can also opt to block any non-essential cookies when you visit our website.

PUBLIC EVENTS

The PTFA periodically runs events which may require the purchasing of tickets. When you book a place at one of our events, we may need to process personal information about those who are booking the event as well as those planning to attend.

What information is collected?

For small-scale events, we need to collect information about who is attending the event, and who to contact in the event of an emergency.

For larger events, the PTFA uses a company to manage the booking process on our behalf, where they are made online (a processor). They will collect information required to process your booking and any payment required for that booking. This will include personal information that relates to the person attending the booking. Currently this is TicketSource. In cases where bookings are handled with a member of the PTFA, they are processed by the PTFA solely.

At the time of booking, we may also ask you for consent to send you information that may be of interest or benefit to you or the organisation or group you are representing. Please note that if you don’t provide your consent, we will be unable to send you this information.

How will the PTFA use my information?

The PTFA will use your personal contact information for the purpose of managing and administering the event. The legal basis for processing information is to pursue the legitimate interests of the PTFA and the person entering into a contract with the PTFA for delivery of services.

You may also book an event and enter into a contract directly with the PTFA. In these cases, the legal basis for processing your personal information will be to manage the performance of a contract. Where emergency contact details are held, the legal basis for processing this information is to protect the vital interests of the person whose information is being processed or another person.

Where you have provided consent for us to do so, the PTFA may also use your contact details to send you information that may be of interest or benefit to you or an organisation or group you are representing. You may withdraw your consent at any time.

Will my information be passed to anyone else?

The information that you provide will be passed to the relevant team within the PTFA that manage event bookings, and will also be accessible to those staff who work at the event. Information is obtained by a company on our behalf (a processor) and then passed to the PTFA.

Where you have consented to receive information about similar events, email addresses are passed to the company that manage and distribute this type of information on our behalf (a processor).

Processors may only act on our instructions. Your information is not passed to any other third party or recipient.

Will my information be transferred internationally?

As part of the booking process, the company the PTFA use on their behalf will take gather and process payment information. This information is not currently transferred outside of the UK. Please note that payment information is not passed to the PTFA. Companies used to process personal information on behalf of the PTFA who are based outside the UK must have signed up to the Privacy Shield, or have other appropriate safeguards in place as defined by law.

What happens to my information when it is no longer required?

Personal information will be destroyed 1 month after the event has been held.

The PTFA is legally required to keep some information relating to contracts and information about financial transactions. Information that relates to who attended the event, together with some information about payment transactions will usually be retained for 6 years from the end of the financial year in which the event was held. The PTFA will securely dispose of information as soon as it is no longer required.

You can ask to be removed from the mailing list for similar events and the PTFA will usually delete your contact details from those distribution lists within 7 days. There may be some circumstances where your details will be retained on our systems, for example if you have been in contact with us via email, however you will no longer receive information about events and parental engagement.

The PTFA also routinely monitors interaction with marketing communications. Your contact details will be automatically deleted from our marketing distribution list if you do not view a newsletter at least once every twelve months.

SCHOOL EVENTS

What information is collected?

For school events, we need to collect information about who is attending the event and, when requested, contact details of parents/carers who may be able to help run the event. The processing is necessary for the purposes of the PTFA managing attendance at the event and ensuring the safety of children attending the event.

How will the PTFA use my information?

The PTFA will use the personal information for the purpose of managing/administering the event and to ensure the safeguarding of children attending the event. Where contact details have been provided about the parent/carer, this will be used solely to contact the parent/carer regarding helping at the event. The legal basis for processing information is to pursue the legitimate interests of the PTFA.

Will my information be passed to anyone else?

The information that you provide will be passed to the relevant team within the PTFA that manage that particular event, and will also be accessible to those staff from Uphill School who will be assisting at the event.

Will my information be transferred internationally?

Information may be recorded on our cloud platform and held internationally. Our Data Processing Agreement with them is GDPR compliant.

What happens to my information when it is no longer required?

Personal information will be destroyed 1 month after the event has been held.

COMPETITIONS & RAFFLES

The PTFA periodically operates competitions which may require the submission of personal data.

What information is collected?

Depending on the competition, we may need to collect personal contact information about those entering the competition. If entry requires an online payment, this will include your email address, postal address and name.

How will the PTFA use my information?

The information you provide is used to contact you in the event of you winning the competition and is processed by the team within the PTFA operating the competition. Your postal address and email address is used to process payment with our payment partner (where applicable). The processing is necessary for the purposes of legitimate interests of the PTFA i.e. to process payment, identify and notify the winner of the competition.

Will my information be passed to anyone else?

Where applicable, the information will be used by our payment partner to validate your details and also by the PTFA for the purposes of operating the competition.

Will my information be transferred internationally?

Information may be recorded on our cloud platform and held internationally. Our Data Processing Agreement with them is GDPR compliant.

What happens to my information when it is no longer required?

Personal information held by the PTFA will be destroyed 1 month after the competition has been held. Details held by our payment partner will be maintained for as long as legislation requires them to hold financial records.

SPONSORSHIP

The PTFA periodically runs events where the participants can be sponsored in their endeavour. In order to sponsor someone we may utilise an online fundraising platform to process payments.

