Privacy Notice for Attendees at Merton School Sport Partnership Activities Contents 1. Introduction 2 2. Document purpose 2 3. Definitions 2 4. Data controller and processors 2 5. The categories of personal data we hold 3 6. Why we use this data 3 7. Our lawful basis for using this data 3 8. Collecting this information 4 9. How we store this data 4 10. Data sharing 5 11. Photographs and media 5 12. CCTV 5 13. Your rights - how to access personal information we hold about you? 5 14. Complaints 6 15. Contact details 6 PUBLIC 1 1. Introduction 1.1 Under data protection law, individuals have a right to be informed about how Harris Federation and its academies use personal data that is held about them. Merton School Sport Partnership, which is sponsored by the Federation and hosted at Harris Academy Morden (HAMD), falls under this remit. 1.2 We, the Harris Federation, comply with this right by providing Privacy Notices to individuals where we are processing their personal data. 2. Document purpose 2.1 The purpose of this Privacy Notice is to explain how Merton School Sport Partnership collects, stores and uses personal data about adults and children, who have contact with the Partnership through its activities, including events, coaching programmes and training. 3. Definitions 3.1 Merton School Sport Partnership (MSSP) is an organisation which aims to help schools in the London Borough of Merton provide cost effective and good quality Physical Education (PE), sport, physical activity, training and events by sharing resources and expertise. 3.2 The Partnership is not a formal legal identity and is sponsored by the Harris Federation. The MSSP’s core staff team, who are employed by and based at Harris Academy Morden (HAMD), are accountable to the Academy’s Principal. 3.3 The Partnership is guided and partly governed by the MSSP Steering Committee, which includes representatives from affiliated Merton schools and the Local Authority School Improvement Team. The Committee plays a role in overseeing the objectives, work remit and finances of the Partnership, along with its safeguarding procedures and policies. 3.4 Activities are events delivered by MSSP for the purpose of promoting sporting and physical activities for children and adult attendees. Activities include sporting competitions and festivals, work experience, holiday camps and coaching (e.g. rugby and other sports) for both children and adults. 3.5 Adult attendees are those individuals accompanying children to MSSP activities or taking part in professional development training or sport/activities e.g. teachers, school support staff, sport coaches, volunteers and parent(s)/carer(s). 3.6 Child attendees are those individuals under the age of 18-years-old taking part in MSSP activities, including sporting competitions and festivals, work experience, holiday camps and coaching. 4. Data controller and processors 4.1 Harris Federation is the Data Controller for the purposes of data protection law and will therefore determine the purposes for which personal data is processed (the ‘why’ and the ‘how’). MSSP, along with our academies, ‘use’ data on behalf (under the supervision/control) of the Federation and are therefore Data Processors. Our postal address is: Harris Federation 4th Floor Norfolk House Wellesley Road, Croydon CR0 1LH PUBLIC 2 4.2 The Federation in conjunction with MSSP will ensure that your personal data is processed fairly and lawfully, is accurate, is kept secure and is retained for no longer than is necessary. 5. The categories of personal data we hold 5.1 MSSP, acting on behalf of the Federation, processes data of attendees at sporting and physical activity events. The personal data that we may collect, use, store and share (when appropriate) about you includes, but is not restricted to: Adult attendees ▪ Personal information - including name, work email address, work and/or personal telephone number, and name of school representing. Such data is held in the Attendance Register; ▪ DBS information - DBS details including issue date and number; ▪ Health and Safety - medical information relating to incidents and accidents, and dietrary needs; ▪ Photographs - for electronic registration at Harris Federation academies; ▪ CCTV footage recorded at Harris Federation academies; ▪ Unnamed photographs of teachers and volunteers attending MSSP activities e.g. posters, website, videos and training material; ▪ Financial information - bank details of adults taken via PayPal for paying for holiday camps or other out of school activities; ▪ Contact details of parents/carers - held as part of a holiday camp / out of school activity Child Information Document. Child attendees ▪ Personal information including name and date of birth; ▪ Anonymised Pupil Premium status, where applicable; ▪ Health and Safety - medical information relating to incidents and accidents; ▪ Medical, SEND and safeguarding information - held as part of a holiday camp / out of school activity Child Information Document; ▪ CCTV footage recorded at Harris Federation academies; ▪ Unnamed photographs of children attending MSSP activities e.g. posters, website, videos and training material. 