School Trunk Ltd Privacy Policy

Effective Date: 7th September 2020

We are dedicated to protecting the privacy of those who visit our Website and whose data is stored on our Website. This Privacy Policy explains how we collect Personal Data on our Website or through third parties, how we protect such data, and the rights you have concerning the use of such data. Please read this Privacy Policy carefully.

WHO WE ARE
This Privacy Policy applies to our website which you are currently visiting (“Website”) as well as to our schools who provide us with data. The controller of Personal Data collected via both these methods according to Art. 4(7) GDPR is School Trunk Ltd, 10 Horseshoe Park, Pangbourne, Reading RG8 7JW.

WHAT DATA IS COLLECTED AND HOW IS IT USED?

Which Personal Data We Collect

Personal Data is information that identifies you or can be used to identify or contact you (“Personal Data”). Such Personal Data may include your name, address, email address and telephone number.
We collect Personal Data from you when you use our Website or information is provided to us by schools. In all of these cases, we will only process Personal Data that is provided directly to us to enable us to provide the service requested. Unless defined in this Privacy Policy or unless you give us permission to do so, we will not use or share your Personal Data other than as specified in this Privacy Policy.

How We Collect and Use Your Personal Data

In the following section, you will find information on how we collect your Personal Data, for which purposes we process your data and on which legal basis we do so. To the extent the legal basis of our processing of your data are our legitimate interests, you can contact us at the contact details below if you require more details on our legitimate interests. If we use your consent as the legal basis of our processing of your Personal Data, you have the right to revoke your consent at any time with future effect as described in the following or by contacting us at the contact details below. This will not affect the processing of your Personal Data being undertaken until the revocation. The same applies if we refer to your consent or our legitimate interests in other parts of this Privacy Policy.

• If you have ordered a service directly from us
  If you place an order on our website you will be asked to provide your name, postal address, bill payer contact details, email address and your telephone number.
  We will use your name and email address to send you an order confirmation email and a shipping confirmation email. We will also use your payment details to process payment for your order and your mail address and other contact details to ship your order to you. Such processing of your Personal Data is necessary to process your order; the legal basis for such processing of your Personal Data is therefore Art. 6(1)(b) GDPR. Please note that you are contractually required to provide us with such Personal Data and that without such Personal Data we will not be able to send you order-related communications or to fulfil your order.
  We will also use your Personal Data to send you important service announcements and updates regarding our service and about your billing account status. Such service announcements and updates contain important information relevant to providing the service
  The processing of your Personal Data for such purposes is necessary for the performance of our services. The legal basis for such processing of your Personal Data is therefore Art. 6(1)(b) GDPR. Please note that you are contractually required to provide us with such Personal Data and that without such Personal Data we will not be able to send you service-related communication.
• If you have requested our service through a School
  If you have notified your school that you require our services as part of the contract the School Trunk .
  Such processing of your Personal Data is necessary for the performance of our services; the legal basis for such processing of your Personal Data is therefore Art. 6(1)(b) GDPR and in addition where Art. 8 (1) GDPR applies you will be authorised by the holder of parental responsibility over the child.
  Please note that you are contractually required to provide us with such Personal Data and that without such Personal Data we will not be able to send you customer service related communications.
• If you Subscribe to Newsletters and other Marketing Communications
  When subscribing to our newsletters or elsewhere on our Website you have the option to consent to receiving newsletters and other information on our products and services. If you “opt-in” we will send you promotional newsletters and inform you about offers, events and surveys via e-mail and through social media platforms. The legal basis for such processing of your data is your consent (Art. 6(1)(a) GDPR) or – if you are an existing customer or subscriber – our legitimate interest (Art. 6(1)(f) GDPR) in providing you with relevant marketing information. Please note that you are not legally required to provide us with your Personal Data. However, without your Personal Data we will not be able to send you our newsletters and other information as described above. You have the option to opt-out of these types of communication at any time by following the respective instructions in such communication.

