WELLINGTON COLLEGE ENTERPRISES LIMITED
Wellington College Enterprises Limited is registered at Companies House with registered number 01259773 (“WCE”). WCE is the trading subsidiary of The Wellington College (the “College”), operating the Wellington Health & Fitness Club, the Wellington Real Tennis Club, the Wellington Golf Club, the College Shop, the lets programme and has property developmentinterests.
WCE is a data controller for the purposes of data protection legislation as we process personal data. This notice is designed to give you information about how we process that data. Our duties in respect of personal data are very important to us and we are committed to using the personal data we hold in accordance with the law. The College’s Legal & Compliance Director is responsible for data protection at WCE and will endeavour to ensure that WCE complies with its responsibilities. Any queries should be directed to her by email at email@example.com or by post at The Bursary, Wellington College, Duke’s Ride, Crowthorne, RG45 7PU.
This notice applies alongside any other information WCE or any of its businesses may provide about a particular use of personal data, for example when collecting data via an online or paper form. The notice should be read in conjunction with our other policies and contracts which apply to you and which make reference to personal data. This includes any contract you have entered into with WCE, our or, where relevant, the College’s safeguarding, pastoral, health & safety policies and IT policies. Separate privacy notices apply to the College and to our staff.
It should be noted that the College and certain aspects of WCE’s businesses also have safeguarding and child protection duties and that, if there is a potential conflict between these duties and those under data protection legislations, the welfare of the child is paramount.
WCE expects members, customers and other individuals using the services and facilities provided by its businesses to respect the personal data and privacy of its staff, and other members, customers and users of its services and facilities.
WHAT TYPE OF PERSONAL DATA DOES WCE PROCESS?
We process personal data about prospective, current and past: pupils and their parents (which includes guardians and carers as well as anyone with parental responsibility for that pupil) of the College and Eagle House; staff, directors/governors and volunteers of WCE, the College and Eagle House; suppliers and contractors; members of the Health & Fitness Club, Real Tennis Club and Golf Club; customers and other non-members using or hiring the services and facilities of any of our businesses; job applicants; those who organise, facilitate or attend residential and non-residential courses, activities, meetings and events held on the College premises (including the Health & Fitness Club or the Wellington Real Tennis Club) and arranged by the lets programme other than educational events; those who visit any of the facilities operated by WCE for any reason; family members of any of the foregoing; those involved in developing property alongside us or purchasing such properties from us; and others connected with us.
The personal data we process takes different forms (it may be factual information, opinion, images or other recorded information) and the type of data processed will depend on your relationship with WCE. Examples of the personal data we process include:
- addresses, telephone numbers, email addresses and other contact details;
- biometric information;
- education and employment information;
- in respect of those who access the College site to use the facilities of or services provided by any of WCE’s businesses, images and video footage;
- financial information;
- courses, activities meetings or events attended;
- car details; and
- correspondence with and concerning individuals.
We may also need to process special category personal data (for example, regarding physical or mental health, ethnicity, religion or biometric data) and criminal records information about some individuals (particularly staff). Where we process this type of data, we will either rely on rights or duties imposed on us by law (for example, in respect of safeguarding, health and safety or employment) or on explicit consent.
HOW DOES WCE COLLECT PERSONAL DATA?
Most of the personal data processed by WCE is provided by the individual. This may be provided via a form or simply in the ordinary course of interaction or communication. However, in respect of those who are pupils of the College or Eagle House or their families, some personal data is shared with us by the College or Eagle House; in respect of all of those subject to this notice, some personal data may be provided to us by third parties (for example, referees, the Disclosure & Barring Service, professionals or authorities working with the individual), with the consent of the individual or from publicly available resources.
WHO HAS ACCESS TO PERSONAL DATA?
The College provides administrative, financial, HR, IT, legal, security and works services to WCE. In order to provide these services, certain personal data has to be shared with the College subject to appropriate controls.
Otherwise, for the most part, personal data held by WCE will remain within WCE and will be processed by appropriate members of staff for the purpose for which the data was collected. As an organisation, we have taken appropriate technical steps to protect your personal data and have implemented policies addressing use of technology. Particularly strict rules of access apply in the context of medical records and pastoral or safeguarding files although, in certain circumstances, some personal data will need to be disseminated more widely in order to provide the necessary care for an individual (for example, details of medical conditions of those using the Health & Fitness Club).
Some of the College’s systems are provided by third parties with some being hosted by the College and others externally. Those hosted internally include certain finance and administrative functions. Those hosted externally include the Health & Fitness Club’s and Wellington Real Tennis Club’s website. The organisations providing these systems are aware of the requirements of current data protection legislation.
In certain circumstances, we share personal data (including, where necessary, special category personal data) with third parties in order to further the objectives and interests of WCE and its businesses and to facilitate the efficient operation of WCE and its businesses. Examples of the third parties with whom we share personal data Wellington College, Eagle House School, relevant authorities (such as the Local Children Safeguarding Board, DBS, HMRC, DWP, Companies House, the Information Commissioner), the emergency services, those supplying goods and services to WCE or any of its businesses, and the College’s professional advisers.
