Privacy notice

Evouchers Ltd, trading as HolidayActivities (“HolidayActivities”, “we” or “us”) has created its event booking management software which we operate through our website https://holidayactivities.com/ (“Website”), and associated applications, collectively known as the HolidayActivities Software to facilitate the provision of services for the Government’s Holiday, Activities and Food Programme (“HAF”) within the HolidayActivities platform (“HolidayActivities Platform”).

This privacy notice (“Privacy Notice”) governs those that access and use our HolidayActivities Software as an authorised user (“Authorised User”) for the purpose of accessing the HolidayActivities Platform. An Authorised User could be a participant in the HAF programme such as a local authority or a school; a parent or guardian of a HAF participant; or an event/activity organiser needing access to the HolidayActivities Platform.

Each Authorised User shall have its own contractual relationship with HolidayActivities and this Privacy Notice oversees the collection, use and processing of any personal data within the HolidayActivities Platform, where we have control of it.

Please note that whilst accessing and using our HolidayActivities Platform, you may consent to providing personal data to a third party, including but not limited to an event/activity organiser, local authority or school. These third parties will collect and process any data in accordance with its own privacy policy or notice which we encourage you to read before sharing any personal data with them. HolidayActivities are not responsible for these third parties or any personal data you share with them or their policies and notices.

Overview

At HolidayActivities, we take privacy very seriously. We have prepared this Privacy Notice to ensure that we communicate to you, in the clearest way possible, how we treat your personal information. We encourage you to read this Privacy Notice carefully as it governs the use of the HolidayActivities Platform and our services to you.

We are committed to ensuring that your personal information remains confidential and secure in accordance with applicable Data Protection Legislation (defined below).

This notice sets out how we look after your personal data if you are a:

Parent, legal guardian, HAF event participant or student;
Member of staff at an education establishment such as a school or college;
Authorised User of the HolidayActivities Platform;
Supplier, retailer or business contact of HolidayActivities;
Any third party organisation that uses HAF as an approved event/activity organiser;
A local authority;
A general buyer of our Services in the HolidayActivities Platform; and/or
A national or Government body.

This Privacy Notice (together with any applicable terms of service, general terms of use, and from time to time any further contractual terms or any other documents or terms incorporated by reference) describes the types of information that we collect from you, through the use of the HolidayActivities Platform and our related services, and how that information may be used or disclosed by us and the safeguards we use to protect it.

The personal information that we collect is used for providing and improving our services. We will not use or share your information with anyone except as described in this Privacy Notice.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

We may update this Privacy Notice from time to time. Every time you wish to use the HolidayActivities Platform, please check this Privacy Notice and any additional terms linked to it to ensure you understand the terms that apply at that time. Your continued use of the HolidayActivities Platform shall be deemed to constitute your acceptance and acknowledgement of any such changes.

Who are HolidayActivities?

Evouchers Ltd has several different trading names, including Evouchers and HolidayActivities. Evouchers Ltd is a company incorporated in England and Wales, with registered company number 14159254.

This Privacy Notice applies to any personal data we collect through the HolidayActivities Platform to enable us to deliver our services.

Our address is Furlong House, 2 Kings Court, Newmarket, Suffolk, England, CB8 7SG.

We have in place an Information Security Compliance Team to oversee all matters relating to data protection and information security.

We also have a Data Protection Officer who is responsible for overseeing questions in relation to this Privacy Notice. If you have any questions about this Privacy Notice, including any requests to exercise your legal rights, please contact the Data Protection Officer as follows:

Address: Furlong House, 2 Kings Court, Newmarket, Suffolk, England, CB8 7SG

Email address: data@wonde.com

Our ICO registration number is ZB504479

We will only process personal information about you in accordance with the UK “Data Protection Legislation” which for the purposes of this Privacy Notice shall mean: all applicable data protection and privacy legislation in force from time to time in the UK including without limitation the UK GDPR; the Data Protection Act 2018 (and regulations made thereunder) and the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) as amended; and all other legislation and regulatory requirements in force from time to time which apply to a party relating to the use of personal data (including, without limitation, the privacy of electronic communications); and the guidance and codes of practice issued by the Commissioner or other relevant regulatory authority and which are applicable to a party.

Your personal information is processed and stored in accordance with the legal requirements in the Data Protection Legislation.

What does HolidayActivities do?

