Privacy Notice

PRIVACY NOTICE

INTRODUCTION

Wellington College Services Ltd is registered at Companies House with registered number 01259773 (“WCS”).  WCS is the trading subsidiary of The Wellington College (the “College”), operating the Wellington Health & Fitness Club, the Wellington Real Tennis Club, the Wellington Golf Club, the College Shop, the let’s programme and has property development interests.

WCS is a data controller for the purposes of data protection legislation as we process personal data.  This notice is designed to give you information about how we process that data.  Our duties in respect of personal data are very important to us and we are committed to using the personal data we hold in accordance with the law.  The College’s Legal & Compliance Director is responsible for data protection at WCS and will endeavour to ensure that WCS complies with its responsibilities.  Any queries should be directed to her by email at data@wellingtoncollege.org.uk or by post at The Bursary, Wellington College, Duke’s Ride, Crowthorne, RG45 7PU.

This notice applies alongside any other information WCS or any of its businesses may provide about a particular use of personal data, for example when collecting data via an online or paper form.  The notice should be read in conjunction with our other policies and contracts which apply to you, and which make reference to personal data.  This includes any contract you have entered into with WCS, our or, where relevant, the College’s safeguarding, pastoral, health & safety policies and IT policies.  Separate privacy notices apply to the College.

It should be noted that the College and certain aspects of WCS’s businesses also have safeguarding and child protection duties and that, if there is a potential conflict between these duties and those under data protection legislations, the welfare of the child is paramount.

WCS expects members, customers and other individuals using the services and facilities provided by its businesses to respect the personal data and privacy of its staff, and other members, customers and users of its services and facilities.

WHAT TYPE OF PERSONAL DATA DOES WCS PROCESS?

We process personal data about prospective, current and past: pupils and their parents (which includes guardians and carers as well as anyone with parental responsibility for that pupil) of the College and Eagle House; staff, directors/governors and volunteers of WCS, the College and Eagle House; suppliers and contractors; members of the Health & Fitness Club, Real Tennis Club and Golf Club; customers and other non-members using or hiring the services and facilities of any of our businesses; job applicants; those who organise, facilitate or attend residential and non-residential courses, activities, meetings and events held on the College premises (including the Health & Fitness Club, the Real Tennis Club or the Golf Club) and arranged by the lets programme other than educational events; those who visit any of the facilities operated by WCS for any reason; family members of any of the foregoing; those involved in developing property alongside us or purchasing such properties from us; and others connected with us.

The personal data we process takes different forms (it may be factual information, opinion, images or other recorded information) and the type of data processed will depend on your relationship with WCS.  Examples of the personal data we process include:

• names;
• addresses, telephone numbers, email addresses and other contact details;
• biometric information;
• education and employment information;
• in respect of those who access the College site to use the facilities of or services provided by any of WCS’s businesses, images, and video footage.
• bank details and other financial information;
• courses, activities meetings or events attended;
• car details; and
• correspondence with and concerning individuals.

We may also need to process special category personal data (for example, regarding physical or mental health, ethnicity, religion or biometric data) and criminal records information about some individuals (particularly staff).  Where we process this type of data, we will seek your explicit consent unless we can either rely on rights or duties imposed on us by law (for example, in respect of safeguarding, health and safety or employment) or on one of the other conditions for processing special category personal data contained in the legislation.

HOW DOES WCS COLLECT PERSONAL DATA?

Most of the personal data processed by WCS is provided by the individual.  This may be provided via a form or simply in the ordinary course of interaction or communication.  However, in respect of those who are pupils of the College or Eagle House or their families, some personal data is shared with us by the College or Eagle House; in respect of children attending events or courses or otherwise utilising our facilities, by their parents or the organiser; in respect of all of those subject to this notice, some personal data may be  provided to us by third parties (for example, referees, the Disclosure & Barring Service, professionals or authorities working with the individual), with the consent of the individual or is obtained by us from publicly available resources.

WHO HAS ACCESS TO PERSONAL DATA?

The College provides administrative, financial, HR, IT, legal, security and works services to WCS.  In order to provide these services, certain personal data has to be shared with the College subject to appropriate controls.

Otherwise, for the most part, personal data held by WCS will remain within WCS and will be processed by appropriate members of staff for the purpose for which the data was collected.  We have taken appropriate technical and organisational steps to protect your personal data and have implemented policies addressing use of technology and devices and access to the College’s IT systems.  Particularly strict rules of access apply in the context of medical records and pastoral or safeguarding records although, in certain circumstances, some personal data will need to be disseminated more widely in order to provide the necessary care for an individual (for example, details of medical conditions of those using the Health & Fitness Club).

