How We Use Your Information

Privacy Notice for Customers

Clifton College Services Limited

CCSL Privacy Notice – Key Information

This notice contains the key information about how and why we collect your personal information and what we do with that information. Personal information is information that identifies you and relates to you.  For example, your contact details, your financial information and photographs of you.

We strongly recommend reading the full version of our privacy notice which is published on the CCSL website and can be found here: https://www.ccsl-cliftoncollege.com/privacy-policy/. You can also obtain a copy of the full privacy notice by contacting Clifton College’s Data Protection Adviser at dpa@cliftoncollege.com.

The full version includes additional points, such as:

  • the rights you have in your information including what decisions you can make about your information;
  • for how long the CCSL retains your personal information; and
  • our legal bases for using your personal information.

CCSL’s primary reason for using your personal information is to enable you to access our services. We set out below examples of the different ways in which we use your personal information and where that personal information comes from.

  • We obtain information about you directly when you sign up for one of our services.
  • We will have information about any medical circumstances which might affect your welfare or ability to access our services.
  • We will process financial information about you in relation to payment for our services.
  • We may take photographs or videos of you at CCSL facilities or events to use on social media and on the CCSL website. This is to show prospective customers what we do here and to advertise CCSL. We may continue to use these photographs and videos after you cease to be a CCSL customer.
  • We will send you information to keep you up to date with what is happening at CCSL. For example, by sending you information about events and activities taking place.
  • We may share your personal information with other members of the Clifton College family, which includes Clifton College, Clifton College Services Limited, Clifton College International Limited and all present or future subsidiaries, Clifton College Development Trust, Old Cliftonian Society, Clifton College Endowment Fund. All members of the Clifton College family are located in the United Kingdom.
  • We may also share your personal information with third parties. For example, we may share information with external facilities and event providers. On occasion, we may need to share information with the police, our legal advisors and our insurers.

You have the following rights regarding your information:

  • Rectification of information held;
  • Access to information held;
  • Deletion of information in certain circumstances;
  • Portability – the transfer of information to you or a third party;
  • Restriction of use of information; and
  • The right to object to the use of information in certain circumstances.

These rights are explained in more detail in the full privacy notice.

The General Manager is the person responsible at CCSL for managing how we look after personal information. The General Manager is supported by the Data Protection Adviser (‘DPA’). The General Manager or the DPA can answer any questions which you may have about how we use your personal information. They can be contacted by emailing dpa@cliftoncollege.com.

CCSL Privacy Notice

Introduction

This notice is to help you understand how and why we collect personal information about you and what we do with that information. It also explains the decisions that you can make about your own information.

If you have any questions about this notice please contact the General Manager or DPA by emailing dpa@cliftoncollege.com.

What is “personal information”?

Personal information is information that identifies you as an individual and relates to you.

This includes your names, contact details and financial information. CCSL holds other information about our customers depending on which of our services they access. For example, we hold medical information about our gym users and children studying with us part of our Holiday Club, Summer Language School and Easter Revision Course programmes.

Our legal bases for using your information

This section contains information about the legal bases that we are relying on when handling your information.

The two tables below contain a general description of the different legal bases but we have also used a colour code system so that you can see which bases we are relying on for each of the purposes described at paragraphs below.

Necessary for contract (“CT”)

We will need to use your information in order to perform our obligations under our contract with you and for you to perform your obligations as well.  For example, we need your name and financial details so that we can process your payment for our services.

Legitimate interests (“LI”)

This means that CCSL is using your information when this is necessary for our legitimate interests except when your interests and fundamental rights override our legitimate interests.

Specifically, CCSL has a legitimate interest in:

·       safeguarding and promoting the welfare of you, other customers and our employees;

·       facilitating the efficient operation of CCSL;

·       keeping the CCSL buildings safe;

·       protecting CCSL’s reputation;

·       promoting the objects and interests of CCSL. This includes using photographs of you at our events and facilities in promotional material. It also includes making sure that we are able to enforce our rights against you, for example, so that we can contact you if unpaid CCSL bills are due;

·       using your information in connection with legal disputes. For example, if you bring a claim against CCSL; and

·       ensuring that all relevant legal obligations of CCSL are complied with.