What information is collected?

When you sponsor someone, you are required to provide your name and contact email address. We utilise a third-party tool, JustGiving, as a processor to manage sponsorship schemes. They will collect information required to process your sponsorship and any payment required for that booking. This will include personal information that relates to the person sponsoring. The PTFA does not have access to data relating to the financial transaction. The processing is necessary for the purposes of establishing a contract for payment and the legitimate interests of the PTFA i.e. to inform sponsors of updates regarding the event they are sponsoring.

How will the PTFA use my information?

The PTFA will utilise your contact information to notify you of progress on the item being sponsored, and also to contact you with thanks for contributing to the sponsorship. The processing is necessary for the purposes of legitimate interests of the PTFA i.e. to inform you of progress of the event or notify you of changes to the event being sponsored.

When you sign up and consent to fundraising notifications, you have consented to the processing described above. You can withdraw this consent at any time with JustGiving.

Will my information be passed to anyone else?

Your contact details will be collected and stored with our payment processor (JustGiving), and we act as a controller for that data. Only the PTFA team member responsible for managing that sponsored event will be able to see contact data.

Will my information be transferred internationally?

As part of the booking process, the company the PTFA use on their behalf will take, gather and process payment information. This information is transferred to the USA as part of the process. Please note that payment information is not passed to the PTFA.

Companies used to process personal information on behalf of the PTFA who are based outside the UK must have signed up to the Privacy Shield Framework, or have other appropriate safeguards in place as defined by law.

What happens to my information when it is no longer required?

Data will be removed 1 month after the completion of the event for which sponsorship was obtained.

100 CLUB

The PTFA operates a subscription-based lottery called the 100 Club. Entry into the scheme requires submission of personal data.

What information is collected?

When you join the 100 Club you will be required to provide your name, your email address and a contact phone number. The processing is necessary for the purposes of legitimate interests of the PTFA i.e. to identify/notify the winner of the competition and to contact the individual regarding annual renewal. If paying online our payment partner will also collect contact details.

How will the PTFA use my information?

Your data will be used to contact you in the event of you winning on the scheme, and also to contact you regarding renewal of your membership to the scheme. Our payment partner will use your contact data to authorise your online payment.

Will my information be passed to anyone else?

Where applicable, the data will be shared with our payment partner and processed by the appropriate member of PTFA team.

Will my information be transferred internationally?

Information may be recorded on our cloud platform and held internationally. Our Data Processing Agreement with them is GDPR compliant.

What happens to my information when it is no longer required?

If you choose not to renew your membership to the 100 Club, your contact details will be deleted within 1 month of you leaving the scheme.

MAILING LISTS

The PTFA has introduced an email mailing list in order for it to reach parents and carers who don’t use social media, or who desire a different means of communication to make finding relevant information easier

What information is collected?

In order to email you we need to collect your name and email address to enable us to pass messages to you and identify you for the purposes of the communication. We also optionally gather information about your child’s year group to enable us to send you information where relevant to a particular year group. It is a legitimate interest of the PTFA to be able to effectively communicate with parents in as broad a manner as possible.

How will the PTFA use my information?

The PTFA will use your name and email address to create and send emails to you informing you of events and activities relating to the PTFA’s fundraising efforts.

Will my information be passed to anyone else?

The data will be passed to our data processor (MailChimp) for the purposes of issuing you emails. We do not pass your details to other third parties for any reason.

Will my information be transferred internationally?

Information may be recorded on our cloud platform (MailChimp) and held internationally. Our Data Processing Agreement with them is GDPR compliant.

What happens to my information when it is no longer required?

Each mail you receive from us includes the option to remove yourself from our mailing list or amend your communication preferences. When you opt to remove yourself, your data will be removed within 24 hours and you will be notified by email of your change in permission. If you request for all data to be removed, this will be completed within 30 days.

COMMITTEE COMMUNICATIONS

The PTFA consists of a number of members and committee members who manage its day-to-day operations. In order to undertake these tasks effectively and in a transparent manner, personal information may be collected and shared regarding the decisions made by the committee.

What information is collected?

When you undertake a task or action within the PTFA you are required to submit your name, and in certain circumstances, your email address. The processing is necessary for purposes of legitimate interests of the PTFA i.e. to record minuted actions and notify members of upcoming meetings. Certain committee members may also have legal duties which require them to share these details as a legal obligation i.e. trustees.

How will the PTFA use my information?

The PTFA will use your name to record any actions or agenda items associated with you in formal minutes. The PTFA will use your email address to contact you solely about matters associated with the running of the committee itself, such as notifying you of meeting dates or constitutional matters.

Will my information be passed to anyone else?

The data will be processed solely by the PTFA committee.

Will my information be transferred internationally?

Information may be recorded on our cloud platform and held internationally. Our Data Processing Agreement with them is GDPR compliant.

What happens to my information when it is no longer required?

In the event of you leaving the PTFA committee, your details will be removed from our systems 1 month following the submission of annual accounts to the charity commission for the year in which you leave.

Last Updated: 23rd November 2020