IPAL Booking System Privacy Notice
Sheffield Holiday Activities with Food Programme 2021 (HAF)
This Privacy Notice explains how personal information is going to be used, what for, who it will be shared with and why.
Sheffield City Council have commissioned with Department of Education funding HAF providers to deliver the Sheffield Activities with Food Programme 2021.
The iPAL Booking System provided by Complete Education Solutions (CES) complies with the Data Protection Act 2018 and the UK General Data Protection Regulation (GDPR). CES is registered with the Information Commissioner’s Office (ICO) as a Data Controller (Registration number: ZA788348).
The iPAL Booking System has been purchased by the Sheffield Manor Castle Development Trust (MCDT) for use by HAF providers.
For the purpose of data protection legislation, Sheffield HAF providers using the IPAL booking system are joint data controllers. Article 26(1) of the UK GDPR states that ‘Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers.’
Sheffield City Council is a data processor:
- For the purpose of providing a helpline to support parents/children with any queries in relation to registration or booking activities on IPAL
- For creating and administering accounts on iPAL for HAF providers
For the purpose of fulfilling the Department of Education Monitoring Requirements for the HAF programme We do not require any personal identifiable information for this task but provide anonymised reports of take-up of the activities.
Why we collect and use Personal Data about you
We process personal data on the basis of you/ your child’s consent to enable their enrolment on the Holiday Activities with Food Programme and, if requested by you/your child to keep you/ your child informed about the programme.
Why our use of your personal data is lawful?
In order for the use of your personal data to be lawful, it needs to meet one (or more) conditions in the data protection legislation. The legal basis for processing the personal data is Article 6(1)(a) of the UK General Data Protection Regulation (GDPR) where “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”.
The processing of special category data (for example, health or ethnicity information) is necessary for the purpose of supporting children during the activity, where they have special needs. In the case of a child’s ethnicity, the voluntary provision of this information is used (anonymously) to evaluate the existence or absence of equality of opportunity or treatment between persons. Our lawful basis for collecting and using this information is permitted under Article 9(2)(a) of the UK GDPR, because the child or parent/carer has given explicit consent to the processing for these purposes.
What information do we collect about you?
Parents and Carers
- Name, gender, address and contact details/legal parent/guardian
- Name and address
- Date of birth
- Self-declaration of Special Educational Needs
- Self -declaration of Medical Need/Allergies
- Self-declaration if Free School Meals entitlement
- Ethnicity and Gender, English as first language (this will be anonymised and used to inform future projects in Sheffield
- an e-mail address if you are happy to be contacted for evaluation purposes and receive further information about the Sheffield Healthy Holidays programme
Who we share your personal data with?
- Holiday Activates with Food Strategic Delivery Partners
- Holiday Activates with Food Holiday Club Providers
How long will we keep your information?
We will only keep your information for as long as we need to so we can deliver the Holiday Activities with Food Programme.
However, with your consent we can hold you/your child’s information for the purpose of informing you about further children’s activities/services beyond the Summer Holiday activities with Food Programme.
Your/your child’s data will not be shared without checking with you or your child. It will be kept securely and up to date.
You have the right to:
- Ask to see the personal information we hold about you
- Ask us to change information we hold about you if it is wrong
- Ask us to delete the information we hold about you
- Ask us to limit the way we use your personal Information
- To object to direct marketing (including profiling) and processing for the purposes of scientific/historical research and statistics
- Complain to the Information Commissioner’s Office
Withdrawal of Consent
Because we are processing you/your child’s personal data because you have said we can, you have the right to withdraw that consent at any time.
Manor Castle Development Trust (MCDT) on behalf of all HAF providers are the contact point for your child/you for you to exercise these rights. Contact: MCDT firstname.lastname@example.org
You have the right to submit a complaint if you are unhappy with the way your request is handled or disagree with a decision made by MDCT who are hosting IPAL regarding your data. In these circumstances you can contact the MDCT and request a review of the decision.
