Who We Are
Orbis Education and Care Limited, Pembrokeshire Resource Centre Limited and Gower Lodge (Swansea) Limited, all three registered at Vision Court, Caxton Place, Cardiff CF23 8HA (together, the "Orbis Group") provide specialist day schools and residential services for children, and community homes for adults who have complex needs associated with autism.
In order to provide our services, the Orbis Group (we or us) gather and process personal information about a variety of individuals. This privacy notice tells you about your rights in relation to information we collect about you and explains how, why and when we use your personal information.
Information That We Collect
The personal information that we collect about you depends on the type of individual you are and how you interact with us.
For residents and pupils, we will generally need to collect quite detailed information about you. This will include basic information such as your name, date of birth and contact details (including home address, email and telephone number), as well as information about your education, including your safeguarding and special educational needs and any health conditions you may have, including any medication you are taking. We will also collect basic information about your family and your next of kin.
Some of the information we collect will come directly from you. However, we may also collect information with other sources, including statutory bodies such as local authorities and regulators, including CIW, SCW, Estyn and Ofsted. We will also share information with these bodies.
If you work for us or apply for a job, we will collect information about you. We have separate privacy notices for job applications and for our staff.
How We Use Your Personal Data
We take your privacy very seriously. We will only use your information for the purposes specified in this privacy notice, unless we are required by law to do so. We will not collect any unnecessary personal data from you and will only keep your information for as long as is necessary and for these purposes.
The purposes for using your personal information are to enable us to provide our services and to meet our legal, statutory and contractual obligations.
Data protection law requires us to ensure that we always have a valid legal basis for processing personal information. We will process personal information on the following grounds:
- If you have a contract with us, where the processing is necessary for the performance of that contract.
- Where the processing is necessary for us to comply with our legal obligations. For instance, we are required by our regulators to retain certain records for residents and pupils.
- With your consent. For instance, if you have agreed to receive marketing from us.
- Where the processing is necessary for our own legitimate interests. For instance, where we need to collect and use personal information in order to run our business efficiently.
Where you have consented to us providing you with promotional offers and marketing, you are free to withdraw this consent at any time.
There are additional rules for processing of 'special categories' of personal information, which includes information about health and medical conditions. We will only process this type of information where it is necessary to provide you with care or in order to comply with our legal and regulatory obligations.
You have the right to request access any personal information that we process about you and to request information about:
- The purposes of the processing.
- The categories of personal information concerned.
- The recipients to whom the personal information has or will be disclosed.
- How long we intend to store your personal information for.
- If we did not collect the information directly from you, information about the source.
If you believe that we hold any incomplete or inaccurate information about you, you have the right to ask us to correct and/or complete the information and we will strive to do so as quickly as possible unless there is a valid reason for not doing so, at which point you will be notified.
You also have the right to request erasure of your personal information or to restrict processing in accordance with the data protection laws, as well as to object to any direct marketing from us. Where applicable, you have the right to data portability of your information and the right to be informed about any automated decision-making we may use. Some of these rights are limited and we cannot always comply with your request. We will tell you if that is the case.
If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the request. This is to ensure that your data is protected and kept secure.
Sharing & Disclosing Your Personal Information
We generally do not share or disclose any of your personal information other than for the purposes specified in this notice or where there is a legal requirement for us to do so. Your information will be shared between the companies within the Orbis Group.
We use third parties to provide us with certain IT services and business functions. All processors acting on our behalf only process your information in accordance with instructions from us and comply fully with this privacy notice, data protection laws and any other appropriate confidentiality and security measures.
Transfers outside the EU
Personal information in the European Union is protected by the General Data Protection Regulation but some other countries may not necessarily have the same high standard of protection for your personal information. We do not routinely transfer or store any personal data outside the EU. If we are required to transfer or store your personal data outside the EU, appropriate safeguards will be used to protect your data.
Consequences of Not Providing Your Data
You are not obliged to provide your personal information to us. However, we may not be able to provide all of our services without it. We will tell you if this is the case.
How Long We Keep Your Data
We only ever retain personal information for as long as is necessary and we have strict review and retention policies in place to meet these obligations. Where your information includes information about payments, we are required under UK tax law to keep your basic personal data (name, address, contact details) for a minimum of 6 years after which time it will be destroyed.
We keep certain educational and care records for as long as is required to meet our legal obligations, after which time they will be destroyed.
Where you have consented to us using your details for direct marketing, we will keep such data until you notify us otherwise and/or withdraw your consent.
For more information about our data retention policies, please contact our Data Protection Officer.
How to Contact Us
If you have any questions about this notice or wish to exercise any of your individual rights, then please contact us.
Our Data Protection Officer can be contacted at:
Data Protection Officer
Orbis Education & Care Ltd
Vision Court, Caxton Place
You also have the right to complain to the Information Commissioner's Office:
Information Commissioner's Office (Wales)
2nd Floor, Churchill House
0330 414 6421