6. Why we use this data 6.1 The purpose of processing this data is to enable MSSP to: ▪ Organise, deliver, improve and promote physical and sporting activities in education; ▪ To register attendees at our activities; ▪ Protect student welfare and meet our statutory obligations with regards to Health and Safety and Keeping Children Safe in Education; ▪ Provide you with promotional emails about new activities or relevant information, which we think you may find interesting. 7. Our lawful basis for using this data 7.1 We only collect and use personal information about you when the law allows us to. Most commonly, we use it where we need to: ▪ Comply with a legal obligation in the field of employment and social protection law e.g. DBS checking. PUBLIC 3 ▪ Carry out a task in the public interest, such as the delivery of physical and sporting education, or in the area of public health. ▪ To protect your vital interests (or someone else’s interests); ▪ It is required for the establishment, exercise or defence of legal claims, or whenever courts are acting in their judicial capacity; 7.2 We may also use personal information about you where: ▪ you have given us consent to use it in a certain way e.g. safeguarding checks, marketing promotional activity or to use named photographs in MSSP publications. 7.3 Where you have provided us with consent to use your data, you may withdraw this consent at any time. We will make this clear when requesting your consent and explain how you go about withdrawing consent if you wish to do so. 8. Collecting this information 8.1 Attendee personal data is essential for MSSP to function effectively. The personal information we collect about you primarily comes from: ▪ Registration at Harris academies via electronic or paper sign-in systems or paper registration at externally held events; ▪ Completion of Child Information Documents, which are generated for holiday camps and other out of school activities; ▪ Registers of secondary sport leaders supporting events, including any personal and medical details where necessary; ▪ Attainment records of students swimming as part of our funded Top Up Swimming Programme; ▪ Our website provider (Fluid), which collects basic personal identifiers prior to providing login details for teachers/coaches to access their school/college dashboard and resources. ▪ CCTV operating systems, which are located in Federation academies. 8.2 Whilst the majority of information we collect from you is mandatory, there is some information that you can choose whether to provide to us. Whenever we seek to collect information from you, we will make it clear whether you must provide this information (and if so, what the possible consequences are of not complying), or whether you have a choice. 9. How we store this data 9.1 Attendee data is stored securely in either electronic or paper format by MSSP, or where registration and CCTV footage is concerned by the respective Harris academies, either HAMD, Harris Academy Merton (HAM), Harris Academy Wimbledon (HAWI) or Harris Primary Academy Merton (HPAM). Certain categories of personal data i.e. teacher basic personal identifiers, are also stored by a third- party Data Processor (Fluid), which is our website provider. 9.2 Personal data will not be retained by the Federation or MSSP for longer than is necessary in relation to the purpose for which it was collected. We will retain your personal file and delete the information in it in accordance with the Federation’s Records Retention Policy, which can be provided on demand by the MSSP Single Point of Contact (see section 15). The majority of Attendees’ personal data held by MSSP will be deleted at the 24-month point from your last known activity. Other personal data will only be held for longer if statutory limits apply. PUBLIC 4 10. Data sharing 10.1 We do not share personal information about you with any third party without your consent unless the law and our policies allow us to do so. 10.2 Where it is legally required, or necessary (and it complies with data protection law) we may share personal information about you with: ▪ Other schools and colleges - where MSSP activities are held, in order to meet safeguarding and security obligations e.g. Attendee DBS details will be provided in advance of an activity via a secure platform, such as Egress Switch. ▪ ‘Wimbledon Foundation’ - as part of the funding arrangements children’s swimming attainment data will be shared with the registered charity in order to track, monitor and improve swimming standards. Any data shared will be anonymised. 11. Photographs and media 11.1 In order to promote the educational benefits of MSSP activities unnamed photographs of adults and children attending activities may be taken and displayed. Such photographs can and will be displayed on official sites, such as the MSSP website, twitter or included in MSSP prospectuses, brochures or newsletters 11.2 If photographs are taken by external third-party photographers on behalf of MSSP e.g.