GDPR Policy
Cairnsly Ltd understand the importance of data protection and safeguarding. The policy below highlights actions we take to ensure that your data is safe.
GDPR Policy
GDPR – Your Rights under the General Data Protection Regulation
1. Context
The General Data Protection Regulation (Regulation (EU) 2016/679), known as the GDPR, is a new regulation which, from May 25th 2018, replaces the Data Protection Regulation (Directive 95/46/EC). This regulation, applying to all EU member states and their citizens, enhances privacy rights for individuals and provides a strict framework within which commercial organisations can legally operate.
The UK government has signalled its intention for the GDPR to remain part of UK law after the country leaves the EU in March 2019 and has accordingly introduced a Data Protection Bill to replace the current Data Protection Act. Your rights under the GDPR are set out below.
This policy sets out how Cairnsly Ltd Ltd (“Cairnsly ”, “we”, “us”, “our”), as “Data Controller” in respect of the personal data detailed below, obtain and use your personal data as well as your rights regarding our possession and processing of such data.
2. Who we are
Cairnsly Ltd is a tour operator specialising in immersive language courses and overseas work experience placements.
We collect the personal data of the following types of people to allow us to undertake our business.
Teachers organising school group bookings
Details of passengers on booked packages required to facilitate bookings
Employees at companies tendering and providing the services we require to fulfill the requirements of our packages: Eg Coach companies, language schools etc.
Employees, contractors and temporary workers at Cairnsly
Employees at companies who provide services directly to Cairnsly
3. When and how we obtain your Personal Data
We will collect information from you
when you request Cairnsly quote your school/association for a package
in order to fulfill the contractual obligation of your confirmed (by means of a signed contract) booking
when you tender to provide a service to Cairnsly , including
Hotel accommodation
Coach bookings
Ferry bookings
Event / attraction bookings
when you request Cairnsly to arrange a work experience or language course placement
when you sign up for our mailing list either through one of our websites or at a convention or exhibition
when you fill in an enquiry form on any of Cairnsly ’s website
when you download any Cairnsly resource file
when you apply to work at Cairnsly , or as part of your contract of employment at Cairnsly
we will collect information about you from a third party – e.g. References and DBS
when required to do so to fulfill our contractual obligations relating to a booked tour or visit, i.e. when you are on the passenger/guest list of a confirmed tour or placement
when you are providing a service as part of a tour or visit booked through Cairnsly , e.g. as a Coach driver
4. How we process your Personal Data
School or group tour enquiry and quoting
At the enquiry/quoting stage we will collect and process the following personal data
Your name
Your address
Your email address and telephone number
We may use your data to
create a quotation tailored to your group’s exact requirement
personalise the quotations we build and ensure these quotations reach you
communicate with you up to the point of confirming your booking
Once you confirm your booking or notify us you are not proceeding we will cease processing your data for this purpose.
Arranging/supporting your confirmed booking of a school or group tour
Once you have confirmed your booking with us by means of signing our booking form, or electronically consenting to the same effect, we will collect and process the following personal information in order to fulfil our contractual obligations to you regarding your tour/visit
Your name
Your address
Your email address and telephone number
Full passenger list of all travelling on the tour/visit, including
Names as per passport
Passport number and date of expiry
Date of birth
Gender
Nationality
Emergency contact details
GP contact details
*Medical information including details of allergies and conditions requiring specific assistance or consideration where necessary to fulfil tour/visit
*Specific dietary requirements of passengers
To fulfil our contractual obligations in providing your tailored tour/visit we may use this data
to issue an invoice, an ATOL Certificate and insurance for your group
to book flights/ferry or Eurotunnel crossings
to book visits/attractions specific to your tour. (Certain visits/attractions require the full passport information of your group for reasons of security)
to ensure hotels, coach companies, airlines are aware of the medical needs of passengers on the tour so they can provide any specific assistance required
to send details of dietary restrictions and requirements to hotels, restaurants, airlines, etc. to ensure
appropriate and suitable meals are provided for your group
to contact you upon your return to seek feedback following your tour
to ask if you would like to submit some photographs of your group whilst on tour to our “Photo competition”
Following the completion of your tour, and allowing such time to complete the feedback and Photo Competition processes mentioned above and collect any remaining monies owed, we will cease processing your data for this purpose.
Cairnsly Ltd will continue to store your personal data after the end of a tour so as to comply with our legal obligations concerning your tour, and to establish, exercise or defend legal claims as required.