If you are not satisfied with the MDCT decision you may wish to apply to the Information Commissioner’s Office for a decision at:
The Information Commissioner’s Office,
The Information Commissioner is the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
Definitions and Interpretation
|Data||Collectively all information that you submit to CES via the Website. This
definition includes the definitions provided in the Data Protection Laws.
|Cookies||A small text file placed on your computer by this Website when you visit certain parts of the Website and/or when you use certain features of the Website. Details of the cookies used by this website are set out below
|Any applicable law relating to the process of personal Data including GDPR
and any national laws, regulations, and secondary legislation.
|GDPR||The UK General Data Protection Regulation, incorporated from EU
|CES a company incorporated in England and Wales under number 10631033 registered office located at Fairfield House, 104 Whitby Road,
Ellesmere Port, Cheshire, CH65 0AB.
|UK and EU Cookie Law||The Privacy and Electronic Communications (EC Directive)Regulations 2003 as amended by the Privacy and Electronic Communications (EC Directive)(Amendment Regulations 2011 and the Privacy and Electronic
Communications (ED Directive)(Amendment) Regulation 2018.
|User or You||Any third part that accesses the Website and is not either (i) employed by CES and acting in the course of the ir employment or (ii) engaged as a consultant or otherwise providing services to CES and accessing the
Website in connection with the provision of such services.
|Website/ Software||The Website that you are currently using, completeeducationsolutions.uk
and any sub-domains of this site unless excluded by their own T&C and the Software refers to any software created or sold by CES.
- The singular includes the plural and vice
- A reference to a person includes firms, companies, government bodies, trusts and
- “including” also means “including without limitation”.
- Reference to any statutory provision includes any modification or amendment of
- The headings and sub-headings do not form part of this privacy
- For purposes of the applicable Data Protection Laws, CES is the “Data Processor”. This means that CES has created processes and systems then enable a Data Controller to gather and store personal data.
- The following Data may be collected, which includes personal Data from You:
- Date of
- Contact information such as email address and phone
- Web browser type and
- Information of children within the
- Financial data relating to bookings
- Pupil premium
- Language and Ethnicity
How We Collect Data
- We collect Data in the following ways:
- Data is given to Us by
- Data is collected
Data That is Given to Us by You
- CES will collect Your Data in a number of ways:
- When You contact Us through the Website, phone, post, email or other
- When You register with Us and set up and account to receive Our products/services.
- When You complete surveys that We use for research and development purposes (although You are not obliged to respond to them).
- When You make payments to Us, through Our Website, Software or
- When You elect to receive marketing from
- When You use Our
Data That is Collected Automatically
- To the extent that You access the Website, We will collect Your Data automatically:
- We automatically collect some information about Your visit. This Data helps Us to make improvements to content and navigation and includes Your IP Address, date, time, frequency, and the way in which You interact and use Our content.
- We will collect Your Data automatically via cookies, in line with the cookies setting on Your browser.
Our Use of Data
- Any or all of the above Data may be required by Us from time to time in order to provide You with the best possible service and experience when using Our Website and Software. Specifically, data may be used by Us for the following reasons:
- Internal record keeping
- Improvements to our services and products
- Transmission by email of marketing materials
- Contact for market research purposes
- We may use Your Data for the above reasons if We deem it necessary to do so for Our legitimate interests. If You are not satisfied with this, You have the right to object in certain
- For the delivery of direct marketing to You, we’ll need Your consent, whether via an opt-in or soft-opt-in;
- soft opt-in consent is a specific type of consent which applies when You have previously engaged with Us (for example, You contact Us to ask Us for more details about a particular product/service, and We are marketing similar products/services). Under “soft opt-in” consent, We will take Your consent as given unless You opt-out.
- for other types of e-marketing, We are required to obtain Your explicit consent; that is, You need to take positive and affirmative action when consenting by, for example, checking a tick box that we’ll provide.
- if You are not satisfied about Our approach to marketing, You have the right to withdraw consent at any time. To find out how to withdraw Your consent, see the section headed “Your rights” below.
- When You register with Us and set up an account to receive Our services, the legal basis for this processing is the performance of a contract between You and Us and/or taking steps, at Your request, to enter into such a contract.
- We may use Your Data to show you CES adverts and other content on other websites. If You do not want Us to use Your data to show You adverts and other content on other websites, please turn off the relevant cookies.