In addition your personal information may be processed for the legitimate interests of others.

Legal obligation (“LO”)

Where CCSL needs to use your information in order to comply with a legal obligation.  We may also have to disclose your information to third parties such as the courts, the local authority or the police where legally obliged to do so.

CCSL must also comply with an additional condition where it processes special categories of personal information. These special categories are as follows:  personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information, health information, and information about sex life or orientation.

Vital interests (“VI”)

In limited circumstances we may use your information to protect your vital interests or the vital interests of someone else (e.g. if you or they are seriously hurt).

Medical purposes (“MP”)

This includes medical treatment and the management of healthcare services.

Legal claims (“LC”)

We are allowed to use your information if this is necessary in relation to legal claims. For example, this allows us to share information with our legal advisors and insurers.

How and why does CCSL collect and use personal information?

We set out below examples of the different ways in which we use personal information and where this personal information comes from. The letters highlighted in different colours below refer to the legal bases we are relying on. Please see the section above for an explanation.

  1. CCSL’s primary reason for using your personal information is to enable you to access our services. – LI, CT.
  2. We will have information about any medical conditions or dietary requirements which might affect your ability to access CCSL events or facilities. This is to help us provide appropriate care and support to you – LI, CT, MP.
  3. We use CCTV to make sure the College site is safe. Images captured of you via CCTV will be your personal information. CCTV is not used in private areas such as toilets – LI, CT.
  4. We will send you information to keep you up to date with what is happening at CCSL. For example, by sending you information about events and activities taking place – LI.
  5. We may take photographs or videos of you at CCSL events to use on social media and on the CCSL website. This is to show prospective customers what we do here and to advertise CCSL. We may continue to use these photographs and videos after you are no longer a customer of CCSL – LI.
  6. If there is a complaint or grievance made to CCSL which involves you then we will use your information in connection with that complaint or grievance – LI.
  1. Where necessary to ensure your access to CCSL facilities and services, we will share your personal information with other members of the Clifton College family, which includes Clifton College Services Limited, Clifton College International Limited, the Old Cliftonian Society, Clifton College Development Trust and Clifton College Endowment Fund. For example, we will share information about dietary requirements with Clifton College to ensure that those being catered for whilst accessing our services are served appropriate food – LI.
  1. We may use information about you if we need this for historical research purposes or for statistical purposes. For example, if we consider the information might be useful if someone wanted to write a book about the College – LI.
  2. We may use your information when ensuring network and information security, for example, our anti-virus software might scan files containing information about you – LI.
  3. We can keep information about you for a very long time or even indefinitely if we need this for historical, research or statistical purposes. For example, if we consider the information might be useful if someone wanted to write a book about the College – LI

Financial information

  1. We will process financial information about you in relation to the payment of bills – LI, CT.

Sharing personal information with third parties

  1. We will share information with third parties where this is in accordance with our legal obligations – LI, LO.
  2. We may need to share information about you with the Health and Safety Executive (a government organisation) if there is a health and safety issue at the College – LI, LO.
  3. Occasionally we may use consultants, experts and other advisors to assist CCSL in fulfilling its obligations and to help run CCSL properly (e.g. our accountants). We will share your information with them if this is relevant to their work – LI, CT.
  4. In certain circumstances, we may also need to share information with our legal advisers for the purpose of obtaining legal advice – LI, LO, LC.
  5. We may need to share information if there is an emergency, for example, if you are hurt whilst on College premises – LI, VI.
  6. We may share information about you with our insurance company, for example, where there is a serious incident at the College – LI, LC.
  7. On occasion, we may need to share your information with the police for the prevention and investigation of crime and the prosecution of offenders.  We will only do this in specific circumstances to assist the police with their investigations – LI, CT, LO.

We sometimes use contractors to handle personal information on our behalf.  The following are examples:

  • IT consultants who might access information about you when checking the security of our IT network; and
  • we use third-party “cloud computing” services to store some information rather than the information being stored on hard drives located on the College site.