Some of the College’s systems are provided by third parties with some being hosted by the College and others externally.  Those hosted internally include certain finance and administrative functions.  Those hosted externally include the Health & Fitness Club’s and Wellington Real Tennis Club’s website.  The organisations providing these systems are aware of the requirements of current data protection legislation and our contracts with them contain assurances that personal data will be kept securely and only in accordance with our specific directions.  We do not transfer personal data outside of the European Economic Area unless we are satisfied that the personal data will be afforded an equivalent level of protection.

In certain circumstances, we share personal data (including, where necessary, special category personal data) with third parties in order to further the objectives and interests of WCS and its businesses and to facilitate the efficient operation of WCS and its businesses.  Examples of the third parties with whom we share personal data Wellington College, Eagle House School, relevant government authorities and regulatory bodies (such as the Local Children Safeguarding Board, the Police, DBS, HMRC, the Home Office, DWP, Companies House, the Information Commissioner’s Office), the emergency services, those supplying goods and services to WCS or any of its businesses (such as Sodexo), and the College’s professional advisers and insurers.

WHY DO WE PROCESS PERSONAL DATA?

We process personal data to support WCS’s operations, objectives and interests.  This broad purpose encompasses the following:

• the provision of health, fitness. sports and social facilities and services to members, customers and users of the Health & Fitness Club, the Wellington Real Tennis Club and the Wellington Golf Club as well as to pupils of the College;
• the provision of childcare facilities to customers of the Health & Fitness Club;
• the provision of uniform and other equipment to pupils of the College and Eagle House;
• provision of courses and lets during the College terms and holiday periods to those enrolled on such courses and lets, including the promotion, administration, monitoring, development and performance of such courses and lets.
• the provision of property development services;
• the safeguarding of children’s welfare and provision of pastoral and medical care and to take appropriate action in the event of an emergency, incident, or accident.
• compliance with legislation and regulation, including that relating to safeguarding, health and safety, employment and companies.
• operational management including the compilation of records relating to members, customers and other users, the administration of invoices, fees and accounts, the management of WCS’s or the College’s property, the management of security and safety arrangements (including the use of CCTV in accordance with the College’s CCTV policy, to run any of its systems that run off biometric data in accordance with our Biometrics Policy and monitoring of the College’s IT and communication systems), management planning and forecasting, research and statistical analysis and other operational purposes;
• staff administration, including the recruitment of staff, directors and other volunteers and engagement of contractors (including compliance with DBS procedures), administration of payroll, pensions, sick leave and other benefits, review and appraisal of performance, conduct of any grievance, capability or disciplinary procedures, the maintenance of appropriate human resources records for current and former staff and providing references.
• the promotion of WCS and its businesses and events organised by any of them including through its own websites, publications and communications, including social media channels and, where appropriate, external publication which may include the publication of images;
• compliance with any internal or external complaints, disciplinary or investigation process;
• for legal and regulatory purposes and to comply with its legal obligations and duty of care;
• obtaining appropriate professional advice and insurance for the College; and
• where specifically requested by the individuals concerned.

ON WHAT BASES DO WE PROCESS PERSONAL DATA?

WCS may process your data for the above purposes because:

• it is necessary for the performance of a contract (eg your Health & Fitness Club membership or the purchase of uniform) or in order to take steps at a contracting party’s request prior to entering into such a contract;
• it is necessary for our compliance with our legal obligations. For example, we may use personal data to exercise or perform any right or obligation conferred or imposed by law in connection with employment and/or for the prevention and detection of crime and/or in order to assist with investigations (including criminal investigations) carried out by the police and other competent authorities;
• it is necessary for our or a third party’s legitimate interest. Examples of our “legitimate interests” include our interests in providing health, fitness, sports and social fitness and services to members, customers and users, providing childcare facilities, providing courses and lets, safeguarding children’s welfare and the provision of pastoral and medical care and the promotion, administration and development of such things;
• it is necessary to protect an individual’s vital interests in certain limited circumstances. For example, where a person has a life-threatening accident or illness whilst in the Health & Fitness Club and we have to process that person’s personal data in order to ensure that they receive prompt and appropriate medical attention.
• it is necessary for the establishment, exercise or defence of legal claims;
• it is necessary for the performance of a task carried out in the public interest (or carrying out public tasks).
• it is necessary for reasons of substantial public interest, including safeguarding purposes;
• it is necessary for medical purposes, including assessing the working capacity of staff;
• it is necessary for archiving, research or statistical purposes;
• we have an individual’s specific or, where necessary, explicit consent to do so.

Where examples are given above, that basis is not limited to those examples.

In some cases, we will rely on more than one basis for a particular use of your information.  In addition, we may move from one of the legal bases listed above to another as circumstances change.

As an alternative to relying on any of the bases listed above, we may rely on your consent to use your information in certain ways.  If we ask for your consent to use your personal data, you may withdraw this consent at any time.  Such withdrawal will not affect the lawfulness of our processing of any data on the basis of that consent prior to that date.

