GDPR compliance & Data protection
Outspark Ltd takes your privacy very seriously. This Privacy Notice is intended to set out your rights and answer any queries you may have about your personal data. If you need more information, please contact our Expeditions Director, Dan Biddle:
If you are taking part in an expedition or other outdoor adventure or training programme with Outspark Ltd, the controller of your data will be Outspark Ltd.
Our personal information handling policy and procedures have been developed in line with the requirements of the 1995 European Union Data Protection Directive (Directive 95/46/EC) and the General Data Protection Regulation (in force from 25 May 2018) and applicable national law.
1. What information do we collect?
We collect and process personal contact and medical information from participants on our expeditions, as well as contact and medical information from school teachers. The personal data we process includes:
· your name and date of birth.
· your home address, email address and phone number.
· your medical information.
· emergency contact details in case of incident.
· and/or any other information you provide.
2. How do we use this information and what is the legal basis for this use?
We process the personal data listed above for the following purposes:
· In accordance with our legitimate interests in keeping participants safe whilst they take part in adventurous activities, we produce participant medical summaries for our trips, so our instructors can run expeditions safely and respond to medical issues appropriately.
· as required to establish a booking with the school, for example, if as a teacher you make a booking for an expedition programme. This may include communicating with you, providing customer services and arranging the delivery or other provision of products or services. We require this information in order to enter into a contract with the school and are unable to do so without it;
· to comply with applicable law and regulation;
· in accordance with our legitimate interests in protecting Outspark Ltd’s legitimate business interests and legal rights, including but not limited to, use in connection with legal claims, compliance, regulatory and investigative purposes (including disclosure of such information in connection with legal process or litigation);
· with your express consent to respond to any comments or complaints we may receive from you, and/or in accordance with our legitimate interests including to investigate any complaints received from you or from others, about our website or our products or services;
· we may use information you provide to personalise our communications to you;
3. With whom and where will we share your personal data? Your personal information is shared with your instructors and other related supervisory and administrative staff at Outspark Ltd, as is required by our safety systems in line with Health and Safety Executive regulations. Personal data may be shared with government authorities and/or law enforcement officials if mandated by law or if needed for the legal protection of our legitimate interests in compliance with applicable laws. In the event that our business or any part of it is sold or integrated with another business, your details will be passed to the new owners of the business.
4. How long will you keep my personal data? We will not keep your personal information for any purpose for longer than is necessary and will only retain the personal information that is necessary in relation to the purpose. We are also required to retain certain information as required by law or for as long as is reasonably necessary to meet regulatory requirements, resolve disputes, prevent fraud and abuse, or enforce our terms and conditions. Where you are under 18, we will retain your data for 5 years after the year in which you turn 18. In the case of any contact you may have with our administrative team, we will retain those details for as long as is necessary to resolve your query. We will retain your data for a short time beyond the specified retention period, to allow for information to be reviewed and any deletion to take place. In some instances, laws may require Outspark Ltd to hold certain information for specific periods other than those listed above.
5. Where is my data stored? All consent/medical forms are held at Outspark HQ in our secure filing cabinet, unless the course you are booked onto is live, where this information is held by your supervisory staff on the course with you, as is required by our safety systems in line with Health and Safety Executive regulations. Any electronic data we store is held on a encrypted laptops at Outspark HQ and on encrypted ‘cloud’ based storage online. Some online personal data that we collect from you may be transferred to, and stored outside the European Economic Area (“EEA”) if based upon external servers.
6. What are my rights in relation to my personal data? If the information we hold about you is inaccurate or incomplete, you can notify us and ask us to correct or supplement it. You also have the right, with some exceptions and qualifications, to ask us to provide a copy of any personal data we hold about you. If you have a complaint about how we have handled your personal data, you may be able to ask us to restrict how we use your personal data while your complaint is resolved. In some circumstances you can ask us to erase your personal data (a) if it is no longer necessary for us to use your personal data; (b) if you object to the use of your personal data and we don’t have a good reason to continue to use it;
7. Where can I find more information about Outspark Ltd’s handling of my data?
Should you have any queries regarding this Privacy Notice, about how Outspark Ltd processes your personal data or wish to exercise your rights you can contact the Outspark Ltd team using this email address: firstname.lastname@example.org.
If you are not happy with our response, you can contact the Information Commissioner’s Office: https://ico.org.uk/
This policy was issued on 24th May 2018 and will be reviewed by 24th May 2019.