EHAS Data Protection Policy
Edenbridge Holiday Activities Scheme Ltd (EHAS) is fully committed to compliance with the requirements of the General Data Protection Regulation 2018 (GDPR). We are required to maintain certain personal data about individuals for the purposes of satisfying our operational and legal obligations. We recognise the importance of correct and lawful treatment of personal data.
The GDPR provides the following rights for individuals concerning their data:
- The right to be informed
- The right of access
- The right to rectification
- The right to erasure
- The right to restrict processing
- The right to data portability
- The right to object
- Rights in relation to automated decision making and profiling
EHAS recognises the importance of maintaining up to date and accurate records, policies and procedures necessary to operate safely, efficiently and in accordance with the law.
EHAS is also aware of its obligations with regards to storing data and is compliant with the 2018 GDPR.
What information is held by EHAS:
- Children’s records include date of birth, gender, school, ethnic background, religion, home address and telephone number, name and address of all parents and/or legal guardians, details of known medical or health issues and immunisations, including any special educational needs or disabilities, and details of the child’s doctor; details of special dietary requirements and allergies; names of people authorised by parents/carers to collect children and any other information deemed by staff or parents to be relevant and significant, including an emergency use password.
- Staff and volunteer records include their name, address, telephone number, criminal records check, reference from employer, special health issues.
- Daily attendance registers
- Medication Records include medication being held by EHAS staff on behalf of children along with signed Medication form in accordance with our administration of medicine policy.
Accident and Incident record book
All records and data, when not in use, will be kept in a locked file in the EHAS Office, which if unattended is locked. All records are on paper and The EHAS Manager has responsibility for the maintenance and updating of records and ensuring that they are accurate.
Parents/Carers telephone numbers and email addresses are stored when necessary on a designated EHAS mobile phone which is password protected. When not in use this phone is kept locked in the EHAS office
Requesting access to your personal data
EHAS is committed to a policy of openness with parents/carers with regard to its policies and procedures and the information that it holds on their child. Under data protection legislation, parents and pupils have the right to request access to information about them that is held by EHAS. To make a request for your personal information, contact the Chairman of EHAS, Mrs Virginia Best. Records and information will be made available to parents/carers within 30 days upon written request unless subject to an exemption. If for any reason a request is going to be refused then this decision and a written explanation will be communicated in writing.
You also have the right to:
- have inaccurate personal data rectified, blocked, erased or destroyed; and
- claim compensation for damages caused by a breach of the Data Protection regulations
If you have a concern about the way we are collecting or using your personal data, you should raise your concern with EHAS in the first instance or directly to the Information Commissioner’s Office at https://ico.org.uk/concerns/
EHAS does not share information with any third parties.
EHAS will hold information for a period of 7 years from the last occasion on which the child or adult was involved with the charity. At this point, data will be destroyed securely in accordance with best practice at the time of destruction. There are safeguarding documents which are required by our Insurers to be kept for 25 years after which time they will be destroyed.
A privacy notice (Appendix 1) will be displayed on the noticeboard at all playschemes and will be included in the registration form.
EHAS will only publish photographs of children on their website and in promotional material with the written consent of the parent/carer
EHAS undertakes to report any major breaches of data loss to the ICO (Tel: 0303 123 1113. Data loss has been added to the EHAS Risk Management matrix, which the trustees will review annually.
EHAS only collects information and data from you that is needed to comply with legal requirements and to carry out our activities safely. Data is stored securely and will be destroyed seven years after your last connection with EHAS. We do not share data with anyone else. If you wish to make any changes to the information we hold, please contact the EHAS Manager or Chairman.