We provide a dedicated platform built to run and report on your Local Authority HAF Programme This software is supplied in the form of the HolidayActivities Platform, which can be used by schools, local authorities, government bodies, housing associations and other organisations to deliver the HAF programme directly to its participants.

The purpose of this Privacy Notice

The purpose of this Privacy Notice is to set out how we collect and use your personal data when we directly control the personal data as a data controller in respect of the HolidayActivities Platform through the HolidayActivities Software and how any data is used by us.

The data we collect and how we collect it

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together depending on your relationship with us (for instance, whether you are a recipient and direct beneficiary of the HAF programme, a local authority in your capacity as a buyer or an event organiser) and these are as follows:

Identity Data: includes first name, last name, username or similar identifier, unique pupil number, student FSM number, date of birth, gender, photography and images.
Financial Information: bank account details or credit card information for payment by any buyer.
Contact Data: your email address, telephone number and postcode.
Relatives Data: the name(s) of any parent(s), legal guardians /or child or children, parental responsibility and priority contact data.
Transaction Data that may include details about payments we receive, invoices and purchase orders.
Technical Log Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access the HolidayActivities Platform.
Profile Data includes your authorised username and password, orders made by you (if applicable), complaints, preferences, and any feedback responses.
Usage Data includes information about how you use the HolidayActivities Platform, its products and services.
Cookies Data like many websites, we may use some “cookies” to enhance your experience and gather information about the visitors and number of visits to the HolidayActivities Platform.
Third Parties and Information we receive from other sources We may receive information about you if you use any of the other websites we operate or via other services we provide. In this case we will have informed you when we collected that data, that it may be shared internally and combined with data collected in the HolidayActivities Software and the HolidayActivities Platform.
Characteristic and Demographic Data includes information about whether a pupil may be entitled to free school meals, eligibility for the HAF scheme, security PIN or Password for pick up.

Special Category and Sensitive Data includes types of data relating to additional needs, allergies, health or dietary requirements which may be necessary to facilitate the provision of the HAF services.
Analytics includes third-party analytics services (such as Google Analytics) to evaluate your use of the HolidayActivities Platform and our HolidayActivities Software, compile reports on activity, collect demographic data, analyse performance metrics, and collect and evaluate other information relating to our website and internet usage. These third parties use cookies and other technologies to help analyse and provide us the data. By accessing and using the HolidayActivities Software, you consent to the processing of data about you by these analytics providers in the manner and for the purposes set out in this Privacy Notice.
Media Images include any photographs or videos that may be used or taken. Where this happens, we shall only do so with your consent and we will discuss with you how any images / information shall be used or shared.

You can withhold your personal data from us, but we may not be able to provide our services to you if you do so.
We may collect your personal data from different sources:

We collect all of the types of data listed above directly from you when you interact with us. This includes when you register or use the HolidayActivities Platform, in the course of us providing our services or via one of our other platforms (including our applications), and when you log in to these.
We collect Identity Data, Contact Data, Relatives Data, Characteristic and Demographic Data and Special Category Data from either yourself directly or from the school(s) you are connected to, or any relevant local authorities or other relevant bodies or organisations to enable the provision of the services to you.
We collect Technical Data automatically when you interact with the HolidayActivities Platform, by using cookies and other similar technologies.

How we use your personal data

We (or third party data processors, agents and sub-contractors acting on our behalf) may collect, store and use your personal information by way of different methods to collect data from and about you including through:

Direct interactions. This is information (including Identity, Contact and Financial Data) you consent to giving us about you, when you voluntarily provide information to us to fill in forms through the HolidayActivities Platform or send to us directly, or by corresponding with us (for example, by email or chat). It includes information you provide when you register, buy or use any of our services through the general use of the HolidayActivities Platform, or when you create an account with us and finally when you report a problem with our services, the HolidayActivities Platform, or more generally in the HolidayActivities Software. If you contact us, we will keep a record of that correspondence.

Information we collect about you and your device either automated or otherwise. Each time you visit or use the HolidayActivities Platform, we will automatically collect personal data including Technical Log Data. We collect this data using cookies and other similar technologies including server logs. We may also receive technical data about you if you visit other websites employing our cookies. We may also collect Technical Log Data if you contact us and use our services generally through the HolidayActivities Platform.

Information we receive from other sources including third parties and publicly available sources. We may receive personal data about you from various third parties such as Government bodies, local authorities, schools and education establishments, or event/activity organisers, but we will only use the personal data where we are allowed to do so and to enable us to provide the services and the use of the HolidayActivities Platform to you.

