Our contact details
Name: Chalknduster ltd
Address: Unit 5, 1-3 Kingsley Road, TW3 1PA
Phone Number: 02085805050
The type of personal information we collect
We currently collect and process the following information:
Personal identifiers, contacts and characteristics (for example, name and contact
details)
September 2021
How we get the personal information and why we have it
Most of the personal information we process is provided to us directly by you for one
of the following reasons:
When you express interest in Chalknduster Tutors and book a free trial session, we
will collect and process the following data from you:
• your name;
• email address which will be used to send you a confirmation email
• contact telephone numbers which will be used to send you a confirmation SMS and
confirmation call
• child’s name, age, school and reason for interest in tuition
When you join Chalknduster Tutors, we will collect and process the following data
from you:
• Parent/Guardian’s name, postal and email address, contact phone numbers
• Membership payer’s name, postal and email address, contact phone numbers (if not
parent/
guardian)
• Emergency contact’s names and phone numbers
• Child/ren’s name, age, date of birth and school
• Information about any medical conditions, allergies or Special Educational Needs of
child/ren
• Details of Direct Debit and debit/credit cards in order for us to accept payment
Members should notify Chalknduster of any changes in circumstances to enable
personal records to be updated accordingly:
What can I opt out of?
When you join ChalknDuster, you have 2 consent options:
• You have the option of allowing us to use your child’s photo for the purpose of
promoting ChalknDuster during and/or after your membership.
Who will your personal information be shared with?
If we are obliged to disclose personal data by law, or if the disclosure is necessary for
purposes of national security, taxation and criminal investigation or to safeguard your
child, we will do so. In some circumstances, you may not be notified first.
Your data is hosted on several different systems. All these providers have relevant
safeguards in place to protect your data in the same way that we do.
September 2021
What happens with my data when my membership ends and how is it retained?
• Upon cancellation of membership, your data will be stored safely and securely. We
will retain your personal data for a minimum of 2 years and a maximum of 3 years
following cancellation of your membership to comply with relevant safeguarding
bodies regulations.
• Accident/Incident reports and Administration of Medication records will be kept
indefinitely.
• Registers of attendance will be kept for 3 years.
Data protection principles
All processing of personal data must be done in accordance with the following data
protection principles of the Regulation, and ChalknDuster’s policies and procedures
are designed to ensure compliance with them.
These are:
- Personal data must be processed lawfully, fairly and transparently
The GDPR introduces the requirement for transparency whereby the controller has
transparent and easily accessible policies relating to the processing of personal data
and the exercise of individuals’ “rights and freedoms”. Information must be
communicated to the data subject in an intelligible form using clear and plain
language.
The specific information that must be provided to the data subject must as a
minimum include:
• the contact details of the Data Protection Officer, where applicable
• the purposes of the processing for which the personal data are intended as well as
the legal basis for the processing
• the period for which the personal data will be stored
• the existence of the rights to request access, rectification, erasure or to object to
the processing
• the categories of personal data concerned
• the recipients or categories of recipients of the personal data, where applicable
• any further information necessary to guarantee fair processing
- Personal data can only be collected for specified, explicit and legitimate
purposes
September 2021
Data obtained for specified purposes must not be used for a purpose that differs from
those formally notified to the Information Commissioner as part of ChalknDuster’s
GDPR registration.
- Personal data must be adequate, relevant and limited to what is necessary
for processing
• The GDPR Owner is responsible for ensuring that information, which is not strictly
necessary for the purpose for which it is obtained, is not collected.
• All data collection forms (electronic or paper-based), including data collection
requirements in new information systems, must be approved by the GDPR Owner.
• The GDPR Owner will ensure that, on an annual basis all data collection methods are
reviewed to ensure that collected data continues to be adequate, relevant and not
excessive.
- Personal data must be accurate and kept up to date
• Data that is kept for a long time must be reviewed and updated as necessary. No
data should be kept unless it is reasonable to assume that it is accurate.
• Members should notify ChalknDuster of any changes in circumstance to enable
personal records to be updated accordingly.
• It is the responsibility of staff at ChalknDuster to ensure that data held by
ChalknDuster is accurate and up-to-date. Completion of an appropriate registration or
application form etc. will be taken as an indication that the data contained therein is
accurate at the date of submission.
- Personal data must be kept in a form such that the data subject can be
identified only as long as is necessary for processing
• Where personal data is retained beyond the processing date, it will be
pseudonymised in order to protect the identity of the data subject in the event of a
data breach.
• Personal data will be retained in line with the retention of records procedure and,
once its retention date is passed, it must be securely destroyed as set out in this
procedure.
