Contact:

Zoe Davis – Director

zoedavis@thegroundschool.org.uk

Groundschool CIC, Irongate Farm, Halls Green, Weston, Hertfordshire, SG4 7DR

Introduction

Groundschool CIC ensures that personal data in relation to Customers, Service Users, Practitioners, Staff, and Partners is used fairly, lawfully and transparently.

The UK Data Protection Act 2018 implements the EU General Data Protection Regulation (GDPR), a legal framework that sets guidelines for the collection and processing of personal information of individuals within the European Union (EU). It stresses 8 principles, that data must be:

1. Fairly and lawfully processed

2. Processed for limited purposes

3. Adequate, relevant and not excessive

4. Accurate

5. Not kept for longer than is necessary

6. Processed in line with your rights

7. Secure

8. Not transferred to other countries without adequate protection

Scope of this Information Policy

This policy addresses all information, systems, facilities, programs, data, networks and all users of technology in the Groundschool organisation, without exception. Groundschool Directors and Managers will identify the types of data, basis for lawful processing, and the locations of data storage. Groundschool CIC handles personal data and sensitive information in both physical and digital formats.

Information includes:

• address and contact information

• dietary requirements

• financial information relating to customer accounts

• records of attendance at farm events and activities including outcome monitoring and customer feedback

• Safeguarding information – farm activities may also involve some engagement with children and families. In such cases the Safeguarding Policy will be applied.

Organisation wide security mandates:

Handling client sensitive data will be in a digital format, accessed only by secure password for accessing the cloud-based system.

No staff will ever share their user id or password with anyone outside the organisation.

Permissions for access

Groundschool Directors and Managers will regularly review permissions for access.

How we manage the security of personal data held

Groundschool CIC has responsibilities as a Data Controller. Data controllers are responsible for implementing appropriate technical and organisational measures to ensure and demonstrate that any data processing is performed in compliance with the GDPR. Controllers’ obligations relate to principles such as:

• lawfulness,

• fairness and transparency,

• purpose limitation,

• data minimisation, and

• accuracy, as well as

• fulfilling data subjects’ rights with respect to their data.

The lawful basis for processing data is consent. This consent is secured at the point of data collection in keeping with our Privacy Policy.

As a Data Controller involved in Cloud-based Processing of Client Sensitive Data – GDPR applies to our using Google for processing client data.

Privacy and Confidentiality

All customers and service users have a right to privacy. This means that their personal information will be protected by staff of Groundschool and through the processes and procedures of recording and reflecting upon confidential and personal identifying information. There are some exceptions to confidentiality and privacy for example when we believe that a child or vulnerable adult is experiencing abuse or neglect or is at risk of significant harm. We will address these in keeping with our Safeguarding Policy.

It is the responsibility of all staff to identify, determine and protect all information which could be regarded as confidential.

Staff are required to have a basic understanding of the data protection act before recording information of a personal nature on a personal computer.

Examples of confidential information include: all client information, and correspondence, information relating to personnel, policies and procedures and financial information, accounts, and budgets.

Subject Access Requests (SARS)

Under GDPR, the data subject has a right of access to data which is held about them. Data subjects have the right to obtain:

• Confirmation that their data is being processed

• Access to their personal data

• Other supplementary information

Data subjects are free to access their information at any time. Groundschool CIC is not permitted to make a charge to process this request, unless the request is felt to be manifestly unfounded or excessive.

Before processing the request, Groundschool CIC must take reasonable steps to verify the identity of the requestor. Once their identity has been verified, the data must be given to the requestor without delay, and at the least within one month. If the request is complex, or there are numerous requests Groundschool CIC will extend this period by a further two months. If this is the case, Groundschool CIC must contact the requestor within one month to explain this extension.

Openness and Transparency

Groundschool CIC will, at all times, make every reasonable attempt to be open and transparent about the data it collects, for what purposes and what happens to it.

Groundschool CIC will respond quickly and efficiently when data is found to be out of date, incorrect or misleading. Groundschool CIC will make every reasonable attempt to correct these data in an efficient timeframe.

In any case, Groundschool CIC will keep the data subject informed of progress and will implement a duty of candour in order to be open, transparent and accountable for its actions.

Data Retention and Data Destruction

Groundschool CIC operates according to the GDPR storage limitation period ensuring that data is not kept for longer than it is needed. Retention periods are determined according to insurance, legal, accountability and valid reference purposes.

Reviews of Policies

This policy was reviewed by:

Signed: Zoe Davis

Date: 21st Sept 2026

Position: Director

• Previous revision date: N/A

• Last reviewed: 21st Sept 2026

• The next revision date is: Sept 2027