If you provide us with personal data for a specific purpose, we shall use the personal data in connection with the personal data for which it was intended. If you provide personal data to us in order to obtain access to or use the HolidayActivities Platform and to benefit from the services we provide, we will use the personal data for that purpose.

We will also use your personal data for internal purposes as set out further below.

There may also be occasions where we are required under law to disclose specific personal information about you to the local authority, Government body or relevant buyer of our services in the provision of the HolidayActivities Platform. We will only do this where we are legally able to do so, or where you have consented to this processing.

We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions, which include strict confidentiality and contractual terms.

We will only use your personal data when the law allows us to. Most commonly we will use your personal data in the following circumstances:

Where you have consented before the processing.
Where we need to perform a contract we are about to enter into, or have entered into with you.
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
Where we need to comply with a legal or regulatory obligation.
Where it is a public task i.e. the processing is necessary for us to perform a task in the public interest or for any official functions, and the task or function has a clear basis in law.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

When we are acting as a data controller, we will use your personal data for the purposes set out in the table below.

The law sets out a number of different reasons for which we can collect and use your data. The legal grounds on which we collect and use your data are also set out in the table below. Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

Purpose for using your data	Legal ground for using your data for this purpose
To allow you to access your account in the HolidayActivities Platform and to register an account with us. To enable access to the HolidayActivities Platform via a link or text message. To enable you to receive the benefit of the services in the HolidayActivities Platform.	Necessary for our legitimate interests (to allow those with an account on the HolidayActivities Platform to use it and benefit from our services) / Performance of a contract with us. To comply with a legal obligation / To perform a task carried out in the public interest.
To manage any account and deliver our services, including managing payments, collecting money owed to us and any financial information.	Necessary for our legitimate interests (to recover debts due to us and for payment for Services) / Performance of a contract with us / To perform a task carried out in the public interest.
To enable communication in the provision of the Services.	Necessary for our legitimate interests (to allow local authorities, schools or event organisers who use the HolidayActivities Platform, staff, recipients/participants to use and access the HolidayActivities Platform).
To provide support to you when you contact us	Necessary for our legitimate interests (to respond to support calls, software problems as our users would expect)/ To perform a task carried out in the public interest/ To comply with a legal obligation.
To manage our relationship with you, which will include notifying you about changes to our Privacy Notice, any correspondence with you.	Necessary for our legitimate interests (to provide important updates to our users).To enter into and/or perform a contract with you.
To administer and protect our business and the HolidayActivities Platform (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data).	Necessary for our legitimate interests (to protect our business, software and website; to keep our services updated).
To deliver relevant system, software and website content and advertisement and promotional activity to measure or understand the effectiveness of the business.	Necessary for our legitimate interests (to study how Authorised Users use our products/services, to develop them, to grow our business and to inform our marketing strategy).
We may collect and use photography, images or film in case studies, media and press publications and marketing materials.	We shall only do this with your consent.
To use data analytics to improve our website, software, products/services, marketing, customer relationships and experiences.	Necessary for our legitimate interests (to continuously improve our services for our customers and users).
To create anonymous aggregated data, as set out below.	Necessary for our legitimate interests (to provide additional benefits and functionality to our customers and users without disclosing personal data).
To comply with applicable laws and regulatory obligations.	To comply with a legal obligation.

Aggregated Data

We may aggregate and use non-personally identifiable data we have collected from you and others. This data will in no way identify you or any other individual.

We may use this aggregated non-personally identifiable data to:

assist us to better understand how our users are using the HolidayActivities Platform and services;
provide users with further information regarding the uses and benefits of Evouchers and the HAF Programme; and
otherwise to improve our HolidayActivities Platform.

Cookies when using our Site

We use a Cookie consent management tool to manage your Cookie options. Upon visiting our site you will be asked to select your cookie preferences. If you would like more information on how we handle Cookies, please contact us.

Who has access to your personal data and who do we share it with?

We only use your personal data in the provision of our services. We will not share it with any third party not accounted for in this privacy notice.

We may need to share your personal data with other organisations when using your personal data as set out in the table above. We may share your personal data with the following third parties:

Our professional advisers, including lawyers, auditors and insurers.
Service providers and associated companies who may provide IT, business and system administration services, or who store or manage data on our behalf.
Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Notice.
Local Authorities, Government bodies or any other buyer of our services, who require access to your personal data to facilitate the provision of the HAF programme, for reporting purposes, and the cross delivery of our services via the HolidayActivities Platform.
Event organisers or retailers who require access to your personal data to facilitate the provision of the HAF programme and the cross delivery of our services via the HolidayActivities Platform.

