Bonterre Privacy Notice
Keeping your data safe
Personal data means data which relate to a living individual who can be identified –
- from those data, or
- from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller,
and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual.
Who are we?
Top Barn Farm, Holt Heath, Worcestershire. WR6 6NH
Who’s in control?
What data do we collect and where from?
Website subscription forms
We collect the details you submit to us when you complete an online form asking us to keep you updated on Bonterre CIC.
When you become a Friend of Bonterre, we collect all the details you provide including contact details and any other details that are voluntarily provided. We also collect your payment details where necessary to process your donations.
Cookies and IP addresses
Our website provider collects information about how you interact with our websites using Cookies and your Internet Connection (IP) Address if your browser is set to accept/provide such.
We maintain records about pupils, including name, address, allergies, EHCPs and minutes from meetings that we attend or that a school wishes us to be aware of. The information is provided by parents/carers, schools, authorities and other official agencies that contact us.
Contact lists and lead data
As a business wanting to provide services to schools and other organisations, we maintain contact information for those organisations and the best member of staff to contact. Information is gathered from publicly available sources, the individuals themselves, past contacts and managers in the organisations.
We also collect anonymised publicly available information from social networking sites such as Facebook and Twitter, for example likes, shares, tweets and posts about the Bonterre CIC and its activities and campaigns. This information is provided to us by the third party social media platform.
What do we use your data for?
We use the data you provide us to communicate with our friends and supporters about our services, activities and organisation. From time to time we will also communicate with you about fundraising campaigns we run in order to finance the operation of Bonterre.
We use your data, including any voluntarily provided information, to choose which campaigns or activity we believe may be of interest to you. Our communications may be via Post, Telephone, Email or Social Media.
Our Friends’ address information may be used to deliver gifts to their home.
The data we hold about pupils is used to keep the pupils safe and to ensure Bonterre meets the requested educational needs of the pupil and its contractual obligations to the school.
What is our legal basis for using your data?
In order to hold and process your data we are obliged to identify the lawful basis upon which we do so. The lawful basis is different for the different purposes identified above.
Purpose: Communicating with online subscribers
Lawful Basis: Consent
We process this personal data on the basis of the contract you formed with us when you completed the online subscription form. This may include details about occasional fundraising campaigns.
Purpose: Managing the Friends membership
Lawful Basis: Contract
We process this personal data on the basis of the contract you formed with us when you completed the Friends form. The data is necessary to deliver gifts, communicate information about how the money is spent and ensure the donation is correctly accounted for.
Purpose: Communicating with schools and other organisations for the purposes of generating new business
Lawful Basis: Legitimate interest
We aim to provide a high quality educational provision to pupils and to make our site available to other organisations that may also benefit from the setting. In order to do this, we must undertake promotional activities to make individuals aware of our services and how they may benefit them, their pupils or others within their organisation. In order to use “legitimate interest” as a lawful basis, we need to carry out and assessment called an “LIA” which we are happy to discuss with you if you contact us. In summary, we believe the processing of the data is lawful because:
- the data held relates to business contact details only
- it was collected in an open manner from public sources, managers with the individual’s organisation and previous customer lists
- it is only being used in a way that offers the individual services related to the performance of their job
- is necessary for us to provide services to new school and organisations
Purpose: Managing student data
Lawful Basis: Contract
We process this personal data on the basis of the contract the school (or other organisation) formed with us.
Purpose: Publishing photographs
Lawful Basis: Consent
We process this personal data on the basis of the consent given by the parent/carer when the pupil first started at Bonterre. Where pictures or film of the pupil is being used for any purposes beyond what the parent might expect, additional consent will be sought.
Who do we share your data with?
Information is shared with our staff (including, where relevant and necessary, anyone on site at the same time as the pupil), the school, parents/carers and others at official meetings that we attend about your child. In an emergency, details will be shared with the police, medical professionals and other relevant authorities.
Third Party Platforms
With your permission, our website utilises the Conversion Tracking Pixel service of Facebook Inc., 1601 S. California Ave., Palo Alto, CA 94304, USA (“Facebook”). This tool allows us to follow the actions of users after they are redirected to a provider’s website by clicking on a Facebook advertisement. We are thus able to record the efficacy of Facebook advertisements for statistical and market research purposes.
The collected data remain anonymous. This means that we cannot see the personal data of any individual user. However, the collected data are saved and processed by Facebook. We are informing you on this matter according to our information at this time.
Facebook is able to connect the data with your Facebook account and use the data for their own advertising purposes, in accordance with Facebook’s Data Use Policy found here. Facebook Conversion Tracking also allows Facebook and its partners to show you advertisements on and outside Facebook. In addition, a cookie will be saved onto your computer for these purposes.
From time to time we may need to share some of your data with third party data processors (such as technology providers, website hosts, online systems). Where we do so we will have a data processing agreement with the third party, and where they are located outside the European Economic Area (EEA) we will ensure that they provide enough security and privacy to enable us to meet our legal obligations to you.
An example of this would be where we use a third party email provider to deliver our emails to you. We would need ot share your email address with the supplier to carry out this function but thier processing of your data would be in line with a data processing agreement we would have with them.
How long do we keep your data for?
Friends and newsletter lists data will be held until such time as you unsubscribe from receiving communications from the lists.
Contact details of schools is held indefinitely while it is still deemed accurate and legitimate to do so.
Pupil data is held for a maximum of 6 years.
What rights do you have?
You have a number of rights under data protection law. Some of these rights and how you can exercise them are set out in this section, more information can be found from the Information Commissioners office (https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/).
We will normally need to ask you for proof of your identity before we can respond to a request to exercise any of the rights in this section and we may need to ask you for more information, for example to help us to locate the personal data that your request relates to.
The right to be informed
A right to access your information
You have a right to ask us to send you a copy of your all personal data that we hold about you (subject to some exceptions). A request to exercise this right is called a “subject access request” and must be made in writing Bonterre CIC.
A right to object to us processing your information
You have a right to object to us processing any personal data that we process where we are relying on legitimate interests as the legal basis of our processing. You also have the right to withdraw your consent from our processing that requires it (such as our email communications). Every communication will have an option for you to withdraw your consent directly.
A right to ask us not to market to you
You have the right to opt-out of any marketing or personally addressed direct mailings we send to you. If the communication is electronic it will include simple links and instructions to ‘unsubscribe’. For other media please us.
A right to have inaccurate data corrected
You have a right to ask us to correct inaccurate data that we hold about you. If we are satisfied that the new data you have provided is accurate, we will correct your personal data as soon as possible.
A right to have your data erased
A right to have processing of your data restricted
You can ask us to restrict processing of your personal data in some circumstances, for example if you think the personal data is inaccurate and we need to verify its accuracy, or if we no longer need the data but you require us to keep it so that you can exercise your own legal rights. Restricting your personal data means that we only store your personal data and don’t carry out any further processing on it unless you consent or we need to process the data to exercise a legal claim or to protect a third party or the public.
To exercise any of the rights above please email us or write to Data Protection Officer, Bonterre CIC, Top Barn Farm, Holt Heath, Worcester WR6 6NH.
To further understand your rights please visit the website of the Information Commissioner’s Office (ICO) at http://www.ico.gov.uk.