Privacy Policy

1. Introduction

Shropshire Adventures Ltd ("we", "us", "our") operates Shropshire Adventures Academy. We are committed to protecting the personal data of everyone who interacts with us, including learners, parents, carers, local authorities and website visitors.

This policy explains what personal data we collect, why we collect it, how we use it, how long we keep it and what your rights are under UK data protection law.

Our registered details are:

Shropshire Adventures Ltd

‍Company number: 15412263

Ginny Hole,
Green Lane,
Stottesdon,
DY14 8US

Data Controller: Daniel Eddies-Davies

‍Email: academy@shropshireadventures.co.uk

‍Phone: 01746 562608

We are in the process of registering with the Information Commissioner's Office (ICO) as required under UK GDPR. Until registration is confirmed, any data protection enquiries should be directed to Daniel Eddies-Davies using the contact details above.

2. The Data We Collect

We collect and process the following categories of personal data:

Enquiry and Contact Data

• Name, email address and phone number
• Details provided via our contact form, email or telephone
• Local authority name and job title where relevant

Learner Data

• Full name, date of birth and contact details
• Education, Health and Care Plan (EHCP) documentation
• Educational history and background information
• Attendance and progress records
• Qualification and assessment records

Health and Medical Data

• Medical conditions, diagnoses and health needs
• Medication requirements
• Mental health information
• Safeguarding-related information

Photographic and Video Data

• Images and videos of learners taken during academy activities, where consent has been obtained

Website Data

• Usage data collected via Google Analytics, including pages visited, time spent on site and approximate location. This data is anonymised and does not identify individuals. Please see our Cookie Policy at www.shropshireadventuresacademy.co.uk/legal/cookie-policy for further information.

3. Why We Collect Your Data and Our Lawful Basis

We process personal data on the following lawful bases under UK GDPR:

• Legitimate Interests: We process contact and enquiry data to respond to enquiries, assess suitability for a place at the academy and manage our admissions process. This is in the legitimate interests of both the academy and the individuals making enquiries.
• ‍Legal Obligation: We process learner data, EHCP documentation and safeguarding-related information to comply with our legal obligations as an education provider, including our duties under the Children and Families Act 2014 and safeguarding legislation.Vital Interests:
• Vital Interests: We process health and medical data to protect the life and physical safety of learners in our care. As an education provider working with young people without parental supervision, we are required to hold accurate health and medical information to respond appropriately in the event of a medical emergency or safeguarding concern.Consent:
• Consent: We process photographic and video data on the basis of explicit written consent, obtained from both the learner and their parent or carer prior to any images being taken or published. Where consent is given by a person under the age of 18, we also obtain consent from a parent or carer. Consent can be withdrawn at any time by contacting us using the details in section 1.

4. Special Category Data

Health and medical information is classified as special category data under UK GDPR and is afforded additional protection. We process this data only where it is necessary to protect the vital interests of our learners, to comply with our safeguarding obligations and to fulfil our legal duties as an education provider.

Access to special category data is restricted to staff members who require it to carry out their responsibilities. All staff are trained in data protection and confidentiality as part of their induction.

5. Data Relating to Children and Young People

We work with young people aged 16 to 25. Where a learner is under the age of 18, we take additional steps to protect their personal data, including:

• Obtaining consent from both the learner and their parent or carer for activities requiring consent, including photography and video
• Ensuring that any data shared externally, including with local authorities, is limited to what is strictly necessary
• Applying the highest standards of data security to records relating to under-18s

6. Who We Share Your Data With

We do not sell personal data to third parties. We may share data with the following organisations where necessary and proportionate:

• ‍Local Authorities: We share learner data, progress updates and EHCP-related information with the relevant local authority as part of our funding and reporting obligations.British Horse Society and Other Awarding Bodies:
• British Horse Society and Other Awarding Bodies: We share learner data with awarding bodies as required to register learners for qualifications and submit assessment evidence.Google Analytics:
• Google Analytics: Our website uses Google Analytics to collect anonymised usage data. No personally identifiable information is shared with Google through this service. For more information, please see our Cookie Policy.Legal and Regulatory Bodies:
• Legal and Regulatory Bodies: We may share data with the police, social services or other statutory bodies where we are legally required to do so, for example in response to a safeguarding concern.

We require all third parties who process data on our behalf to do so in accordance with UK GDPR and to maintain appropriate security measures.

7. Data Storage and Security

Personal data is stored on a password-protected local computer held on our premises. We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss or disclosure.

We are aware that storing sensitive personal data, including health information and images of learners, on a local device carries inherent risks. We recommend and are working towards implementing secure cloud-based storage with appropriate access controls as a more robust long-term solution.

• ‍Learner records and health data: Retained for 7 years after the learner leaves the academy, in line with safeguarding guidance and education sector best practice. After this period, records are securely deleted.Enquiry data where no place was offered:
• Enquiry data where no place was offered: Retained for 12 months from the date of the enquiry, after which it is securely deleted.Photographic and video data:
• Photographic and video data: Retained for the duration of the learner's enrolment and for a period of 12 months after leaving, unless consent is withdrawn earlier. Where consent is withdrawn, images and videos will be removed from our website and social media platforms as soon as reasonably practicable.Website analytics data:
• Website analytics data: Retained in accordance with Google Analytics' standard data retention settings. This data is anonymised and does not identify individuals.

Photographic and video content shared on our website and social media platforms is stored on the servers of those respective platforms. We ensure that only content for which explicit consent has been obtained is published publicly.

8. How Long We Keep Your Data

We retain personal data for the following periods:

• ‍Right of access: You have the right to request a copy of the personal data we hold about you.Right to rectification:
• Right to rectification: You have the right to ask us to correct any inaccurate or incomplete personal data we hold about you.Right to erasure:
• Right to erasure: You have the right to ask us to delete your personal data in certain circumstances, for example where it is no longer necessary for the purpose for which it was collected.Right to restrict processing:
• Right to restrict processing: You have the right to ask us to restrict the processing of your personal data in certain circumstances.Right to object:
• Right to object: You have the right to object to the processing of your personal data where we are relying on legitimate interests as our lawful basis.Right to withdraw consent:
• Right to withdraw consent: Where we process your data on the basis of consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.Right to complain:
• Right to complain: If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.

After any retention period has expired, personal data is securely deleted or anonymised so that it can no longer be linked to an individual.

9. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

To exercise any of your rights, please contact Daniel Eddies-Davies using the details in section 1. We will respond to all requests within one calendar month.

10. Third Party Websites

Our website may contain links to third party websites, including our partner organisations and social media platforms. This privacy policy applies only to our website and services. We are not responsible for the privacy practices of third party websites and encourage you to read their privacy policies before providing any personal data.

11. Changes to This Policy

We review and update this privacy policy periodically to reflect changes in our practices or in applicable law. The date at the top of this policy indicates when it was last updated. We encourage you to review this policy regularly.

If we make significant changes to how we handle your personal data, we will take reasonable steps to inform you, for example by posting a notice on our website.

12. Contact Us

If you have any questions about this privacy policy or about how we handle your personal data, please contact:

Daniel Eddies-Davies

‍Shropshire Adventures Ltd
Ginny Hole,
Green Lane,
Stottesdon,
DY14 8US

‍academy@shropshireadventures.co.uk

‍01746 562608