Lancashire Outdoor Education Service

Lancashire Outdoor Education Service (LOE) is a major provider of outdoor residential facilities and activities, offered to schools, groups, individuals and businesses.

Our approach at Lancashire Outdoor Education is to use the outdoors to learn about ourselves, others, and the environment. We want you to try new things outside your comfort zone and explore your potential, making lifelong memories.

In order to comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.

Identity and contact details of the data controller

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Contact details of the data protection officer

Our Data Protection Officer is Paul Bond. You can contact him at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ

Purposes for processing

To manage our relationship with our customers (e.g. responding to questions, complaints, asking customers to partake in feedback).
To deliver on food provisions for customers including special diets and intolerances.
To deliver outdoor experiences safely with knowledge of medical conditions and/or specific needs.
For financial administration such as invoicing, card payments and journalling.
For statistical purposes, to improve our delivery of service to our customers.
For obtaining consent to use photographs and video for social media (Facebook, X) website and marketing.

Category of personal data being processed

Personal data (information relating to a living, identifiable individual)
Special category personal data (racial, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation)

Legal basis for processing personal data

The legal basis for processing your personal data, in accordance with the UK GDPR is:

Consent: the individual has given clear consent for us to process your personal data for a specific purpose.
Contract: the processing is necessary for a contract we have with you, or because we have asked you to take specific steps before entering into a contract.
Legal Obligation: the processing is necessary for us to comply with the law. We will cite the applicable legislation if we need to rely on this basis for processing.
Vital Interests: the processing is necessary to protect someone's life.
Public Task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law. We will cite the applicable task/function and its' basis in law if we wish to rely on this basis for processing.
Legitimate Interests: pursued by us or by a third party.

Legal basis for processing special categories of personal data

The legal basis for processing special categories of personal data relating to you, in accordance with the UK GDPR is:

You have given explicit consent to the processing of your personal data.
Processing is necessary for the purposes of carrying out our obligations or exercising our specific rights or your rights in the field of employment and social security and social protection law.
Processing is necessary to protect vital interests of you or another natural person where you or they are physically or legally incapable of giving consent.
Processing is carried out in the course of legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim.
Processing relates to personal data which is made public by you.
Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.
Processing is necessary for reasons of substantial public interest.
Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of an employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.
Processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices.
Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

Recipients of the data

All employees of Lancashire Outdoor Education Service.
Associate Tutors (freelance workers) employed by Lancashire Outdoor Education Service.
Agency workers employed by Lancashire Outdoor Education Service.

Information we share

Full Name
Date of Birth
Gender
Address
Email address
Telephone/Mobile number
Medical conditions and additional information relating to
Disability and/or specific needs and additional information relating to
Health issues or concerns and additional information relation to
Dietary information
Parent/Carer contact number (if a child is visiting a centre)
Name of School (if a child is visiting a centre)
Year group (if a child is visiting a centre)
Bedroom Lists (if a visit is residential)
Group Registers
Activity Group Lists
Activity programmes
Photo/Video consent for social media, website and marketing

Any transfers to another country

Retention periods

Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.

File type	Description	Security	Retention period
Email	Emails held in Outlook that haven't been exported or moved elsewhere.	Encrypted used when emailing personal data to partners.	Retained in accordance with appropriate internal retention guidelines
LOE Customer booking forms	Completed booking forms including full customer details	Stored within MS365 software for LOE employees with access only.	Retained within MS365 software for 2 years and then archived.
Bedroom lists	Details of which individual slept in which room and building, if the visit to the centre is residential	Stored within MS365 software for LOE employees with access only. Additionally stored in locked fire secured box during visit. Customer, employees of LOE, associate tutors and agency with access only	In the case of groups under the age of 18, held in the Centre within MS365 for two years and then archived until the individual has reached the age of 45 years. In the case of groups over the age of 18, held within MS365 software for two years and then archived for a further 8 years.
Group Registers	Details of every individual attending a centre, including: Full Name Date of Birth Gender Medical Conditions Dietary information Health issues/concerns	Stored within MS365 software for LOE employees with access only. When applicable, data shared with associate tutors and agency staff during their employment.	Retained within MS365 software for 2 years and then archived. In the case of groups under the age of 18, held in the Centre within MS365 for two years and then archived until the individual has reached the age of 45 years. In the case of groups over the age of 18, held within MS365 software for two years and then archived for a further 8 years.
Activity Group Lists	Details of every individual partaking in activities at a centre including: Full Name Date of Birth Gender Medical Conditions Dietary information Health issues/concerns	Stored within MS365 software for LOE employees with access only. When applicable, data shared with associate tutors and agency staff during their employment.	Retained within MS365 software for 2 years and then archived. In the case of groups under the age of 18, held in the Centre within MS365 for two years and then archived until the individual has reached the age of 45 years. In the case of groups over the age of 18, held within MS365 software for two years and then archived for a further 8 years.
Activity Programmes	Details the daily activities each group is undertaking including: Name of visiting group Group numbers Lead adult from visiting group responsible for activity group LOE employee name and/or associate tutor name leading the activity group	Managed by the Operations Manager or in the absence of, LOE employees at centre level. Accessible only by LOE employees and associate tutors with access to office space.	Photographic documentation retained within MS365 software for 2 years and then archived. In the case of groups under the age of 18, held in the Centre within MS365 for two years and then archived until the individual has reached the age of 45 years. In the case of groups over the age of 18, held within MS365 software for two years and then archived for a further 8 years.
Photography and/or Videography	Photos and videos captured of individuals with consent, during their visit to a centre, including consent forms	Stored within MS365 software for LOE employees with access only.	Subject to review after 2 years. Upon expiry, consent for any further usage will be sought as required.
Financial details	Invoicing, journalling and card payment receipts	Stored within MS365 software for LOE employees with access only.	3 years from the end of the financial year.

Your rights

You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are those rights:

to be informed via Privacy Notices such as this.
to withdraw your consent. If we are relying on your consent to process your data then you can remove this at any point.
of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
of rectification, we must correct inaccurate or incomplete data within one month.
to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights then you can do so by contacting:

Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ

Email: dpo@lancashire.gov.uk

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.

Further information

If you would like more information about this specific service then please contact outdoor.education@lancashire.gov.uk.

For more information about how we use personal information see Lancashire County Council's full privacy notice.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.

Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).