FOR HOW LONG DO WE KEEP PERSONAL DATA?

Personal data will be kept securely and for no longer than is necessary or required by law.  This period will vary depending on the piece of personal data and the purpose for which it was collected.  If you have any specific questions in respect of retention, please direct them to the Legal & Compliance Director.

WHAT RIGHTS DO YOU HAVE IN RESPECT OF YOUR PERSONAL DATA?

If we process personal data about you, you have a number of rights in respect of that data.  Subject to certain exemptions and limitations specified by law, you can:

• require WCS to change incorrect or incomplete data;
• require WCS to delete your data in certain circumstances;
• withdraw your consent to WCS processing certain personal data where WCS is relying on your consent to do so;
• object on grounds relating to your particular situation to WCS processing your data where we are relying on our legitimate interests or public interest to do so so where you feel that it has a disproportionate impact on your rights or where we are processing your data for direct marketing purposes;
• require WCS to transfer your personal data to another organisation if (a) such personal data has been provided by you; (b) the basis on which we are relying to process your data is consent or contract; and (c) the information is being processed by us on a computer; or
• access and obtain a copy of your data on request.

If you would like to exercise any of these rights, please contact the College’s Data Information Officer by email at data@wellingtoncollege.org.uk or by post at The Bursary, Wellington College, Duke’s Ride, Crowthorne, RG45 7PU.  We will respond to such written requests as soon as is reasonably practicable and in any event within the time limits permitted by law which is typically one month but may be extended if your request is complex.

WCS will be better able to respond quickly to smaller, targeted requests for information.  In circumstances where we consider a request to be manifestly unfounded or excessive and data protection law permits, we may ask you to reconsider or charge a proportionate fee.

You should be aware that certain data is exempt from the right of access.  This may include information which identifies individuals or information which is subject to legal privilege.

Children’s data

Rights in respect of personal data belong to the individual to whom the data relates.  However, in respect of children, we will often rely on parental authority or notice to process personal data (if consent is required) unless we consider that, given the age and understanding of the child and the type of processing, it is more appropriate to rely on the child’s consent.  Parents should be aware that whether they are consulted or not will depend upon the interests of the child, the parents’ rights and all other circumstances.

In general, we will assume that a child’s consent is not required before ordinary disclosure of their personal data to their parents (for example, to keep parents informed of their child’s progress, behaviour and activities or in the interests of the pupil’s welfare) unless WCS considers that there is a good reason to do otherwise.

However, if a child seeks to raise concerns confidentially with a member of staff and expressly withholds their consent to their personal data being disclosed to their parents, WCS may be obliged to keep the information confidential unless WCS considers that there is a good reason to do otherwise.

Children can make a subject access request for their own personal data if they have sufficient maturity to understand the request they are making.  A child may ask a parent or other representative to make a request on their behalf.  Whilst a parent will generally be entitled to make a subject access request on behalf their child, the personal data will always be considered to be the child’s at law and, if of sufficient maturity, that child’s consent or authority may be required to be obtained by the parent making the request.  All information requests from, on behalf of or concerning children – whether made under subject access or simply as an incidental request – will therefore be considered on a case by case basis.

DATA ACCURACY AND SECURITY

WCS will endeavour to ensure that all personal data held in relation to an individual is as up to date and accurate as possible.  Individuals must please notify the Legal & Compliance Director of any significant changes to important information, such as contact information, held about them.

An individual has the right to request that incorrect information held about them is corrected and that any information held about them is erased.  However, we will sometimes have compelling reasons to refuse specific requests to amend, delete or stop processing your personal data: for example, a legal requirement or where it falls within a proportionate legitimate interest identified in this Privacy Notice.  Generally, if WCS still considers the processing of the personal data to be reasonably necessary, it is entitled to continue.  All such requests will be considered on their own merits.

WCS will take appropriate technical and organisational steps to ensure the security of personal data about individuals, including policies around the use of technology and devices and access to our  IT systems.

THIS NOTICE

WCS will update this notice from time to time.  Any substantial changes that affect your rights will be notified on our website and, as far as reasonably practicable, notified to you.

This privacy notice does not, and is not intended to, give you any rights which you did not already have.  For example, it does not give you any additional contractual rights.

If you believe that WCS has not complied with this notice or acted other than in accordance with data protection laws, you should notify the College’s Data Information Officer.  You can also make a referral to or lodge a complaint with the Information Commissioner’s Office (ICO), although the ICO recommends that steps are taken to resolve the matter with WCS before involving the regulator. You can also find out more about your rights under data protection law from the ICO website (www.ico.org.uk).

Legal & Compliance Director

August 2021

Reviewed and updated September 2022

Updated to reflect the change of name November 2022

KEJB