Privacy notice relating to the processing of personal data by Rhondda Cynon Taf County Borough Council for the provision Breakfast Clubs
Breakfast Club Provision
Under the School Standards and Organisation (Wales) Act 2013, Local Authorities have a statutory duty to provide free breakfasts to all children who go a primary school which is maintained by a Local Authority.
In Rhondda Cynon Taf, free breakfasts are provided to children by the Local Authority (Rhondda Cynon Taf Country Borough Council), at the school that the child attends, through the provision of a Breakfast Club.
Introduction
This privacy notice is intended to provide information about how Rhondda Cynon Taf County Borough Council (‘RCTCBC’, ‘Council’, ‘Local Authority’ ‘we’) will use (or ‘process’) personal data about individuals, including current, past and prospective pupils and their parents, carers or guardians (referred to in the notice as ‘parents’) for the provision of a Breakfast Club at the school.
When processing the personal data, only the minimum amount necessary in relation to the purpose is processed.
This privacy notice should be read in conjunction with the Council’s general data protection privacy notice;
The Data Controller
The Council is the data controller for the personal data we process, unless otherwise stated. This includes the personal data processed by our staff.
The Council is registered with the Information Commissioner’s Office (ICO) as a controller under reference Z4870100.
How to contact us for data protection matters or concerns relating to this privacy notice
If you would like to discuss anything in this privacy notice, please contact Catering Services at;
Alternatively, you may contact the Councils Data Protection Officer at;
The categories of personal data we process
We may process the following categories of personal data relating to Breakfast Club provision at the school.
Pupil personal data;
- School the pupil attends
- Name
- Date of birth
- Year group
- Preferred days of attendance at breakfast club / attendance record
- Dietary needs
- Relevant medical information e.g. allergies etc.
Parent personal data;
- Name
- Relationship to the pupil
- Contact details such as, address, email address, telephone number
Why we process the personal data
We process the personal data to manage Breakfast Club provision at the school. This may include but is not limited to the following activities;
- Planning breakfast club provision at the school
- Working in conjunction with the school to deliver breakfast club provision
- General administration relating to a pupil’s attendance at the breakfast club
- Recording attendance
- Managing dietary needs of the pupil
- Recording and managing incidents (e.g. any accident that may arise)
- Service improvement
Our lawful basis for processing the personal data;
Under the General Data Protection Regulation (GDPR), our lawful basis for processing the personal data to manage Breakfast Club provision at the school is;
- Legal Obligation Article(c) – processing is necessary for compliance with a legal obligation to which the controller is subject.
- Public Task - Article 6 (e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
- Substantial public interest - Article 9 (2) (g) - processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
The primary legislation, regulations and guidance that supports this includes but is not limited to;
- School Standards and Organisation (Wales) Act 2013
Who and where we get the personal data from
We may receive the personal data from the following individuals or organisations;
- Pupils
- Parents
- Breakfast Club staff
- School
Who we share personal data with
We may share personal data with the following key organisations to manage Breakfast Club provision at the school.
When sharing the personal data, we only share the minimum amount necessary in relation to the purpose.
|
Who
|
Purpose
|
|
School
|
To co-ordinate Breakfast Club provision at the school
|
Data Processors
A data processor is a company or organisation that processes personal data on behalf of a controller. The Council uses data processors that provide services to us. The category of data processors that we in relation to the management of Breakfast Club provision is;
- General IT system suppliers / service providers
Our data processors act only upon our instruction. They cannot do anything with the personal data unless we instruct them to do so. They will not share the personal data with any organisation apart from us or use it for their own purposes. They will hold it securely and retain it for the period we instruct.
Should you have a specific query relating to the processors that we use for Breakfast Club provision please contact us at;
How long we retain the personal data;
The Council retains records relating to Breakfast Club provision for;
|
Record
|
Statutory Provision
|
Retention period
|
|
Breakfast Club Records
|
Business Need
|
Current year plus 3 years
|
In keeping with the General Data Protection Regulation storage limitation principle, records are periodically reviewed. Not all personal data is retained. Only personal data that is relevant to the record is retained for the entire retention period. Information that has no long term or evidential value is routinely destroyed in the normal course of business.
Your data protection rights
Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your personal data.
Your right of access
You have the right to ask us for copies of your personal data. This right always applies. There are some exemptions, which means you may not always receive all the data we process. You can read more about this right on the ICO’s website.
Your right to get your data corrected
You have the right to ask us to rectify personal data you think is inaccurate. You also have the right to ask us to complete data you think is incomplete. This right always applies. You can read more about this right on the ICO’s website.
Your right to get your data deleted
You have the right to ask us to erase your personal data in certain circumstances. You can read more about this right on the ICO’s website.
Your right to limit how organisations use your data
You have the right to ask us to restrict the processing of your personal data in certain circumstances. You can read more about this right on the ICO’s website.
Your right to object to the use of your data
You have the right to object to us processing your personal data in certain circumstances. You can read more about this right on the ICO’s website.
Your right to data portability
This only applies to personal data you have given us. You have the right to ask that we transfer the personal data you gave us from one organisation to another or give it to you. This right only applies if we are processing the personal data based on your consent or under, or in talks about entering a contract and the processing is automated. You can read more about this right on the ICO’s website.
You are not required to pay any charge for exercising your rights. We have one month to respond to your request from the date your request is validated. We may extend this period by a further two months if the request is complex or we receive a number of requests from you.
For more information on your rights and how to exercise them please refer to the ‘Your Information Rights’ section of the Council’s website.
Your right to make a data protection complaint to the Council
You have the right to complain to the Council if you believe we have not handled your personal data responsibly and in line with good practice.
If you have a concern, we encourage you to contact us in the first instance. Most concerns can be resolved relatively quickly through a simple phone call or email. Should you wish to make a formal complaint you can do so via our Comments, Compliments and Complaints Policy.
Your right to make a data protection complaint to the ICO
You can also complain to the ICO if you are unhappy with how we have used your data, but we encourage you to contact us first.
The ICO’s contact information is:
- Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Helpline number: 0303 123 1113
- Website: https://www.ico.org.uk