* denotes special category data
Arranging/supporting your work experience abroad or language school course
To arrange your work experience abroad or language school course we will collect and process the following personal data
Your name
Your address
Your email address and telephone number
Full passenger list of all travelling on the tour/visit, including
Names as per passport
Passport number and date of expiry
Image of passport photo page
Copy of signature (digitally created on booking)
Date of birth
Gender
Nationality
Medical information* including details of allergies and conditions requiring specific assistance or consideration where necessary to fulfil tour/visit
Specific dietary requirements of passengers*
Emergency contact details (e.g. telephone numbers)
Details of students’ GP
Payment details from students (or parents/carer of students) travelling, e.g. credit card details
ID Photos of students travelling
Emergency contact numbers for group leaders of students travelling
Language levels / abilities of students
Details of courses studied
Intended career
Hobbies and interests
Experience
We may use your data
to create a quotation tailored to your or your group’s exact requirement
to communicate with you regarding the booking process
to issue travel and medical insurance for you or your group
to book flights/ferry or Eurotunnel crossings
to ensure language schools, host families, restaurants and hotels are aware of the needs of your group.
This may include our transferring medical information, including dietary and allergy information, so that they can provide appropriate and necessary accommodation, access to facilities, and to ensure appropriate and suitable meals are provided for you and your groupto ensure coach companies, airlines, ferry operators are aware of the medical needs of passengers so they can provide any specific assistance required, including the provision of appropriate and suitable meals for you or your group
to contact parents or next-of-kin in case of emergency
to contact students’ GPs in case of emergency
to provide easy identification of students traveling (passport photo)
as proof of payment for our records (payment details)
to place students on the appropriate level of language course
to allow us to contact you upon your return to seek feedback following your tour
Following the completion of your tour, and allowing such time to complete the feedback and Photo Competition processes mentioned above, and collect any remaining monies owed, we will cease processing your data for this purpose.
Cairnsly will continue to store your personal data after the end of a tour so as to comply with our legal obligations concerning your tour, and to establish, exercise or defend legal claims as required.
* denotes special category data
Marketing purposes
If you have subscribed to our email newsletter, made a booking with us, or requested a quote, brochure or other information from us, we may send you direct marketing that we think may be of interest to you, based on your subject interest or school location.
For marketing purposes we will collect and process the following personal data
Your name
Your email address
We use this data to contact you with, or make available to you, information relating to our services, brochures, new products, forthcoming events and special promotions. We will endeavour to tailor the information you receive or see so it is as relevant to your needs as we are able to make it.
You have the right at any time to request we desist from such processing of your data. The mechanism for doing so is detailed below in Section 12 of this policy. Every marketing communication (email and postal) you receive will include details of how to exercise these rights.
Tendering for, or supplying services for, our tours/visits
When you tender to or supply a service to Cairnsly , depending on the type of service you are providing, we will collect and process the following personal data
Coach Travel
Name, address, email address, and telephone number of company owner
Name, email address, and telephone number of the transport manager
Names as listed on the operator’s licence
Names as listed on the insurance documents
Names and telephone numbers of all drivers on the tour
Hotels/Agents
Name, telephone number, email address and signature of the hotel manager or person in charge of groups
Names and signatures of persons responsible for public liability and insurance at the hotel
Names and signatures of persons responsible for Health and Safety and the completion of the hotel audits
Name, email address, telephone and mobile numbers of the director of the agency
Visits/Attractions/Reps
Name, email address and mobile phone number of reps or tour guides
Bank details, address and contact details for any personal guides
We may use your data
to contact you regarding the tender process, to send confirmation of bookings, and to send necessary tour documentation
to contact you, including out of hours, should our groups require assistance in an emergency
to enable us to meet the necessary requirements for the School Travel Forum (including obtaining operators’ licences from coach operators, Standard Audit forms and necessary insurance documentation
to contact the drivers of vehicles providing transport during the tour to issue payment for services provided
Following the completion of the tour, and allow for a suitable period of time to ensure all payments are made and issues relating to any issues on the tours are resolved, we will cease processing your data for this purpose.
We will thereafter maintain your details on our system so as to comply with our legal obligations concerning any tours your supplied a service to, and to establish, exercise or defend legal claims as required, and so we are able contact you in future to request your tendering services to future tours.
You have the right at any time to request we desist from such processing of your data. The mechanism for doing so is detailed below in Section 12 of this policy.
Supplying a service to Cairnsly
When you supply a service directly to Cairnsly , whether on behalf of another company or personally, we may collect the following personal data
Your name
Contact details (may include your home address, email address and telephone number)
Bank details if we make payment directly to you
We may use your data
to contact you in order to make appointments for you to visit our premises
to issue payment for services supplied to Cairnsly
to follow up on incidents relating to services provided by you to us
Following your successful provision of the services for which you were contracted, we will cease processing your data for this purpose.
We will thereafter maintain your details on our system so as to comply with our legal obligations concerning the services you supplied, and to establish, exercise or defend legal claims as required, and so we are able to contact you in future to request future services from you.
You have the right at any time to request we desist from such processing of your data. The mechanism for doing so is detailed below in Section 12 of this policy.
