IPAL Booking System Privacy Notice

  Sheffield Holiday Activities with Food Programme 2021 (HAF)

This Privacy Notice explains how personal information is going to be used, what for, who it will be shared with and why.

Sheffield City Council have commissioned with Department of Education funding HAF providers to deliver the Sheffield Activities with Food Programme 2021.

The iPAL Booking System provided by Complete Education Solutions (CES) complies with the Data Protection Act 2018 and the UK General Data Protection Regulation (GDPR). CES is registered with the Information Commissioner’s Office (ICO) as a Data Controller (Registration number: ZA788348).

The iPAL Booking System has been purchased by the Sheffield Manor Castle Development Trust (MCDT) for use by HAF providers.

For the purpose of data protection legislation, Sheffield HAF providers using the IPAL booking system are joint data controllers. Article 26(1) of the UK GDPR states that ‘Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers.’

Sheffield City Council is a data processor:

  • For the purpose of providing a helpline to support parents/children with any queries in relation to registration or booking activities on IPAL
  • For creating and administering accounts on iPAL for HAF providers

For the purpose of fulfilling the Department of Education Monitoring Requirements for the HAF programme We do not require any personal identifiable information for this task but provide anonymised reports of take-up of the activities.

Why we collect and use Personal Data about you

We process personal data on the basis of you/ your child’s consent to enable their enrolment on the Holiday Activities with Food Programme and, if requested by you/your child to keep you/ your child informed about the programme.

Why our use of your personal data is lawful?

In order for the use of your personal data to be lawful, it needs to meet one (or more) conditions in the data protection legislation. The legal basis for processing the personal data is Article 6(1)(a) of the UK General Data Protection Regulation (GDPR) where “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”.

The processing of special category data (for example, health or ethnicity information) is necessary for the purpose of supporting children during the activity, where they have special needs. In the case of a child’s ethnicity, the voluntary provision of this information is used (anonymously) to evaluate the existence or absence of equality of opportunity or treatment between persons. Our lawful basis for collecting and using this information is permitted under Article 9(2)(a) of the UK GDPR, because the child or parent/carer has given explicit consent to the processing for these purposes.

What information do we collect about you? 

Parents and Carers  

  • Name, gender, address and contact details/legal parent/guardian


  • Name and address
  • Date of birth
  • Self-declaration of Special Educational Needs
  • Self -declaration of Medical Need/Allergies
  • Self-declaration if Free School Meals entitlement
  • Ethnicity and Gender, English as first language (this will be anonymised and used to inform future projects in Sheffield
  • an e-mail address if you are happy to be contacted for evaluation purposes and receive further information about the Sheffield Healthy Holidays programme

Who we share your personal data with? 

  • Holiday Activates with Food Strategic Delivery Partners
  • Holiday Activates with Food Holiday Club Providers


How long will we keep your information?

We will only keep your information for as long as we need to so we can deliver the Holiday Activities with Food Programme.

However, with your consent we can hold you/your child’s information for the purpose of informing you about further children’s activities/services beyond the Summer Holiday activities with Food Programme.

Your/your child’s data will not be shared without checking with you or your child. It will be kept securely and up to date.


Your Rights

You have the right to:

  1. Ask to see the personal information we hold about you
  2. Ask us to change information we hold about you if it is wrong
  3. Ask us to delete the information we hold about you
  4. Ask us to limit the way we use your personal Information
  5. To object to direct marketing (including profiling) and processing for the purposes of scientific/historical research and statistics
  6. Complain to the Information Commissioner’s Office

Withdrawal of Consent

Because we are processing you/your child’s personal data because you have said we can, you have the right to withdraw that consent at any time.

Manor Castle Development Trust (MCDT) on behalf of all HAF providers are the contact point for your child/you for you to exercise these rights. Contact: MCDT info@manorandcastle.org


You have the right to submit a complaint if you are unhappy with the way your request is handled or disagree with a decision made by MDCT who are hosting IPAL regarding your data. In these circumstances you can contact the MDCT and request a review of the decision.

If you are not satisfied with the MDCT decision you may wish to apply to the Information Commissioner’s Office for a decision at:

The Information Commissioner’s Office,
Wycliffe House,
Water Lane,
SK9 5AF.


The Information Commissioner is the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.


This version was last updated on 13 July 2021