1. Company Details

Company Name: Cross-Curricular Orienteering Ltd
Company Address: The Croft, Cow Brow, Lupton, LA6 1PJ
Contact Information: Email: contact@crosscurricularorienteering.co.uk | Phone: 01524 907000
Data Protection Officer (DPO): William Huntington | Email: dpo@crosscurricularorienteering.co.uk

2. Types of Personal Data Collected

Personal Data: We collect the following personal data:

• Name
• Job role
• Address
• Email address
• Phone number
• IP address
• Place of work

Job Application Data: If you apply for a job with us, we may also collect the following data:

• CV or résumé
• Cover letter
• Employment history
• Education history
• Professional qualifications
• References
• Any other information you provide during the application process

Sensitive Data:
We do not collect sensitive personal data, such as health information or data revealing racial or ethnic origin, unless it is required for specific roles and you voluntarily provide it (e.g., to request reasonable adjustments during the recruitment process).

3. Purpose of Data Collection

Purpose:

• Service Provision: To provide our services, such as educational resources and orienteering activities.
• Marketing: To send you information about our services, promotions, and updates that may be of interest to you.
• Website Improvement: To improve our website’s functionality, user experience, and content.
• Recruitment and Employment: To assess your suitability for a position you have applied for, conduct background checks, communicate with you throughout the recruitment process, and, if successful, manage your employment with us.

Legal Basis:
Under GDPR, we must have a lawful basis for processing your personal data. Depending on the context, the following bases may apply:

• Contractual Necessity: Processing your data is necessary for the performance of a contract (e.g., providing services you’ve requested).
• Legitimate Interests: Processing is necessary for our legitimate interests, such as improving our services, recruiting suitable candidates, and marketing to existing customers, provided these interests are not overridden by your rights.
• Consent: In some cases, we may ask for your consent to process your data (e.g., for marketing emails or to keep your job application on file for future opportunities).
• Legal Obligation: Processing is necessary to comply with legal obligations, particularly in the context of employment and recruitment laws.

4. How Data is Collected

Methods: We collect personal data through:

• Website Forms: Information you provide through forms on our website.
• Cookies: Data collected through cookies and similar technologies when you browse our website.
• Third-Party Services: Data provided by third-party services that assist us in delivering our services.
• Job Applications: Data you provide during the job application process, whether through our website, email, or third-party recruitment platforms.

Direct and Indirect Collection: We collect data directly from individuals as well as indirectly from third parties that you interact with.

5. Data Sharing

Third Parties:

• We generally do not share your personal data with third parties, except where necessary to provide our services or where required by law.
• However, we may share data with partner companies for the purpose of improving our services or during the recruitment process if third-party background check providers are used.

International Transfers:

• We do not currently transfer personal data outside the UK or the European Economic Area (EEA). If this changes, we will ensure appropriate safeguards are in place, such as Standard Contractual Clauses or other legally accepted mechanisms.

6. Data Retention

Retention Periods:

• We retain personal data only as long as necessary to fulfill the purposes for which it was collected, including any legal or reporting requirements. Typically, this is for the duration of our business relationship and for a period of up to 7 years thereafter to comply with legal obligations.
• Job Application Data: Personal data from unsuccessful job applicants is retained for a period of 2 years after the recruitment process ends. This allows us to consider you for future opportunities or to comply with legal obligations. If your application is successful, the data collected during the recruitment process will be transferred to your employment record and retained according to our employee data retention policy.

Deletion or Anonymization:

• Once personal data is no longer required, we will either delete it or anonymize it so that it can no longer be associated with you. Regular reviews are conducted to ensure data is not kept longer than necessary.
• Personal data from unsuccessful job applicants will be securely deleted after the 2-year retention period, unless you have provided consent for us to keep your details on file for future opportunities.

7. Data Subject Rights

Individual Rights:
Under GDPR, you have the following rights regarding your personal data:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can ask us to correct any inaccuracies in your personal data.
• Right to Erasure: You can request that we delete your personal data.
• Right to Restrict Processing: You can ask us to limit how we process your data.
• Right to Data Portability: You can request that your data be transferred to another organization.
• Right to Object: You can object to our processing of your data based on legitimate interests or for direct marketing.

To exercise any of these rights, please contact our DPO at dpo@crosscurricularorienteering.co.uk.

Complaints:
If you believe we have not complied with GDPR, you have the right to file a complaint with the Information Commissioner’s Office (ICO). More information can be found on their website: ICO Website.

8. Security Measures

Security Practices:

• We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk of processing personal data. These measures include encryption, access controls, and security assessments.
• For job application data, we implement strict access controls, ensuring only those involved in the recruitment process have access to your information. Data is stored securely, and we use encryption where appropriate.

9. Cookies and Tracking

Cookie Policy:

• Our website uses cookies to enhance user experience, analyze site traffic, and serve targeted advertisements. You can manage your cookie preferences through your browser settings.

Consent Mechanism:

• By using our website, you consent to our use of cookies. You can withdraw your consent at any time by changing your browser settings to refuse cookies, but this may impact your ability to use certain features of our website.

10. Updates to the Privacy Policy

Policy Changes:

• We may update this privacy policy from time to time. Any changes will be posted on this page, and we encourage you to review it periodically to stay informed about how we are protecting your data.
• Job Applicant Notifications: If you are a job applicant, we may update this privacy policy to reflect changes in how we handle recruitment data. You will be notified of any significant changes during the application process.

11. Contact Information

Privacy-Related Inquiries:

• For any questions or concerns regarding your privacy, please contact our DPO, William Huntington, at dpo@crosscurricularorienteering.co.uk.

Children’s Privacy:

• We do not collect or process personal data from children. Our services are intended for adults, primarily school staff, and we do not collect data on children.

Last Updated: 25/08/2024