Who We Share Data With
- We may share Your Data with the following groups of people for the following reason:
- Any of Our group companies or affiliates
- To ensure the proper running of Our website and
- To ensure effective support can be provided between end users, customers and Us
- Our employees agents and/or professional advisors
- To help improve the system as a whole and relevant training requirements
- To obtain any advice from professional advisers
- Third party service providers who provide services to Us which require the processing of personal data
- To help third party service providers in receipt of any shared data to perform functions on Our behalf to help ensure the website and software runs
- To help with development of Our services
- Third party payment providers who process payments made over Our Website or Software
- To enable third party payment providers to process user payments and refunds
- Relevant authorities
- To facilitate the detection of crime or the collection of taxes or duties
- Any of Our group companies or affiliates
Keeping Data Secure
- We will use technical and organisational measures to safeguard Your Data for example;
- Access to Your account is controlled by a password and a user name that is unique to
- We store Your Data on secure
- Technical and organisational measures include measures to deal with any suspected data breach. If you suspect any misuse or loss or unauthorised access to Your Data, please let Us know immediately via:
- If You want detailed information from Get Safe Online on how to protect Your information and Your computers and devices against fraud, identity theft, viruses and other online problems visit getsafeonline.org get Safe Online is supported by the UK Government and leading businesses.
- Unless a longer retention period is required or permitted by law, We will only hold Your Data on Our systems for the period necessary to fulfil the purposes outlined in this policy or until You request that the Data be deleted.
- Even if We delete Your Data, it may persist on backup or archival media for legal, tax or regulatory purposes.
- You have the following rights;
- Right to Access – the right to request;
- Copies of the information We hold about You at any time
- That We modify, update or delete such
- Right to Access – the right to request;
If we provide You with access to the information We hold about You, We will not charge You for this unless Your request is unfounded or excessive. Where We are legally permitted to do so, We may refuse any request. If We refuse Your request You will be given the reasons why.
- Right to Correct – the right to have Your Data rectified if it is inaccurate or
- Right to Erase – the right to request Your Data is removed or deleted from Our
- Right to Restrict the use of Your Data – Right to block Us from using Your Data or limit how it can be used.
- Right to Data Portability – Right to request that We move, copy or transfer Your Data
- Right to Object – Right to object to Our use of Your Data including where We use it for Our legitimate interests.
- To make enquiries, exercise any of Your rights set our above, or withdraw Your consent to the processing of Your Data, please contact us via email@example.com
- If You are not satisfied with the way a complaint You make in relation to Your Data is handled, You may be able to refer Your complain to the relevant data protection For the UK this is the Information Commissioners Office – ice.org.uk
- It is important that the Data we hold about You is accurate and current, please keep us informed of any changes to Your Data.
Transfers Outside the UK and EEA
- Data which we collect from You may be stored and processed in and transferred to countries outside the UK and This could occur if our servers are located in a third party country or our service providers are outside the UK/EEA.
- We will only transfer Data outside of the UK and EEA where it is compliant with data protection legislation and the means of transfer provides adequate safeguards in relation to Your Data.
- To ensure that Your Data receives an adequate level of protection, We have put in place appropriate safeguards and procedures with the third party companies we share Your Data
with. This ensures that Your Data is treated by those third parties in a way that is consistent with the Data Protection Laws.
Links to Other Websites
Changes of Business Ownership and Control
- CES may from time to time, expand or reduce Our business and this may involve the sales and/or transfer of control of all or part of Data provided by Users will, where it is relevant to any part of Our business so transferred, be transferred along with that part and the new owner or newly controlling party will, under the terms of this policy, be permitted to use the Data for the purposes for which it was originally supplied to Us.
- We may also disclose Data to a prospective purchaser of Our business or any part of
- In the above instances, we will take steps with the aim of ensuring Your Data is
- All Cookies used by this Website are used in accordance with current UK
- Before the Website places Cookies on Your computer, You will be presented with a message bar requesting Your consent to set those By giving Your consent or continuing to use the Website, You are consenting to placement of the Cookies. You are enabling CES to provide a better experience and service to You. You may, if you wish, deny consent to the placement of Cookies however certain features of the Website will not function as intended.
- Cookies We may place on Your PC;
|Types of Cookie||Purpose|
|Strictly necessary||These are required for the operation of Our Website. They include cookies that enable You to log into secure areas of Our Website
/ Software etc
|Analytical and performance||These enable Us to recognise and count the number of visitors and see how they react on Our Website. This helps to improve the
way Our Website operates.
|Functionality||These recognise You on returning to the
Website. This enables Us to personalise Our content for You.
|Targeting||These record Your Visit, the pages You visit and the links You have followed. We use this information to make our website and the advertising displayed on it more relevant to Your interests. We may also share this
information with third parties.
- You can disable or enable Cookies in Your By default, most internet browsers accept Cookies but this can be changed.
- You can choose to delete Cookies at any time, however You may lose any information that enables You to access the Website more quickly and efficiently including to but not limited to personalisation settings.
- For more information on cookies, see org
This version was last updated on 24th March 2023