Where any of your personal data is required for such a purpose, we will take all reasonable steps to ensure that your personal data will be handled safely, securely, and in accordance with your rights, our obligations, and the obligations of the third party under the Data Protection Legislation. This type of external data processing is always subject to contractual assurances between us and the third party that personal data will be kept securely and used only in accordance with our specific directions.

International Transfers

Subject to us complying with Data Protection Legislation and ensuring appropriate safeguards are in place, we may transfer your personal data to third parties providing services to us who are based outside of the UK without obtaining your specific written consent. This may include parties providing IT administration services and hosting services, and parties providing assistance with managing our marketing databases.

Whenever we transfer your personal data outside of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

(a) the personal data is transferred to or processed in a territory which is subject to adequacy regulations under the Data Protection Legislation, and that the territory provides adequate protection for the privacy rights of individuals such as the EEA; or
(b) we participate in a valid cross-border transfer mechanism under Data Protection Legislation, so that we (and, where appropriate, the school, education establishment, local authority or any other relevant organisation using our Services) can ensure that appropriate safeguards are in place to ensure an adequate level of protection with respect to the privacy rights of individuals as required under the UK GDPR; or
(c) the transfer otherwise complies with Data Protection Legislation.

Retention period

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

For more details of our specific retention periods, please contact our Data Protection Officer.

Data Security

Data security is of great importance to us, and to protect your data we have put in place suitable physical, electronic and managerial procedures to safeguard and secure data collected through the HolidayActivities Platform.

We have implemented significant security measures to maintain a high level of security. We use all reasonable endeavours to maintain our ISO 27001 accreditation to ensure we meet those high standards continuously.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Notwithstanding the security measures that we take, it is important to remember that the transmission of data via the internet may not be completely secure and that you are advised to take suitable precautions when transmitting to us data via the internet and you take the risk that any sending of that data turns out to be not secure despite our efforts.

If we give you a password upon registration and use of the HolidayActivities Platform, you must keep it confidential. Please don’t share it.

How do we protect personal information?

We implement a variety of security measures to protect and maintain the safety of your personal information including encrypted software. Your personal information is contained behind secured networks and is only accessible by a limited number of persons who have special access rights to such systems, and are required to keep the information confidential.

Your rights as a data subject

Under certain circumstances, you have rights under the Data Protection Legislation in relation to your personal data. These rights are set out below. If you wish to exercise any of the rights set out below, please contact our Data Protection Officer.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

Your rights are as follows:

Right of access – you have the right to request a copy of the personal data that we hold about you and to check that we are lawfully processing it.
Right of rectification – you have a right to request that we correct personal data that we hold about you that is inaccurate or incomplete.
Right to be forgotten / erasure – in certain circumstances you can ask for the data we hold about you to be erased from our records i.e. when there is no good reason for us continuing to process it.
Right to restriction of processing – where certain conditions apply, you have a right to restrict or suspend the processing, for example if you want us to establish its accuracy or the reason for processing it.
Right of portability – you have the right to have the data we hold about you transferred to another organisation.
Right to object – you have the right to object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms.

There are some exceptions to the above rights.

Right to withdraw consent. In the limited circumstances where you have provided your consent to the collection, processing and transfer of the personal data referred to above, you may withdraw that consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent, or to processing carried out on other legal grounds. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

All of the above requests will be forwarded to the relevant party should there be a third party involved in the processing of your personal data.

Access to Sensitive and Special Category Data

We acknowledge that there are strict rules of access and use of sensitive and special category personal data.

From time to time, it may be necessary for us to collect personal data that is classified as Sensitive and Special Category Data under the Data Protection Legislation in the provision of our services in the HolidayActivities Platform and in the delivery of the HAF programme.

We will only do this where we have a lawful basis to do so and extra care will be taken when collecting, processing or sharing this type of data. Such lawful bases might include:

where we have explicit consent;
where processing is necessary to protect the vital interests of the data subject or another natural person where the data subject is physically or legally incapable of giving consent;
where processing is necessary for reasons of substantial public interest
where we are permitted to for statutory purposes

Complaints to the Information Commissioner’s Office

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance by emailing us at dpo@wonde.com.