WHY DO WE PROCESS PERSONAL DATA?
We process personal data to support WCE’s operations, objectives and interests. This broad purpose encompasses the following:
- the provision of health, fitness. sports and social facilities and services to members, customers and users of the Health & Fitness Club, the Wellington Real Tennis Club and the Wellington Golf Club as well as to pupils of the College;
- the provision of childcare facilities to customers of the Health & Fitness Club;
- the provision of uniform and other equipment to pupils of the College and Eagle House;
- provision of courses and lets during the College terms and holiday periods to those enrolled on such courses and lets, including the promotion, administration, monitoring, development and performance of such courses and lets;
- the provision of property development services;
- the safeguarding of children’s welfare and provision of pastoral and medical care;
- compliance with legislation and regulation, including that relating to safeguarding, health and safety, employment and companies;
- operational management including the compilation of records relating to members, customers and other users, the administration of invoices, fees and accounts, the management of WCE’s or the College’s property, the management of security and safety arrangements (including the use of CCTV in accordance with the College’s CCTV policy and monitoring of the College’s IT and communication systems), management planning and forecasting, research and statistical analysis and other operational purposes;
- staff administration, including the recruitment of staff, directors and other volunteers and engagement of contractors (including compliance with DBS procedures), administration of payroll, pensions, sick leave and other benefits, review and appraisal of performance, conduct of any grievance, capability or disciplinary procedures, the maintenance of appropriate human resources records for current and former staff and providing references;
- the promotion of WCE and its businesses including through its own websites, publications and communications, including social media channels;
obtaining appropriate professional advice and insurance for the College; and
- where specifically requested by the individuals concerned.
In some situations, we have to carry out these processes in order to meet our legal obligations, whether they are imposed on us by law or through contract (for example, a membership form). In other situations, we have obtained the consent of the relevant individual to the particular processing of the data. WCE has determined that it has a legitimate interest in all of the remaining processes we conduct.
FOR HOW LONG DO WE KEEP PERSONAL DATA?
Personal data will be kept securely and for no longer than is necessary or required by law. This period will vary depending on the piece of personal data and the purpose for which it was collected. If you have any specific questions in respect of retention, please direct them to the Legal & Compliance Director.
WHAT RIGHTS DO YOU HAVE IN RESPECT OF YOUR PERSONAL DATA?
If we process personal data about you, you have a number of rights in respect of that data. Subject to certain exemptions and limitations specified by law, you can:
- require WCE to change incorrect or incomplete data;
- require WCE to delete your data;
- withdraw your consent to WCE processing certain personal data where WCE is relying on your consent to do so;
- object to WCE processing your data where we are relying on our legitimate interests to do so;
- require WCE to transfer your personal data to another organisation; or
- access and obtain a copy of your data on request.
If you would like to exercise any of these rights, please contact the College’s Data Information Officer by email at firstname.lastname@example.org or by post at The Bursary, Wellington College, Duke’s Ride, Crowthorne, RG45 7PU. We will respond to such written requests as soon as is reasonably practicable and in any event within the time limits permitted by law. WCE will be better able to respond quickly to smaller, targeted requests for information.
Rights in respect of personal data belong to the individual to whom the data relates. However, in respect of children, we will often rely on parental authority or notice to process personal data (if consent is required) unless we consider that, given the age and understanding of the child and the type of processing, it is more appropriate to rely on the child’s consent. Parents should be aware that whether they are consulted or not will depend upon the interests of the child, the parents’ rights and all other circumstances.
In general, we will assume that a child’s consent is not required before ordinary disclosure of their personal data to their parents (for example, to keep parents informed of their child’s progress, behaviour and activities or in the interests of the pupil’s welfare) unless WCE considers that there is a good reason to do otherwise.
However, if a child seeks to raise concerns confidentially with a member of staff and expressly withholds their consent to their personal data being disclosed to their parents, WCE may be obliged to keep the information confidential unless WCE considers that there is a good reason to do otherwise.
Children can make a subject access request for their own personal data if they have sufficient maturity to understand the request they are making. A child may ask a parent or other representative to make a request on their behalf. Whilst a parent will generally be entitled to make a subject access request on behalf their child, the personal data will always be considered to be the child’s at law and, if of sufficient maturity, that child’s consent or authority may be required to be obtained by the parent making the request. All information requests from, on behalf of or concerning children – whether made under subject access or simply as an incidental request – will therefore be considered on a case by case basis.
WCE will update this notice from time to time. Any substantial changes that affect your rights will be notified on our website and, as far as reasonably practicable, notified to you.
If you believe that WCE has not complied with this notice or acted other than in accordance with data protection laws, you should notify the College’s Data Information Officer. You can also make a referral to or lodge a complaint with the Information Commissioner’s Office (ICO), although the ICO recommends that steps are taken to resolve the matter with WCE before involving the regulator.
Legal & Compliance Director