GDPR Policy

GDPR Policy

GDPR – