LETTINGS - Privacy Notice
To facilitate the administration and marketing of our lettings Haydon School (the School) collects relevant information about you through the venue marketing website, BookingsPlus, the data processor, who processes information about you on our behalf.
BookingsPlus is an online application that provides the School with a website to help promote our facilities and a booking system with online accounts for our clients, and the ability for our clients to pay for bookings online. BookingsPlus is a product of Kajima Partnerships Limited. You can access their Privacy Notice through the following link: https://www.kajima.co.uk/privacy, https://www.bookingsplus.co.uk/privacy-policy/.
This Privacy Notice explains how and why the School and Booking Plus collect data, what we do with it and what rights you have.
Haydon School is a charitable company limited by guarantee (registration number 07557791) whose registered office is Haydon School Wiltshire Lane, Eastcote, Pinner, Middlesex, HA5 2LX. Haydon School is a Data Controller.
Why do we collect and use your information?
We collect and use information about you under the following lawful bases:
a. where we need to perform the contract we have entered into with you;
b. where it is necessary for compliance with a legal obligation;
c. where it is in our legitimate interests to do so;
d. where we have your consent (for marketing communications and promotion of the business or activity you are using the venue for).
The School and BookingsPlus will use the contact details and documentation (training certificates, DBS forms, public liability insurance) on your BookingsPlus client account to:
· provide you with access to BookingsPlus;
· administer your account, send you invoices and collect payment from you;
· ensure the School have valid documentation in order for your booking/s to take place;
· provide customer service to you, and to deal with any enquiries/complaints made by you with regards to your booking/our service;
· provide a customer account management service to you and keep your details up-to-date;
· send to you email notifications solely related to your bookings;
· pass your contact details to GoCardless (or any online payment provider within BookingsPlus) for the purposes of payment processing only. Haydon School and BookingsPlus do not store or process any credit/debit card or bank account details;
· occasionally email you a link to a feedback survey, for the purposes of improving the BookingsGuru service, but this is entirely optional as to whether you complete it;
· send to you marketing communications, where you have opted in. Your preferences can be amended at any time, by logging into your online account or emailing your venue administrator;
· obtain statistical information about BookingsPlus users, to help BookingsPlus and the School manage their business, but this information will be anonymised and not be used to identify any individual user.
When you book a venue, as part of the booking process, you may consent to your name, business and contact details being entered on the booking timetable so that you can promote the business or activity you are using the venue for. If you don’t consent to this, all that will show up on the timetable is the type of activity taking place within that time slot and without any personal information added.
BookingsPlus would also like to send you information about their services and other venues which may be of interest to you. If you have consented to receive marketing in your client account, you may opt out a later date.
What personal information do we collect?
BookingsPlus will collect the following information on our behalf:
a. when an enquiry/registration is made through the venue marketing website, BookingsPlus will collect and store the contact details of the enquirer (name, phone, email), for our use;
b. when BookingsPlus adds new clients and/or issue them an online account, BookingsPlus will store their contact details (name, address, phone, email);
c. when BookingsPlus adds new users to a client’s account (such as bill payers), BookingsPlus will store their name and email;
d. BookingsPlus collects documents that have been uploaded by clients and their administrators. These are stored on Amazon S3;
e. when new booking is added, the School and BookingsPlus will store financial data related to the booking such as prices, invoices/credit notes, payments/refunds made and account balances;
f. when a client makes a payment via one of the payment provider options in BookingsPlus, BookingsPlus will store the payment reference, the name of the person paying, and the status of the payment, which may include reasons as to why the payment failed;
g. the School and BookingsPlus collect public liability insurance and may collect training certificates and DBS forms in order to provide lettings services to you.
Cookies are text files placed on your computer to collect standard internet log information and visitor behaviour information. This information is used to track visitor use of BookingsPlus website and to compile statistical reports on website activity. For further information visit http://www.allaboutcookies.org/ or https://www.aboutcookies.org/. You can set your browser not to accept cookies and the above websites tell you how to remove cookies from your browser. However in a few cases some of BookingsPlus website features may not function as a result.
BookingsPlus will use the contact details submitted via their venue marketing website and sent to the School email addresses to:
· contact you regarding the enquiry you made;
· generate a client account on BookingsPlus should the booking go ahead;
· obtain statistical information about venue users, to help BookingsPlus and the School manage our business but this information will be anonymised and not be used to identify any individual user.
