Safety & Support

Purpose of this Agreement

This Data Sharing Agreement (“DSA”) sets out the basis on which personal data relating to pupils and accompanying adults is shared between the School and TCBC School Tours (TCBC) for the purpose of planning, managing and delivering a school trip safely and effectively.

We are a tour operator based in the UK and specialise in providing school group tours. We are registered with the ICO and comply with the UK General Data Protection Regulation (GDPR).

This agreement is intended to ensure that personal data is shared lawfully, fairly, securely and transparently in accordance with the UK GDPR and the Data Protection Act 2018.

Roles of the Parties

For the purposes of data protection law:

• The School is an independent Data Controller
• TCBC is an independent Data Controller

Personal data is shared controller-to-controller. Each party is responsible for complying with its own obligations under UK data protection law.

TCBC does not act as a data processor on behalf of the School and processes personal data solely as an independent data controller.

Categories of Personal Data Shared

The School will share the following personal data with TCBC for the trip:

Standard personal data

• Full name
• Date of birth
• Nationality
• Passport details (number, issue and expiry dates)
• Gender

Special category data (where applicable)

• Medical conditions
• Dietary requirements
• Accessibility or mobility needs

Only data that is necessary for the safe and effective delivery of the trip will be requested and processed.

The School is responsible for ensuring that the personal data it shares with TCBC is accurate and kept up to date. TCBC will rely on the information provided by the School for the purposes of delivering the trip.

Purpose of Processing

TCBC will process the shared personal data solely for the purposes of:

• Organising and delivering the school trip
• Meeting health, safety and safeguarding obligations
• Making travel, accommodation and activity arrangements
• Responding to medical or safeguarding incidents
• Complying with legal and regulatory requirements, and for our own legitimate interests

Personal data will be processed solely for the purposes set out in this agreement and will not be used for marketing or any other incompatible purpose.

Lawful Basis for Processing

Each party is responsible for determining and documenting its own lawful basis for processing personal data under UK GDPR.

TCBC processes personal data where this is necessary to perform its contract with the School, to pursue legitimate interests in delivering school trips safely and effectively, and to protect the vital interests of individuals in emergency situations.

Where we need to process special category data (such as medical, dietary or accessibility needs), we only do so where this is genuinely necessary and where an appropriate legal condition applies. This includes using the information to protect individuals’ health or safety (especially in emergencies), to meet safeguarding requirements, or where explicit consent has been provided for a specific purpose. We apply additional safeguards to keep this information secure at all times.

Consent is not relied upon by TCBC as the primary lawful basis for processing personal data required to deliver school trips safely and effectively.

Data Sharing with Third Parties

TCBC may share relevant personal data with trusted third-party suppliers where necessary to deliver the trip, including:

• Transport providers (airlines, ferries, rail operators)
• Accommodation providers
• Catering providers
• Venues, museums and activity providers

Data will be shared:

• Securely
• On a data-minimisation basis
• Only for the duration and purpose required

Suppliers are only permitted to use personal data to deliver the trip arrangements (and to meet their own legal obligations directly connected to those arrangements) and must not use the data for any other purpose.

Further information about suppliers involved in a specific tour can be provided on request. Some suppliers may be located outside the UK. In such cases, TCBC ensures that appropriate safeguards are in place in accordance with UK GDPR requirements and that only the minimum data required is shared securely.

Data Security

TCBC will implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. Access to personal data is restricted to staff and suppliers who require it for the purposes set out in this agreement.

Personal Data Breaches

If either party becomes aware of a personal data breach involving shared data, they will inform the other without undue delay and cooperate reasonably in investigating and responding where this may affect the other party’s data protection obligations.

Data Retention

TCBC will retain personal data for a period of 7 years following the completion of the trip, after which it will be securely deleted or anonymised. Data may be retained for longer where required in connection with an incident, safeguarding concern, complaint, insurance matter or legal claim.

Individual Data Protection Rights

Individuals (or their parents/guardians) have certain rights in relation to personal data that we hold under UK data protection law. These include the right to:

• access their personal data
• request correction of inaccurate or incomplete data
• request restriction or erasure of personal data where applicable
• object to certain types of processing
• request data portability where applicable
• raise concerns with the Information Commissioner’s Office (ICO), the UK data protection regulator

Some of these rights apply only in certain circumstances. Where we process personal data because it is necessary to perform a contract, comply with legal obligations, or protect individuals’ vital interests, we may not be able to erase or stop processing that data. Exercising these rights will not affect the lawfulness of any processing already carried out.

This is particularly relevant where personal data is required to deliver a booked school trip safely and lawfully.

Requests relating to TCBC’s processing should be directed to info@tcbcschooltours.co.uk

Transparency

The School is responsible for informing parents and pupils about the sharing of personal data with TCBC.

TCBC’s Privacy Policy is available at https://tcbcschooltours.co.uk/privacy-and-cookies

Review

This agreement will be reviewed periodically and updated where necessary to reflect changes in data protection law or guidance.