More than one basis

As you will see from this notice, in some cases we will rely on more than one basis above for a particular use of your information. In addition, we may move from one of the legal bases listed above to another as circumstances change.

Consent

We will contact you with marketing material by email, telephone, post or by text message but we will only do this where we are allowed to do so under data protection law (for example, we will usually need your consent before sending you an email about an upcoming production at Redgrave Theatre).

We may ask for your consent to use your information in certain ways as an alternative to relying on any of the bases in the table above. For example, we may ask for your consent before taking or using some photographs and videos if the photograph or video is more intrusive and we cannot rely on legitimate interests. If we ask for your consent to use your personal information you can take back this consent at any time.

If you tell us that you do not want to be contacted for any of these purposes then we will of course respect that. Any use of your information before you withdraw your consent remains valid. Please speak to the General Manager or DPA if you would like to withdraw any consent that you have given.

Sending information to other countries

In certain circumstances, we will send your information to countries which do not have the same level of protection for personal information as there is in the UK. For example, we may store your information on cloud computer storage based overseas.

The European Commission has produced a list of countries which have adequate data protection rules. The list can be found here: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en

If the country that we are sending your information to is not on the list or is not a country within the EEA (which means the European Union, Liechtenstein, Norway and Iceland), then it might not have the same level of protection for personal information as there is in the UK.

If you have any questions about the safeguards that are in place please contact the General Manager or DPA.

For how long do we keep your information?

We keep your information for as long as we need to in order to in order to provide you with access to CCSL events and facilities. We will keep some information after you are no longer a customer of CCSL, for example, so that we can find out what happened if you make a complaint.

In exceptional circumstances, we may keep your information for a longer time than usual but we would only do so if we had a good reason and only if we are allowed to do so under data protection law.

For further information regarding our retention of personal data, please contact the General Manager or DPA.

What decisions can you make about your information?

From 25 May 2018 data protection legislation gives you a number of rights regarding your information. Some of these are new rights whilst others build on your existing rights. Your rights are as follows:

  • Rectification: if information CCSL holds about you is incorrect you can ask us to correct it.
  • Access: you can also ask what information we hold about you and be provided with a copy. This is commonly known as making a subject access request. We will also give you extra information, such as why we use this information about you, where it came from and what types of people we have sent it to.
  • Deletion: you can ask us to delete the information that we hold about you in certain circumstances. For example, where we no longer need the information.
  • Portability: you can request the transfer of your information to you or to a third party in a format that can be read by computer. This applies where (a) the information has been provided by you; (b) the basis that we are relying on to process your information is consent or contract (please see “Our legal bases for using your information” above); and (c) the information is being processed by us on computer.
  • Restriction: our use of information about you may be restricted in some cases. For example, if you tell us that the information is inaccurate we can only use it for limited purposes while we check its accuracy.
  • Object: you may object to us using your information where:
    1. we are using it for direct marketing purposes;
    2. the legal basis on which we are relying is legitimate interests. Please see the section “Our legal bases for using your information” above; and
    3. we are using it for historical or scientific research purposes or archiving purposes. For example, we may keep photographs of you at a CCSL event for historical reasons.

The General Manager or DPA can give you more information about your data protection rights.

Further information and guidance

The General Manager is the person responsible at CCSL for managing how we look after personal information and deciding how it is shared.

Like other organisations, we need to keep your information safe, up to date, only use it for what we said we would, destroy it when we no longer need it and most importantly – treat the information we get fairly.

This notice is to explain how we use your personal information. The General Manager or DPA can answer any questions which you may have.

This privacy notice does not, and is not intended to, give you any rights which you did not already have. For example, it does not give you any additional contractual rights.

Please speak to the General Manager or DPA if:

  • you object to us using your information for marketing purposes e.g. to send you information about CCSL events. We will stop using your information for marketing purposes if you tell us not to; or
  • you would like us to update the information we hold about you; or
  • you would prefer that certain information is kept confidential.

If you fail to provide certain information when requested, we may not be able to perform our obligations under the contract we have entered into with you. We may also be prevented from complying with our legal obligations.

If you consider that we have not acted properly when using your personal information you can contact the Information Commissioner’s Office – ico.org.uk.