In addition, the School uses CCTV cameras around the school site for security purposes and for the protection of our staff and students and school’s property. There are signs around the School showing that CCTV is in operation. The images captured are securely stored and only accessed on a need to know basis (e.g. to look into an incident). For more information and CCTV retention schedule, please refer to school’s CCTV Policy (available on request & on the school website).
Storing your data
Information that you provide us with via BookingsPlus will be stored electronically on BookingsPlus, on servers located in the UK and Amazon Web Services located in Ireland. BookingsPlus use carefully chosen suppliers. Appropriate steps will be taken to keep the data secure.
Personal information is only accessible to a limited number of Kajima Partnerships Limited employees and limited number of Haydon School staff with the responsibilities for lettings who can only access the information via their unique username and password.
The School will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, insurance or reporting requirements. Details of retention periods for different aspects of your personal information are available from BookingPlus website. If you are an existing client you can view and amend the personal contact details we hold for you, in your online account at https://my.schoolbookings.co.uk/users/sign_in.
Personal information that is collected via our venue marketing websites or via email during the enquiry process, which is not converted to a booking, is permanently deleted following a period of 6 months of inactivity.
In some circumstances BookingPlus may anonymise your personal information so that it can no longer be associated with you, in which case BookingPlus and the School may use such information without further notice to you. Once you are no longer wish to use our letting services the School will retain and/or securely destroy your personal information in accordance with our Data Retention Guide.
Who do we share your information with?
We routinely share information about you with our venue marketing website, BookingsPlus. Please refer to their Privacy Notice (https://www.bookingsplus.co.uk/privacy-policy/) for the detailed information on how BookingPlus use information about you.
Haydon School will, at no time, pass your details on to third parties, except where such disclosure is legally permitted and necessary to:
· safeguard the wellbeing and protect the vital interests of our students, staff, governors, and visitors;
· comply with a Court order or other legal process;
· fulfil a Freedom of Information request;
· protect our rights of property; and
· establish, exercise or defend our legal rights.
The disclosure might be necessary for the prevention or detection of crime, or the apprehension or prosecution of offenders, or where we are required to do so by law.
We will always seek your consent to share your information with the organisations for purposes other than outlined in this Privacy Notice unless such disclosure is legally permitted.
In the event that we share personal data about you with third parties, we will provide the minimum amount of personal data necessary to fulfil the purpose for which we are required to share the data.
Requesting access to your personal data
Under current data protection legislation, you have the right to request access to information about you that we hold (“Subject Access Request”). To make a request for your personal data, please contact the Data Protection Officer (DPO) although any written request for personal data will be treated as a Subject Access Request.
The legal timescales for the School to respond to a Subject Access Request is one calendar month. As the School has limited staff resources outside of term time, we encourage you to submit Subject Access Requests during term time and to avoid sending a request during periods when the School is closed or is about to close for the holidays where possible. This will assist us in responding to your request as promptly as possible. For further information about how we handle Subject Access Requests, please see our GDPR Policy (available on request from school’s DPO).
No fee usually required
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is manifestly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
You also have the right to:
· object to processing of personal data that is likely to cause, or is causing, damage or distress;
· prevent processing for the purpose of direct marketing;
· object to decisions being taken by automated means;
· in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed;
· claim compensation for damages caused by a breach of our data protection responsibilities.
If you would like to update or to delete any information we hold on you please contact our Marketing and Development Officer on firstname.lastname@example.org. If you would like to complain about how we are using or disclosing your data please first contact school’s DPO.
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. You can contact the Information Commissioners Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Please refer to our GDPR Policy (available on request from school’s DPO) for more detailed information on your rights.
Right to withdraw consent
In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. You have a right (at any time) to stop us from contacting you for marketing purposes. To withdraw your consent, please contact our DPO or if you no longer wish to be contacted for marketing purposes please login to your client account at https://my.schoolbookings.co.uk/users/sign_in. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to.
Data Protection Officer
The School have appointed a Data Protection Officer (DPO) to oversee compliance with this Privacy Notice. If you have any questions about this Privacy Notice or how we handle your personal information, please contact the DPO, Mrs L Faraj, via email, email@example.com.
Changes to this Privacy Notice
We reserve the right to update this Privacy Notice at any time, and we will provide you with a new Privacy Notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.
This Privacy Notice was last updated on 30 August 2018.