Effective May 2018
We are committed to protecting and respecting your privacy.
This notice sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand how we will use your personal data and your rights in relation to your personal data.
We, us, our and the Trust refer to Henley Educational Trust (registered Charity Number 309237). Contact with the Trust should be made through the Clerk to the Trustees whose details are available on our website: www.henleyeducationaltrust.com
The data controller is Henley Educational Trust.
Information we collect from you and how we collect it
We will collect and process the following data about you:
- Information you give us. This is information about you that you give us. It includes information you provide when you:
- apply for a grant from us by filling in an application form
- send us any follow up request or provide further information in relation to your application whether by post, email or telephone
- fill in any forms on our website or make contact with us via our website or otherwise
The information you give us may include your name, address, e-mail address, phone number, information about your children and family members and information relating to your income, welfare benefits and family expenditure. The information may contain special categories of personal data if you provide us with health or disability information concerning yourself or the child(ren) on whose behalf you are applying. The application will also contain information in relation to the grant you are seeking which may contain further personal data.
- Information we receive from other sources. This is information we receive about you if your application to us is supported by a third party, for example, a school, teacher, Nomad, or a club.
How we use your personal data
We will only use your personal data in accordance with the law.
We have set out below a description of how we will use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.
|Purpose/use of personal data
|Lawful basis for processing
|Individual applications: to consider your application, to provide you with information about the progress and the acceptance or refusal of your application and, if successful, to provide the financial support which you have been awarded
|Your consent and necessary for the performance of a contract with you
|Schools, Clubs, other organisations: to consider your application, to provide you with information about the progress and the acceptance or refusal of your application and, if successful, to provide the financial support which you have been awarded
|Necessary for the performance of a contract with you
|To administer and protect the Trust and its website
|Necessary for our legitimate interests (for carrying out the purposes of the Trust, provision of administration and IT services, network security and to prevent fraud) and to comply with our legal obligations.
Withdrawing your consent
Where our lawful basis of processing your personal data is your consent, you may withdraw your consent at any time by contacting our Clerk or by emailing firstname.lastname@example.org This will not affect the lawfulness of any processing by us before withdrawal of consent but you should note that it may affect our ability to consider your application.
Sharing your information
We may share your personal information with:
- Our group of Trustees, each of whom has been made aware of their obligations of confidentiality, so that they may consider your application;
- The school, club, music teacher or other educational establishment for which you are seeking a grant as in most instances grants are paid directly to that person or organisation. To make these payments we will share limited personal details with the organization or person receiving payment so that the payment can be credited to your account;
- Selected third parties including:
- Service providers acting as processors who provide us with cloud based services to administer the Trust (Microsoft Inc. who is based in the US);
- Professional advisers including lawyers, bankers, auditors and insurers based in the UK who provide consultancy, banking, legal, insurance and accounting services; and
- HM Revenue & Customs, regulators and other authorities based in the UK if required by such authorities.
Where we store your personal data and international transfers
All information you provide to us is stored on secure servers located in the UK. This is a cloud service hosted for us by Microsoft Inc. Any paper applications are shredded after scanning and storage on our secure servers.
Your data may be transferred, stored and/or processed outside the EEA as Microsoft Inc is a US company. We will only transfer your data outside of the EEA in compliance with data protection laws and provided appropriate or suitable safeguards are in place to protect your data. Please contact us if you would like details of the appropriate safeguards.
Retention of your personal data
We will only keep your application form and related documents for so long as is necessary to administer your application and for a period up to the end of the following financial year to enable us to comply with our legal and accounting obligations. We keep a limited record of grants made for a period of 7 years for our accounting records.
You have the right to:
- access any personal data we hold about you and we will provide details of the purposes of the processing, the types of personal data we hold and the people to whom your personal data has been disclosed;
- have inaccurate or incomplete personal data corrected or to restrict the processing of personal data whilst the accuracy is checked;
- have personal data we hold about you erased. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with law;
- object to processing of your personal data where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms;
- withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent; and
- lodge a complaint with the Information Commissioner’s Office if you have a concern about your personal data: https://ico.org.uk/concerns/
You can exercise your rights at any time by contacting us at email@example.com
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
Time limit to respond
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Questions, comments and requests regarding this privacy notice are welcomed and should be addressed to firstname.lastname@example.org