Privacy Notice – Ruskin Mill Trust Limited
Under data protection law, individuals have a right to be informed about how Ruskin Mill Trust Limited (“the Trust”) uses any personal information that we hold about them. We comply with this right by providing privacy notices to individuals where we collect and use (“process”) their personal information.
This privacy notice lets you know what happens to any personal data that you give to us, or any that we may collect from or about you. It applies to all products, services and any other circumstances where we collect your personal data.
This privacy notice applies to personal information processed by or on behalf of:
Ruskin Mill Trust, Ruskin Mill, Millbottom, Old Bristol Road, Nailsworth, Gloucestershire GL6 0LA which is the ‘Data Controller’ for the purposes of data protection law.
The Trusts Data Protection Officer (DPO) is SchoolPro TLC Limited and is contactable via GDPR@SchoolPro.uk
The Trust is contactable via email@example.com
The Trust is joint controller with its schools which are also defined as Data Controllers. The Trust’s colleges are registered under the same ICO registration – Registration number Z7589083 – as the Trust and this includes the following:
- Argent College
- Coleg Plas Dwbl
- Freeman College
- Glasshouse College
- Ruskin Mill College
- Coleg Ty’r Eithin
Each school is also registered with the ICO and will renew their registrations annually or as otherwise legally required. The Trust and the schools also have joint controller status. Their registration numbers are as follows:
- Brantwood Specialist School – Z2718500;
- Clervaux Garden School (Clervaux Trust Ltd) – ZA223569;
- Sunfield School & Children’s Home – Z7064238.
References to “the Group” include references to the subsidiary companies of the Trust.
We may change this privacy notice from time to time by updating this page in order to reflect changes in the law and/or our privacy practices. We encourage you to check this notice on a regular basis.
What kinds of personal information about you do we process?
Personal information that we may process in connection with our activities, services and products if relevant, necessary and accurate includes:
a) Personal and contact details, such as title, full name, contact details and contact details history;
b) Your date of birth, gender and/or age;
c) Nationality if needed for the activity, product or service;
d) Family members if relevant for the activity, product or service;
e) Records of how and when you contact us e.g. if you get in touch with us online using our online services details of your location data, IP address will be stored;
f) Activities, products, services and events you have been interested in;
g) Marketing to you and analysing data including history of those communications, whether you open them or click on links, and information about activities, products, services and events you may be interested in, and analysing data to help target communications to you that we think are of interest or relevance to you;
h) Information we may share with third parties including any marketing lists, publicly available information and information to help improve the relevance of our activities, products and services;
How we will collect your data
We will collect personal information from the following sources:
a) From you directly, e.g. if you make an enquiry as to our provisions or about products and services provided by any member of the Group;
b) Information generated about you when you use our website;
c) Information gathered from third parties.
Why do we collect your data?
We use your personal data, including any of the personal data listed above for the following purposes:
a) Managing any aspect of the activity, product or services offered;
b) To respond to queries, refund requests and complaints;
c) To perform and/or test the performance of our products and services and internal processes;
d) To improve the operation of our business and auditing of our business operations;
e) To monitor and keep records of our communications with you and our staff;
f) To administer good governance requirements such as internal reporting and compliance obligations or administration required for Trustee meeting processes;
g) For direct marketing communications. We’ll send marketing to you by SMS, email, phone, post, social media where you have consented to this;
h) To comply with legal and regulatory obligations, requirements and guidance;
i) To share information, as needed, with business partners, local authorities or other stakeholders to assess or improve the operating of our businesses.
What are the legal grounds for our processing of your personal information (including when we share it with others)?
We rely on the following legal bases to use your personal data:
a) Contractual obligations where it is needed to provide you with our products or services, such as:
i) Updating your records, ensuring we still have your correct details.
b) Where it is in our legitimate interests to do so, such as:
i) In some situations we might require your data for our legitimate interests and we will process your data in a way which might reasonably be expected as part of the running of our business and which does not materially affect your rights, freedoms or interests;
ii) To follow guidance and recommended best practice of government and regulatory bodies;
iii) For management and audit of our business operations including accounting;
iv) To carry out monitoring and to keep records of our communications with you and our staff;
v) To administer good governance requirements and those of members of the Group, such as internal reporting and compliance obligations or administration required for meetings of the Trustees;
vi) For direct marketing communications. We will send you marketing to you by SMS, email, phone, post and social media where we think it may be of interest to you and you have provided your consent to receive such communication. You are of course free to opt out of hearing from us by any of these channels at any time;
vii) Where we need to share your personal information with people or organisations in order to run the Trust.
