Children's services privacy notices

Purpose for processing your information

Westminster City Council (WCC) complies with the Data Protection Act and the UK General Data Protection Regulation (GDPR). This Privacy Notice explains how personal information is going to be used, what for, who it will be shared with, and why.

WCC is working with partner organisations as part of the government’s Holiday Activities and Food (HAF) programme, to deliver activities and healthy meals during the school holidays for children aged 4-16 years old who are eligible for free school meals. The programme is funded through local authorities by the Department for Education (DfE).

In order to provide the activities to you and your family, it is necessary to collect and hold personal information about you and your children.

For the purpose of data protection legislation, the local authority is the data controller for the personal data processed as part of the programme when it is supplied to them. HAF-funded provider organisations are acting as data processors.

We collect the following information

To provide this service, we will collect and use some, or all, of the personal information below:

• Unique Pupil Identifier
• full legal name
• date of birth (in DD/MM/YYYY format)
• gender
• home postcode
• school name
• school type (primary/secondary)
• borough school is in
• number of sessions attended
• photos, videos and quotes (with parental consent)
• refugee or asylum seeker status

To provide this service, we will also collect and use some special category personal data, which includes:

• SEND status
• ethnicity

The lawful basis for the processing of the above-mentioned personal data is Article 6(1)(e) public task. Where photos, videos and quotes are collected and processed, the lawful basis is Article 6(1)(a) consent. The condition for processing special category personal data is Article 9(2)(g) substantial public interest. The associated condition under Schedule 1, Part 2 is para 6, statutory etc and government purposes.

In order for its use of your personal data to be lawful, the DfE needs to meet one (or more) conditions in the data protection legislation. For the purpose of this project, the relevant condition is Article 6(1)(e) UK General Data Protection Regulation to perform a public task as part of the DfE’s function as a department.  Where the DfE processes Special Category data, it will only do so where it meets conditions under Articles 9(1)(g) (substantial public interest) or 9(2)(j) (archiving, research and statistics).

How we collect your information  

The personal information is gathered by HAF funded organisations and provided by you, either when accessing an activity or booking an activity in advance.

Who we share your information with

We may share some of your personal information with the following organisations:

• The Department for Education
• The HAF activity provider where your child attended a holiday club.

Anonymised data will also be shared with the Department of Education as part of the funding requirements.

Details for Transfers 

No personal information is routinely sent or held outside the UK. Should the transfer of personal information outside the UK become necessary, it will only take place if permitted by law, and then only where there are appropriate safeguards in place to protect the data. 

How long do we keep your information?  

We will only retain your personal HAF data for as long as reasonably necessary to fulfil the purposes that it was collected it for, and no longer than six years, in line with the Limitation Act (1980). For more details, please refer to the Council Corporate Records Retention Schedule.

The DfE will keep your personal data for up to one year and may keep the minimum necessary for longer where it is processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the UK GDPR subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard your rights and freedoms.

Your rights and access to your information  

You have the right to request a copy of the information that we hold about you. 

The Data Protection Act 2018 also gives you additional rights that refer to how the council holds and uses your information.

Consequently, under certain circumstances, by law you have the right to:

• withdraw consent and the right to object and restrict further processing of your data; however, this may affect service delivery to you.
• request to have your data deleted where there is no compelling reason for its continued processing and provided that there are no legitimate grounds for retaining it.
• request your data to be rectified if it is inaccurate or incomplete
• have your data transferred or copied should you move to another authority
• not be subject to automated decision-making including profiling

Find information about how to submit a subject access request

Please visit our web pages for further details on how the council complies with the Data Protection Act 2018.

Find information on how the DfE handles personal information.

If you have any concerns  

Please contact us if you would like to know more about the information we hold about you and how we use it by emailing: [email protected]

You have a right to complain to us if you think we have not complied with our obligation for handling your personal information.

If you are not satisfied with the council’s response you have a right to complain to the Information Commissioner’s Office (ICO).  You can report a concern by visiting the ICO website.

Changes in your circumstances 

You must notify us immediately if there are any changes in your circumstances and personal details so we can maintain an accurate and up to date record of your information.