Privacy notices

We're committed to protecting your privacy when you use our services. You should read the councils corporate privacy notice because it will give you information about use of data by the council generally, as well as details of how to contact us and your rights.

This privacy notice explains how the council processes personal data in relation to the Holiday Activity and Food (HAF) Programme.

EEQU Ltd provides the booking platform. This includes:

• hosting the booking system
• supporting initial eligibility checks
• sharing information with us
• enabling bookings and attendance registers to be managed
• supporting data exports
• storing data
• assisting with data subject rights or deletion requests

EEQU may collect and use some information for its own account management and platform administration purposes so you should also read EEQU’s own privacy notice when creating or using your EEQU account.

We commission Providers to deliver activity camps under the HAF Programme. The booking form allows you to select the provider from a list of options. The provider you select will receive the relevant information needed to deliver the activity and manage your booking, as explained further in this notice. Providers may give you their own privacy information if they collect or use additional information separately from the HAF booking process.

In this notice, “we” and “us” includes the council, EEQU and Providers where they are acting on the council’s behalf.

Personal data 

Depending on your involvement with the HAF programme, the information we hold may include: 

Personal data

We collect personal information to manage participation, ensure safety, and support the delivery of the HAF Programme.

• Child’s name, address and date of birth
• Parent/carer name, email address and telephone number and confirmation of parental responsibility
• Emergency contact name and telephone number
• child’s eligibility for Free School Meals (FSM)
• School name and type of school attended
• Information about support needs and vulnerability factors
• CCTV images and records of incidents
• Attendance and participation data
• Child’s dietary requirements
• Safeguarding, welfare or protection information
• Photos or videos taken where consent has been provided 

Special category data

We may collect and use special category data, such as health information and, where indicated, details about religion or ethnicity, to support participation in the HAF Programme.

• Health (e.g. allergies, medical conditions, disabilities, support or adjustments required)
• Health, religion or belief and ethnicity/ethnic origin, where this is revealed or inferred from information such as dietary requirements, support needs, adjustments, photos or videos

Purpose for using it

We use your personal data to:

• check eligibility (including on discretionary grounds) and allocate places for the HAF programme
• manage bookings and routine communication
• deliver activities safely
• manage attendees’ health and support needs 
• record attendance and participation 
• meet our reporting obligations to DfE 
• signpost you to additional funding or support
• manage safeguarding, welfare, protection, and/or health & safety concerns 
• share information with you about future HAF provision or similar support
• manage sessions
• monitor delivery, quality assure the programme and understand basic delivery metrics
• create and publish public-facing promotional materials where consent has been given

Lawful basis 

For the most part, we process your personal data because this is necessary for us to comply with a legal obligation, or to perform a task carried out in the public interest or in the exercise of official authority vested in us under Children Act 1989 & 2004, Working Together to Safeguard Children 2018, Education Act 1996, Department for Education (DfE)’s grant determination letter and associated guidance.

We rely on consent for the purpose of:

• sending you non-essential HAF programme communications, such as newsletters or general updates
• using photos and videos which include you in public-facing promotional materials and/or reports sent to the Department for Education. 

The booking form includes optional consent fields for these purposes. Whether or not you choose to consent to these options, it will not impact on receiving a place under the HAF programme.  If you wish to withdraw your consent, you can contact us at [email – recommend group one], by telling the provider, or via the EEQU platform.  We will cease to process your data for the purposes which rely on consent if you withdraw this, but materials already published or shared may not always be retrievable.

Where necessary, we may also process your personal data on the basis of Article 6(1)(d) – Vital interests.

Where we process special category data, we rely on Article 9(2)(g) UK GDPR where processing is necessary for reasons of substantial public interest, supported by relevant conditions in Schedule 1 of the Data Protection Act 2018, including statutory and government purposes and safeguarding of children and individuals at risk. We may also rely on Article 9(2)(h) where processing is necessary for health or social care purposes, Article 9(2)(j) where processing is necessary for research or statistical purposes with appropriate safeguards, and Article 9(2)(c) where processing is necessary to protect someone’s vital interests in an emergency.

How we get your data

We may receive your personal data from:

• you directly, where you provide the information yourself
• parents, carers and emergency contacts
• the council’s Revenues and Benefits team (to check eligibility for FSM)
• Providers 

Who we share it with and why

We may share your personal data with the following:

• the provider you select on the booking form for the purposes explained in this notice. 
• EEQU to provide and administer the booking platform
• children’s social care, early help, police, health practitioners, or schools (in relation to safeguarding, welfare and/or protection matters)
• DfE (for programme monitoring, evaluation and funding assurance. Reporting will be aggregated or pseudonymised wherever possible, with identifiable photos/videos only used where consent has been given).
• public-facing promotional channels where consented photos/videos are used

Any automated decision making or profiling 

We do not make decisions about you based solely on automated processing, and we do not carry out profiling that produces legal or similarly significant effects on you.

Following completion of a booking form, eligibility checks are carried out by EEQU through a rule-based matching process using the child’s name and date of birth provided in the booking against a list of individuals eligible for FSM. The council will review the results and retain control over decisions.

Transfer of data to another country

Some tools integrated with EEQU’s technology maintain data residency within the European Economic Area (EEA). EEQU is a UK-based organisation subject to the UK GDPR. Transfers between the UK and the EEA are permitted because the UK has recognised EEA countries as providing an adequate level of data protection. More information can be found within EEQU’s privacy notice.

Retention period 

Personal data is kept in a form that permits identification of data subjects for no longer than necessary and a maximum of 5 years.

Date of notice

This notice was last updated on 17 June 2026.