- Personal data must be processed in a manner that ensures its security
September 2021
• Appropriate technical and organisational measures shall be taken against
unauthorised or unlawful processing of personal data and against accidental loss or
destruction of, or damage to, personal data.
• These controls have been selected on the basis of identified risks to personal data,
and the potential for damage or distress to individuals whose data is being processed.
• Personal data shall not be transferred to a country or territory outside the European
Union unless that country or territory ensures an adequate level of protection for the
‘rights and freedoms’ of data subjects in relation to the processing of personal data.
• The transfer of personal data outside of the EU is prohibited unless one or more of
the specified safeguards or exceptions apply.
- Accountability
The GDPR introduces the principle of accountability which states that the controller is
not only responsible for ensuring compliance but for demonstrating that each
processing operation complies with the requirements of the GDPR.
Specifically, controllers are required to maintain necessary documentation of all
processing operations, implement appropriate security measures, perform DPIAs
(Data Processing Impact Assessment), comply with requirements for prior
notifications, or approval from supervisory authorities and appoint a Data Protection
Officer if required.
- Data subjects’ rights
Data subjects have the following rights regarding data processing, and the data that
is recorded about them:
• To make subject access requests regarding the nature of information held and to
whom it has been disclosed.
• To prevent processing likely to cause damage or distress.
• To prevent processing for purposes of direct marketing.
• To be informed about the mechanics of automated decision-taking process that will
significantly affect them.
• Not to have significant decisions that will affect them taken solely by automated
process.
• To sue for compensation if they suffer damage by any contravention of the GDPR.
• To take action to rectify, block, erased, including the right to be forgotten, or
destroy inaccurate data.
• To request the ICO to assess whether any provision of the GDPR has been
contravened.
September 2021
• The right for personal data to be provided to them in a structured, commonly used
and
machine-readable format, and the right to have that data transmitted to another
controller.
• The right to object to any automated profiling without consent.
- Right to be forgotten
Data Subjects who wish to exercise their right to be forgotten can request this by
contacting info@chalknduster.co.uk. However, due to our Ofsted/Care Inspectorate
registration, we are required to keep the following data for 2 years following
cancellation of membership:
• The name, home address and date of birth of each member
The name, home address and telephone number of a parent/guardian/carer of each
member
• A daily record of the names of the children and their hours of attendance.
• The right to be forgotten can be exercised after this 2 year period of nonmembership. For any Data Subject who did not become a member of ChalknDuster, a
request for the right to be forgotten will be completed within 30 days.
- Complaints
Data Subjects who wish to complain to ChalknDuster about how their personal
information has been processed may lodge their complaint directly with the GDPR
Owner by email to info@chalknduster.co.uk
Data subjects may also complain directly to the supervisory authority.
- Consent
ChalknDuster understands ‘consent’ to mean that it has been explicitly and freely
given, specific, informed and unambiguous indication of the data subject’s wishes by
which he or she by statement, or by a clear affirmative action, signifies agreement to
the processing of personal data relating to him or her. The consent of the data subject
can be withdrawn at any time.
- Security of data
All Employees/Staff are responsible for ensuring that any personal data which
ChalknDuster holds and for which they are responsible, is kept securely and is not
under any conditions disclosed to any third party unless that third party has been
specifically authorised to receive that information and has entered into a
September 2021
confidentiality agreement. Care must be taken to ensure that PC screens and
terminals are not visible except to authorised Employees/Staff. Manual records may
not be left where they can be accessed by unauthorised personnel and may not be
removed from business premises without explicit authorisation. As soon as manual
records are no longer required for day-to-day membership support, they should be
archived. Personal data may only be deleted or disposed of in line with the Data
Retention Procedure. Manual records that have reached their retention date are to be
shredded and disposed of as ‘confidential waste’.
- Rights of access to data
Data subjects have the right to access any personal data (i.e. data about them) which
is held in electronic format and manual records which form part of a relevant filing
system.
- Disclosure of data
ChalknDuster must ensure that personal data is not disclosed to unauthorised third
parties which includes family members, friends, government bodies. ChalknDuster will
only disclose and discuss personal data with the Primary contact.
The GDPR permits certain disclosures without consent so long as the information is
requested for one or more of the following purposes:
• to safeguard national security
• prevention or detection of crime including the apprehension or prosecution of
offenders
• assessment or collection of tax duty
• to protect the vital interests of the individual
• to safeguard our members including contact with local safeguarding boards
All requests to provide data for one of these reasons must be supported by
appropriate paperwork and all such disclosures must be specifically authorised by the
GDPR Owner.
- How to complain
If you have any concerns about our use of your personal information, you can make a
complaint to us at info@chalknduster.co.uk
You can also complain to the ICO if you are unhappy with how we have used your
data.
September 2021
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk
