Holiday Activities and Food programme Privacy Notice
This privacy notice is designed to help you understand how we use personal information when delivering our Holiday Activities and Food (HAF) Programme. It explains the services covered, the information we use to provide those services, who we may share it with, and how long we will keep it.
The HAF Programme supports children and young people during school holiday periods by providing access to free activities, healthy meals, and targeted support for those who are eligible for Free School Meals (FSM), have special educational needs or disabilities (SEND), or are receiving support from Early Help or Children’s Social Care. The programme is funded by the Department for Education and delivered by Cheshire West and Chester Council in partnership with local providers.
To manage the programme safely and effectively, we collect information from families, schools, activity providers, and social care services. This includes operating a secure booking system and, where required, carrying out checks to confirm whether a child is open to Early Help or Children’s Social Care services. These checks are carried out using a secure internal reporting tool built in Microsoft Power BI, which helps us confirm eligibility for discretionary HAF places and ensure appropriate support is provided
What information we collect, use, and why
Whenever you get in touch with us or access the Holiday Activities and Food (HAF) Programme, we collect certain information to make sure we can provide the right support to you and your child. This helps us identify you, understand your circumstances, confirm eligibility, and deliver the programme safely and effectively. We categorise the information we collect into personal data and special category data.
Personal Data
We collect the following personal data so we can deliver the HAF Programme:
To identify you and communicate with you about bookings, attendance, and programme updates.
To verify your child’s identity, confirm eligibility, and match records accurately.
To uniquely identify your child and ensure information matches our education and social care systems.
To understand where support is being accessed and allocate places fairly across the borough.
To allocate places, manage sessions, monitor participation, and meet reporting requirements.
Used internally to match information when checking whether a child is open to Early Help or Children’s Social Care.
Used to evidence activities, capture feedback, or support optional promotional materials.
Special Category Data
We collect the following special category data to ensure we provide appropriate and safe support:
To make sure providers understand your child’s needs and can deliver safe, suitable activities.
To ensure meals and activities are appropriate and safe.
Criminal Data
We do not routinely collect criminal offence data for the HAF Programme.
Data collected through eligibility checks
Where a child may qualify for a discretionary HAF place because they are open to Early Help or Children’s Social Care, authorised staff use a secure internal report built in Microsoft Power BI. This report links directly to our case management systems and allows us to confirm whether a child is currently receiving support. Only the minimum amount of information needed is viewed for this purpose.
We do not extract or store new datasets as part of this reporting activity.
Sources of Information
We primarily collect information directly from you when you make a booking, contact the HAF team, or provide details needed to support your child during holiday activities. However, to ensure we have accurate and up‑to‑date information and to confirm eligibility for certain types of support, we may also receive information from:
To confirm a child’s school, eligibility for Free School Meals, attendance patterns, or educational needs such as SEND status.
To provide us with booking information, attendance records, and any relevant details needed to deliver activities safely.
To confirm whether a child is open to support services, where this is relevant to determining eligibility for a discretionary HAF place.
Used to confirm whether a child is open to Early Help or Children’s Social Care. These checks are completed through a secure internal Power BI report, which only shows the minimum information needed to confirm eligibility.
Where someone acting on your behalf, such as a support worker or professional, provides information needed to help us deliver the programme.
We only collect information from these sources where it is relevant, necessary, and lawful to provide the HAF Programme safely and effectively.
What is your personal information used for?
We use your information to make sure you and your child receive safe, appropriate and effective support through the Holiday Activities and Food (HAF) Programme. This includes:
To confirm eligibility for Free School Meals and to identify children who may need a discretionary place due to SEND, vulnerability, or involvement with Early Help or Children’s Social Care.
To understand any health, dietary or support needs your child has so that providers can plan suitable activities and ensure their safety.
To work with education providers, activity providers, and other council services to ensure children receive the right level of support.
To confirm whether a child is open to Early Help or Children’s Social Care, we use a secure internal Power BI report that links directly to the Council’s case management systems. This helps us identify children who may require additional support during the holiday period.
To record attendance at activities, manage bookings, and ensure that the programme is being delivered effectively.
To understand demand, plan delivery, and make improvements. Where possible, information used for reporting and analysis is anonymised or aggregated.
To provide required monitoring information to the Department for Education about programme participation and outcomes. Only the minimum information needed is shared, and this is usually anonymised.
To deal with any questions you may raise about the programme or the support your child receives.
Who do we share your information with?
We only share your information when it is necessary, lawful, and relevant to deliver the Holiday Activities and Food (HAF) Programme safely and effectively. This includes sharing information with:
To make sure your child can participate safely, providers receive only the information they need, such as dietary requirements, SEND needs, health information, and emergency contact details.
Edsential supports the coordination and delivery of parts of the HAF Programme. They receive the minimum information required to manage bookings, support activity delivery, and provide summarised programme information back to the Council.
To confirm Free School Meals eligibility, SEND status, or to understand any support needs relevant to providing holiday activities safely.
To confirm whether a child is open to support services where this is relevant to providing a discretionary HAF place.
Including Early Help, Children’s Services, Education, and Public Health, where joint working is required to provide coordinated support.
We provide anonymised or summarised data to meet national reporting requirements for the HAF Programme. Personal information is not routinely shared unless required by law.
We do not routinely share criminal offence data as part of the HAF Programme, and we do not sell your information or use it for marketing.
All organisations receiving information from us are required to handle it securely and in line with data protection legislation.
