DfE Privacy Notice: Holiday Activities and Food 2020
Who we are
The Holiday Activities and Food (HAF) programme is funded by the Department for Education (DfE). For the purpose of data protection legislation, the DfE is a data controller of personal data collected about your child.
How we will use your information
Your HAF provider collects and uses the minimum of personal information necessary in order to run the holiday club.
Personal information collected by your holiday club provider about your child is then summarised.
The summarised information itself does not contain any personal data from which your child can be identified.
The summarised information is then securely shared by your HAF provider’s co-ordinator with the DfE in order for them to understand the uptake of holiday clubs in your area and how public money has been spent to help improve holiday clubs.
This enables analysis of the longer-term benefits of participating in holiday clubs.
The nature of your personal data being used
The personal data collected by your holiday club provider will include
- a minimum of personal data to identify attendance numbers (this might include for example name, address and date of birth to identify the number of unique attendees)
- self-declaration of Special Education Needs
- self-declaration of Free School Meals entitlement
When the data is summarised by the HAF provider, names and other identifiers are removed to prevent identification of individuals from the summarised information.
Why our use of your personal data is lawful
In order for DfE use of the personal data to be lawful, it needs to meet one (or more) conditions in the data protection legislation.
The legal basis for DfE processing the personal data is Article 6(1)(e) of the General Data Protection Regulation (GDPR) where “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the [data] controller”.
The processing of special category data is necessary for the purpose of identifying or keeping under review the existence or absence of equality of opportunity or treatment between persons as permitted under Article 9(2)(j) of the GDPR. This is with a view to enabling such equality to be promoted or maintained and is carried out with appropriate safeguards for the rights and freedoms of data subjects.
How long will DfE keep your personal data
Your personal data will only be retained as long as necessary in order to run the Holiday Club and to supply DfE with the necessary summarised information. When your personal data has been securely destroyed by the holiday club provider, DfE will retain the remaining non personal data for research and analysis purposes.
Your data protection rights
Under certain circumstances, you have the right:
- to ask us for access to information about you that we hold
- to have your personal data rectified, if it is inaccurate or incomplete
- to request the deletion or removal of personal data where there is no compelling reason for its continued processing
- to restrict our processing of your personal data (i.e. permitting its storage but no further processing)
- to object to direct marketing (including profiling) and processing for the purposes of scientific/historical research and statistics
- not to be subject to decisions based purely on automated processing where it produces a legal or similarly significant effect on you
If you need to contact DfE regarding any of the above, please do so at: HAF.firstname.lastname@example.org
Further information about your data protection rights appears on the Information Commissioner’s website at:
We may need to update this privacy notice periodically so we recommend that you revisit this information from time to time. This version was last updated on 8 June 2020.
If you have any questions about how your personal information will be used, please contact us at HAF.email@example.com To contact the DfE’s Data Protection Officer (DPO) please contact us via gov.uk (https://www.gov.uk/contact-dfe) and mark it for the attention of the ‘DPO’.