COOKIES
We use cookies and similar technologies like pixels, tags, web beacons, and other identifiers to help us personalise our Website and Products & Services for you, remember your preferences, understand how users are using our Website and Products & Services and help customise our marketing communication.
A cookie is a small data file containing a string of characters that is sent to your computer when you visit a website. When you visit the website again, the cookie allows that site to recognise your browser. The length of time a cookie will stay on your computer or mobile device depends on whether it is a “persistent” or “session” cookie. Our Website uses both types of cookies. Session cookies will only stay on your device until you stop browsing. Persistent cookies stay on your computer or mobile device until they expire or are deleted.
We use the following types of cookies on our website:

• Session & Persistent cookies: We may use the session cookies to keep track of you whilst you navigate the website. We may use the persistent cookies to enable our website to recognise you when you visit. Session cookies will be deleted from your computer when you close your browser. Persistent cookies will remain stored on your computer until deleted, or until they reach a specified expiry date.
• Analytics cookies: We use analytics cookies to help us understand how users browse our Website and how they arrived at our Website. We use a variety of website analytics providers such as Google Analytics, Hot Jar, Optimizely and Exact Target. These cookies are subject to the respective privacy policies of the external service providers and to learn more about your options and how to opt-out of such analytics cookies visit the respective providers web site for details.

SOCIAL PLUG-INS AND OTHER THIRD-PARTY FEATURES

Our Website contains links to or features from other websites. This Privacy Policy covers the privacy practices of School Trunk Ltd only and does not cover the privacy practices of third-party websites or features. We are not responsible for the privacy policies and/or practices of third parties. When linking to another website or using a third-party service, you should read the privacy policy on that site or service.

To the extent certain third-party website features are available on our Website, the following terms apply:
We use plug-ins of the social networks Facebook, Pinterest, Twitter, Instagram and YouTube to enable our Website users to easily share content found on our Website and connect with their friends via such social networks. Whenever you view a page of our Website containing such plug-in, your browser establishes a direct connection to the servers operated by provider of the social network. As a result, the content of the social plug-in is transferred by the network provider directly to your browser and embedded in our Website being shown. If you visit our Website whilst signed into your social network user account, information concerning your visit will be transferred to the network provider and the provider of the social network can assign your visit to our Website to your account with the social network. Please note that a data transfer is triggered already when you visit our Website, irrespective whether you interact with the plug-in. To prevent this you must log out of your social network account before visiting our Website. Please refer to the privacy policies of Facebook, Pinterest, Twitter, Instagram and YouTube for more information on the purpose and scope of data collection and data analysis undertaken by the social network as well as your options to modify settings and how to protect your privacy.

HOW WE SHARE AND DISCLOSE PERSONAL DATA

We will not share, sell, transfer or otherwise disseminate your Personal Data to third parties, unless required by law according to Art. 6(1)(c) GDPR, unless required for the purpose of your contract according to Art. 6(1)(b) GDPR, unless the third party acts as a data processor on our behalf according to Art. 28 GDPR or you have given us express consent to do so according to Art. 6(1)(a) GDPR.
We also use third-party service providers to offer or facilitate services on our behalf and share your Personal Data with such providers to the extent necessary for such providers to perform their services on our behalf. In particular, we use a payment service providers to process your bills and a shipping company to fulfil orders for those that require it.
In order to grant sufficient protection of your Personal Data in this context, we use standard data protection clauses adopted by the European Commission according to Art. 46(2)(c) GDPR with such companies or certifications of such companies under the EU-U.S. Privacy Shield according to Art. 45(1) GDPR. You can request further details by contacting us at the contact details as mentioned below.
Any sharing of your Personal Data with other entities or service providers will be made in accordance with applicable data protection laws and will be limited to the extent necessary. We have carefully selected these companies and continuously monitor their compliance with our instructions. These companies are contractually prohibited from using your Personal Data for any other purposes than those described in this Privacy Policy. The legal basis for our sharing of your Personal Data with such companies is Art. 28(1) GDPR or alternatively our legitimate interests in commissioning those companies with the services described above (Art. 6(1)(f) GDPR).
We may also be required to disclose your Personal Data to government or law enforcement officials in response to a lawful request by a public authority or if we have to do so to comply with a legal obligation, including to meet national security or law enforcement requirements according to Art. 6(1)(c) GDPR. We can also disclose your information in order to pursue our legitimate interest in applying or enforcing our terms and conditions or in responding to any claims, in protecting our rights or the rights of a third party, in protecting the safety of any person or in preventing any illegal activity (including for the purposes of fraud protection and credit risk reduction) according to Art. 6(1)(f) GDPR.
If required under applicable data protection laws, we will collect your prior consent before sharing your Personal Data with other companies. In such cases, the legal basis is Art. 6(1)(a) GDPR.