Data Processors
We use data processors to support the delivery of the Holiday Activities and Food (HAF) Programme. Data processors act on our instructions, must keep your information secure, and are not permitted to use your information for their own purposes. The main data processors we use for this service are:
An online booking and registration system is used to manage HAF bookings and allocate places at activities. The system collects only the information necessary to confirm eligibility, reserve places, record attendance, and ensure providers have the information they need to deliver sessions safely, including relevant dietary or accessibility needs.
Edsential supports parts of the coordination and administration of the HAF Programme. Where they act on behalf of the Council, they process booking information and attendance records in line with our instructions.
An internal case management system is used by authorised staff to check whether a child is open to Early Help or Children’s Social Care. This information is accessed through secure reporting arrangements and is not copied or retained separately for HAF purposes.
Secure reporting systems are used to support service oversight, safeguarding checks and monitoring of the HAF Programme. These systems are accessible only to authorised staff and do not create new case records.
Used to host systems, maintain secure infrastructure, and ensure the safe operation of the booking and reporting tools we rely on.
All data processors working on behalf of the Council must comply with our contractual requirements, apply appropriate technical and organisational security measures, and ensure only authorised staff can access your information.
Data Controller
Cheshire West and Chester Council is the Data Controller for the personal information processed as part of the Holiday Activities and Food (HAF) Programme. This means we are responsible for deciding how and why your information is used, and for ensuring that it is handled securely, lawfully, and in line with data protection legislation.
If you have any questions about how your information is processed, or wish to exercise any of your data protection rights, you can contact the Council’s Data Protection Officer using the details in the “Your Rights” section at the end of this notice.
The Lawful Basis for Processing
We do not rely on consent to process personal information for the delivery of the Holiday Activities and Food (HAF) Programme. Your information is processed because the Council has statutory duties to support children, provide holiday provision, and ensure appropriate care for those with additional needs.
We process personal data under:
UK GDPR Article 6(1)(e) – Public Task
Processing is necessary for the Council to deliver the HAF Programme, support children and families, meet Department for Education requirements, and carry out our official functions in relation to education, wellbeing, Early Help, and social care.
We process special category data under:
UK GDPR Article 9(2)(g) – Substantial Public Interest
Supported by the Data Protection Act 2018 Schedule 1, Part 2, including:
- Statutory and government purposes
- Support for individuals with a disability or medical condition
- Safeguarding children and individuals at risk
Special category data is used to ensure that children with SEND, medical needs or vulnerabilities receive appropriate support during holiday activities and are prioritised for discretionary places where needed.
We also process special category data under:
UK GDPR Article 9(2)(h) – Health and Social Care
Where necessary to understand additional support requirements and enable safe participation in activities.
Consent is only used for optional elements such as photos, videos or quotes. Where consent is used, it can be withdrawn at any time.
The legislation underpinning this processing includes:
- Children Act 1989
- Children Act 2004
- Childcare Act 2006
- Section 507B Education Act 1996 (duty to promote wellbeing and positive activities)
- DfE HAF Programme Guidance
- Local Government Act 1972 and 2000 (delivery of statutory functions)
International Data Transfers
We store and process your personal information within the United Kingdom. We do not routinely transfer personal information outside the UK as part of the Holiday Activities and Food (HAF) Programme.
If any personal information is transferred outside the UK, we will ensure that appropriate safeguards are in place to protect your information. These may include:
- Adequacy Decisions: Transferring data to countries with adequate data protection laws.
- Appropriate Safeguards: Using Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or International Data Transfer Agreements (IDTAs).
- Derogations for Specific Situations: Relying on your explicit consent, performance of a contract, public interest, legal claims, or vital interests.
- Risk Assessments: Conducting risk assessments to ensure data protection standards are maintained.
- Technical and Organisational Measures: Implementing encryption, access controls, and regular audits to protect your data.
These measures ensure your personal information remains secure and your rights are upheld, even when transferred internationally.
Retention Period
We will only keep your personal information for as long as it is needed to deliver the Holiday Activities and Food (HAF) Programme and to meet our legal and reporting obligations. We do not create or store separate datasets for the eligibility checking process. The information used in the internal reporting tool is drawn directly from our existing case management systems and follows the retention rules already applied to those systems.
In practice, this means:
- Early Help records: Retained for 7 years after the case is closed.
- Children in Need and other Children’s Social Care records: Retained until the child’s 25th birthday.
- Looked After Children records: Retained until the child’s 75th birthday.
- Booking and attendance information collected through the HAF booking system: Retained for 7 years from the end of the programme year in which the information was collected.
We do not extract or store additional personal information in Power BI for discretionary eligibility checks. The report reads live information from our internal systems and does not create new copies of your data.
Where information is used for research, analysis or statutory reporting, it is anonymised wherever possible so you cannot be identified. Any handwritten notes or working materials used to support operational decisions are securely destroyed once the information has been recorded in the appropriate system.
Your Rights
The UK GDPR provides you with a several rights to control what personal information is used by us and how it is used by us.
Further guidance about these rights can be accessed from the Information Commissioner’s Office (ICO) website
If you are not happy about the way your personal data is being used, or you require further information about how we process your personal data, you can contact Council’s Data Protection Team:-
- Online: Contact the DPO
- By post: Data Protection Officer, The Portal, Wellington Road, Ellesmere Port, CH65 0BA
You also have the right to complain to the Information Commissioner’s Office using the following details:
- Website: Information Commissioner's Office (ICO)
- Instant Message: Live Chat
- By post: The Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Telephone: 0303 123 1113