Internal Practices – Staff
Recruitment Stage (incl. Interview)
When you apply for a position at Cairnsly or you are forwarded as a candidate by a recruitment agency we will collect the following personal data
Your name
Your address
Your email address and telephone number
Your CV detailing employment history
Details of medical conditions* which may require specific assistance or consideration when attending an interview
We may use your data
to contact you regarding your application, including to arrange an interview
to enable us to evaluate whether your skillset and experience match our requirements regarding the position you are applying for
to ensure all specific assistance and consideration you may require in order to attend an interview at our offices can be provided
to provide feedback to recruitment agencies and government bodies regarding your attendance of an interview, as required
to contact the references you provide ahead of making job offers to prospective employees
Following the application stage, whether you were successful or unsuccessful, Cairnsly will cease processing your data for this purpose. We will however be required to hold data to comply with our legal obligations concerning the application process, e.g. confirming your attendance of interviews.
* Denotes special category data
Employment Stage
As part of your employment at Cairnsly we will collect and process the following additional items of personal data
Your signature
Your National Insurance number
Bank account information
Details of your next of kin, including name and contact details
Details of prescription should you claim a refund for an eye test
Your pension number
Details of your student loan, where applicable
Details of your childcare provider, where applicable
Details relating to bonus payments and performance reviews
Details relating to any disciplinary or grievance issues
Details of annual leave requests, sickness or other absences
Training records
Accidents or incidents occurring at Cairnsly or on Cairnsly business
References given by third parties
Details of medical conditions which may require specific assistance or consideration in the workplace *
We may use your data
to generate your contract of employment and other relevant legal documents regarding your employment at Cairnsly
to enable us to instruct our payroll team to set you up as an employee
to allow us to pay you a salary and to make payments for any bonuses earned
to contact your next of kin in case of emergency
to refund you for the cost of an eye test/glasses
to liaise with your pension provider and to allow us to make contributions into your pension
to make requested deductions for your student loan
to make payments to your childcare provider
to monitor and record your performance throughout your employment at Cairnsly
to record details of any grievances raised and the records of outcomes
to know when staff are on annual leave and to identify patterns of illness
to record training you undertake to comply with the requirements of the School Travel Forum
to comply with the H&SE requirements. Details of any work place accidents must be stored for a minimum of 3 years after the accident takes place
Cairnsly will cease processing your data for purposes relating to your employment once all contractual matters relating to your employment are concluded, including but not limited to final payments for your period of employment. However Cairnsly may continue to process your data as and when we obliged to do so in order to comply with our legal obligations, or as requested by you, for instance to provide details of your period of employment to a third party.
5. Special Category Data
Cairnsly will store and process special category data, including details of medical conditions, special dietary requirements, religious beliefs, and racial and ethnic origin, only when it is required that we do so, for example to fulfil our contractual obligations arranging and supporting your tour, or to provide such assistance or consideration as is required for you to visit our offices or facilitate your employment at Cairnsly . We will only do so when we have your explicit consent by means including
Your signing a contact of employment with Cairnsly
Our receiving a signed booking form confirming a tour with us
Once the reason for our processing this data is completed we will cease processing this data.
6. Storage and Security of Personal Data
Data we collect from you will be stored on Cairnsly ’s secure servers located in the United Kingdom or secure cloud-based servers located within the European Union at GDPR compliant cloud-storage providers. These include the following but does not preclude the use of other facilities that meet the aforementioned criteria: Ionos web services, Google, Microsoft O365, Microsoft Azure, Dot Digital.
We will store and process your Personal Data only for as long as it is reasonably necessary for us to perform the services/activities we are undertaking on your behalf or that fall within our legitimate interest, as well as to comply with our legal obligations. You may at any time request that we cease processing your data or remove it from our systems. Details for how to make such request can be found in Section 12 in this document.
As the transmission of information via the internet is not completely secure we cannot guarantee the security of your Personal Data in the course of being transferred to us; any transmission is at your own risk. Once we have received your Personal Data, we will use strict procedures and security features to try to prevent unauthorised access. Should such a breach occur we will, in compliance with articles 33 and 34 of the GDPR notify the supervisory authority and all affected individuals upon our discovering the breach.
7. Legal Basis for holding and processing your Personal Data
Cairnsly will rely on the following legal bases for holding and processing your personal data
A. Necessary for the fulfilment a contract, i.e. booking a tour or visit
We have a legitimate interest to store and process your data in order to ensure the smooth organisation of your tour. We are unable to make the necessary arrangements for any tour without processing the data outlined in this policy.
B. Necessary for compliance with a legal obligation
We will hold information on you when we are required to do so to comply with Cairnsly ’s legal obligations. For example we hold details of passengers on tours and visits we organise against potential future legal actions resulting from these
C. Legitimate Interest.
We will hold and process your information for purposes relating to our legitimate interests. This includes the marketing of our services to you.