(c) To comply with our legal obligations such as:
i) We may need to share data with law enforcement;
ii) We may need to send you communications required by law such as updates to this Privacy Notice and legally required information relating to your orders. These service messages will not include promotional content and do not require prior consent when sent by email or text message.
(d) With your consent or explicit consent:
i) For some direct marketing communications;
ii) For some of our processing of special categories of personal data such as about your health and medical needs or gender.
When do we share your personal information with other organisations?
We would not sell your information to third parties. But we may, from time to time, share information with the following third parties for the purposes listed above:
a) Members of the Group;
b) Governmental and regulatory bodies such as HMRC;
c) Other organisations and businesses who provide services to us such as back up and server hosting providers, IT software and maintenance providers, document storage providers and suppliers of other back office functions.
We take steps to ensure that any third party partners who handle your information comply with data protection legislation and protect your information just as we do.
How and when can you withdraw your consent?
Where we are relying upon your consent to process personal data, you can withdraw this at any time by contacting us using the details below.
Is your personal information transferred outside the UK or the EEA?
We are based in the UK but sometimes your personal information may be transferred outside the European Economic Area. If we do so we will make sure that suitable safeguards are in place, for example by entering into contractual agreements.
What should you do if you wish to update your information?
You should tell us if your details change using the Contact Us section of our website.
Do you have to provide your personal information to us?
We are unable to provide some services or products to you if you do not provide us with certain information. In the cases where providing some personal information is optional, we will make this clear.
How long do we retain your information?
We do not hold your information in an identifiable format for longer than is necessary. Unless we explain to you otherwise, we will hold your personal information in accordance with our Data Retention Policy and Retention Schedule. These can be sent to you upon request.
What are your rights?
Here is a list of the rights that all individuals have under data protection laws. They don’t apply in all circumstances. If you wish to use any of them, we’ll explain at that time if they are engaged or not.
a) The right to withdraw your consent (where we rely on it);
b) The right to be informed about the processing of your personal information;
c) The right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed;
d) The right to object to processing of your personal information for certain purposes in particular to data processed for direct marketing purposes and to data processed for certain reasons based on our legitimate interests;
e) The right to restrict the processing of your personal information;
f) The right to have your personal information erased (“the right to be forgotten”);
g) The right to request access to your personal information and to obtain information about how we process it;
h) The right to move, copy or transfer your personal information in a commonly used and machine readable format;
i) Rights in relation to automated decision making which has a legal effect or otherwise significantly affects you;
You have the right to complain to the Information Commissioner’s office which enforces data protection laws. This can be done by contacting the Information Commissioner’s Office directly. Full contact details including a helpline number can be found on the Information Commissioner’s Office website (www.ico.org.uk). This website has further information on individuals’ rights and our obligations.
You can exercise the above rights and/or manage your information by contacting us using the details below.
What are your marketing preferences and what do they mean?
We may use your home address, phone numbers, email address and social media (for example Facebook) to contact you according to your marketing preferences and consents provided. You can stop our marketing at any time by contacting us using the details below or by following the instructions in the communication.
If you have any questions, concerns or would like more information about anything mentioned in this privacy notice, please contact our DPO:
Our DPO is SchoolPro TLC Limited and is contactable via GDPR@SchoolPro.uk
You can contact the Trust at:
Ruskin Mill Trust
Old Bristol Road
Or by email at firstname.lastname@example.org
Privacy Notice – NHS Test & Trace Addendum
This addendum to our Privacy Notice explains how and why we may share stakeholder personal information with the NHS Test and Trace service.
Who We Share Stakeholder Information With
During the period of the coronavirus pandemic (which is, as yet, an undefined length of time), we may share stakeholder information with:
- NHS Test and Trace Service
Why We May Share This Information
We do not share information about our stakeholders with anyone without consent unless the law and our policies allow us to do so. The NHS Test and Trace service may collect information from educational settings in order to allow for the operation of the service and enable contacts to be effectively traced. Information that will be requested and shared where necessary is:
- Contact phone number and/or email address
- Dates and times entering and leaving a Trust premises
The lawful bases for processing personal data are set out in Article 6 of the General Data Protection Regulation. Ruskin Mill Trust / Ruskin Mill Land Trust and respective subsidiaries process such data in this instance because we have:
- (6c) A legal obligation: the processing is necessary for us to comply with the law;
- (6d) A duty to safeguard pupils and students, parents, staff, governors and visitors: the processing is necessary in order to protect the vital interests of the data subject.
- (6e) Public task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law (i.e. our legal responsibilities around public health).
Information provided to the NHS Test and Trace service is held in strict confidence and is only kept and used in line with the Data Protection Act 2018.