IS MY PERSONAL DATA USED FOR ANY OTHER PURPOSES?

Except as otherwise described in this Privacy Policy, we will only use Personal Data for the purposes described above or as otherwise disclosed at the time we request such data from you. Should your Personal Data be processed for other purposes than those outlined in this Privacy Policy or other purposes than the ones your Personal Data has originally been collected for, we will provide you with information on that other purpose and any other relevant information as referred to in this Privacy Policy.

WHAT RIGHTS DO I HAVE?

You have the following rights:
• Right of access (Art. 15 GDPR):
You have the right to request confirmation as to whether we process your Personal Data and where that is the case, to request access to the Personal Data we hold about you.
• Right to rectification (Art. 16 GDPR):
You have the right to request the correction of inaccurate Personal Data.
• Right to erasure (Art. 17 GDPR):
You have the right to request erasure of Personal Data without undue delay under certain circumstances, e.g. if your Personal Data is no longer necessary for the purposes for which it was collected or if you withdraw consent on which our processing is based according to Art. 6(1)(a) GDPR and where there is no other legal ground for processing.
• Right to restriction of processing (Art. 18 GDPR):
You have the right to request us to restrict the processing of your Personal Data under certain circumstances, e.g. if you think that the Personal Data we process about you is incorrect or unlawful.
• Right to data portability (Art. 20 GDPR):
Under certain circumstances, you have the right to receive your Personal Data you have provided us with, in a structured, commonly used and machine-readable format and you have the right to transmit that information to another controller without hindrance or ask us to do so.
• Right to object (Art. 21 GDPR):
You have the right to object to the processing of your Personal Data under certain circum-stances, in particular if we process your Personal Data on the legal basis of legitimate interests (Art. 6(1)(f) GDPR) or if we use your Personal Data for marketing purposes.
You can assert your abovementioned rights by contacting us at the contact details mentioned below.

RIGHT TO LODGE A COMPLAINT BEFORE THE DATA PROTECTION AUTHORITY

You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement if you consider that our processing of your Personal Data infringes the applicable data protection laws. Please contact us at the contact details mentioned below and we will assist you to identify the respective competent supervisory authority.

DATA RETENTION

We store your Personal Data and other information for as long as necessary to enable you to use our Website and to provide our services to you or the school, to comply with applicable laws (including those regarding document retention), to resolve disputes with any parties and otherwise as necessary to allow us to conduct our business. If you have a question about a specific retention period for certain types of Personal Data we process about you, please contact us at the contact details mentioned below.

WHO DO I CONTACT IF I HAVE ANY PRIVACY QUESTIONS?

If you have any questions about our Privacy Policy or feel that we are not abiding by the terms of our posted Privacy Policy or the applicable data protection laws, please contact our data protection officer at [email protected]

CHANGES TO THIS PRIVACY POLICY
We may amend this Privacy Policy from time to time. We will post any changes to this Privacy Policy here. Please refer back to this Privacy Policy on a regular basis.