D. Consent
We will store and process your personal data when we have your explicit consent to do so. This includes your signing up to Cairnsly ’s mailing lists online or at an exhibition, etc.
8. With whom we share your data
No personal data will be shared with any third party prior, excepting our use of a GDPR compliant mailing company for the purpose of marketing (when the data used is restricted to your name and email address necessary to send marketing emails), to your confirming a booking with Cairnsly by means of signing our booking form.
When you confirm a booking with Cairnsly it will become necessary for us to share information with certain third parties so that we may fulfil the terms of the contract we have entered into with you. These third parties may include
Airlines
Coach companies
Ferry operators
Eurotunnel
Hotels
Visits and attractions
Insurance companies
Ground handling agents
Some of these parties may be based outside of the European Economic Area (EEA) or the list of countries considered by the European Union to provide an adequate level of data protection in accordance with Article 45 of the GDPR (details of this list can be found on the European Union website here https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en). Organisations that are based outside of the EEA may not be subject to the same level of controls in regard to data protection as exist within the UK and the EEA.
In order for you to travel overseas, we may be required to disclose some of your personal data to Government bodies or other authorities in the UK and in other countries, such as those responsible for immigration, border control, security and anti-terrorism. Even if it is not mandatory for us to provide information to such authorities, we may exercise our discretion to assist them where appropriate.
9. Your rights
A. Right of Access
Under Article 15 you have the right to access the personal data we hold about you and confirmation of how it is being processed by us
B. Right to Rectification
Under Article 16 you have the right to request that incomplete or inaccurate personal data information we hold about you is corrected.
C. Right to Erasure
Under Article 17 you have the right to have the personal data we hold about you deleted if
The personal data is no longer necessary for the purpose it was originally collected or processed for
Cairnsly has no legitimate interest to continue to hold and process your data
When you have exercised your right to object to processing (see below)
Cairnsly has processed your data unlawfully
Cairnsly may refuse such a request if the storing of your data is required for
complying with a legal obligation
establishing, exercising or defending future legal claims
The right to erasure will not apply to special category data if
Its processing is necessary for public health purposes, e.g. for protecting against serious cross-border threats to health
D. Right to Restriction of Processing
Under Article 18 you have the right to restrict to our processing of your data if
You contest the accuracy of your personal data and/or you are verifying the accuracy of your data
You believe your data has been unlawfully processed by us
The personal data is no longer necessary for the purpose it was originally collected or processed for but you require us to hold your data for the establishment, exercise of defence of legal claims
You have lodged a request under Article 21, the Right to Object (see below), and this request is being processed
E. Right to Data Portability
Under Article 20 you have the right to request Cairnsly to transfer such personal data we hold about you in a structured, commonly used, and machine readable format to you or another party as you request, should it be practical to do so.
F.Right to Object
Under Article 21 you have the right to object to our processing your personal data, as detailed above in section 4. This includes the right to object to our processing your data for direct marketing purposes Cairnsly can refuse such a request if
We can demonstrate legitimate grounds for continuing to process personal data which overrides the interests, rights and freedoms of the individual
We require the processing of personal data to establish, exercise or defend legal claims
10. How to exercise your rights
The above rights can be exercised by contacting Cairnsly ;
By email:
gdpr@cairnsly.com
By post:
Cairnsly Ltd Ltd. 107 Westbourne Terrace, London.
Cairnsly will act upon all requests under GDPR without undue delay and will respond within one calendar month of receiving the request. In cases where the request is complex or when you have submitted multiple requests to us, we may extend this time by an additional two months. We would notify you in this eventuality within one calendar month of receiving the request.
If we have doubt over the identity of the individual making the request we will ask for additional information before proceeding. We will notify you within one month of receiving your request should we require more information. Failure to provide this information would result in your request being denied.
All requests will be made free of charge although if any request is deemed to be manifestly unfounded or excessive, Cairnsly reserve the right to impose an administration fee of £30 to comply with the request.
Cairnsly reserves the right to refuse to comply with a request if
it is deemed to be manifestly unfounded or excessive
we are unable to confirm the identity of the requestor
we request an administration fee which is not paid
doing so would prevent us
complying with a legal obligation
establishing, exercising or defending future legal claims
The exercising of any of these rights under GDPR will not prejudice you in anyway regarding any other rights you have or the future levels of service you would expect to receive from us in the event of future enquiries or bookings.
11. Making a complaint
Should you be unhappy with our response to your request, including cases when we refuse to comply with the request, you have the right to lodge a complaint with the supervisory body tasked with overseeing the GDPR. The supervisory body for the U.K. is the Information Commissioner’s Office. The ICO can be contacted at: https://ico.org.uk/concerns/