Privacy notice - Holiday Activities and Food Programme

Middlesbrough Council funds the Holiday Activities and Food (HAF) Programme for eligible children across Middlesbrough and Redcar and Cleveland.

We use personal data such as name, address, contact details including mobile phone numbers, next of kin, parent or carer details, gender, school details, and benefits eligibility. We also collect ‘special category’ data including racial or ethnic origin, religious or philosophical beliefs, and health information. We collect this information directly from children, young people, and parents or carers and from other organisations like the UK Department of Education and other Council teams.

We use personal data where we have a ‘legal obligation’ and to carry out our ‘public tasks’. We use special category data where there is a ‘substantial public interest’ in law. Some of the laws that allow us to use personal data include the Children’s Act 2004, Education Act 1996, National Health Service Act 2006, Local Government Act 1972, and the Health and Safety at Work Act 1974.

We use personal information to publicise and provide a range of free, fun activities during some school holidays, to ensure eligible children receive a healthy and nutritious meal, enrichment, and reduced levels of learning loss. We carry out checks to make sure that the children and young people who apply are eligible for the HAF programme. We also use information to prevent, detect, and investigate fraud. 

We use special category data to make sure that we meet the needs of children including those with specific dietary requirements or health needs. We may also use some information where we think there is a need to protect or otherwise keep specific children safe. 

We share personal information with our contracted providers and other clubs, food suppliers, and voluntary and community groups, to help us to deliver these programmes. We may also share some personal data with Children’s Services teams in your home local authority, to protect or safeguard a child.

We use the following measures to ensure that your personal data is secure: data protection and security policies, information security incident reporting, data and device encryption, system and data access controls, user accounts and passwords, physical and environmental security, staff vetting practices, staff training and awareness, data back-ups, ICT network penetration testing, and business continuity and disaster recovery plans.

We only keep personal data for as long as the Law requires it as set out in our ‘Records Management Retention Schedules’ on our website.

No, your personal data is only processed and stored in the UK.

We will not use this personal data for any direct marketing purposes. But, from time to time, we may send you ‘public service messages’ via text message or email to make you aware of future programmes.

Your Information Rights are set out in law and, subject to some exceptions, you have the:

• Right to rectification - to ask for information to be corrected
• Right to erasure - to have your personal data deleted
• Right to object - to how your data is used
• Right to restriction - to request limits on how your data is used
• Right to portability - to request that we move your data to another organisation
• Right of subject access - to request a copy of data the Council holds about you

If you have a concerns about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner's Office. Visit the website of the Information Commissioner's Office.

If you would like to discuss anything in this privacy notice or your information rights, please contact:

The Data Protection Officer
Middlesbrough Council
PO Box 500, Middlesbrough, TS1 9FT
Phone: 01642 245432
Email: dataprotection@middlesbrough.gov.uk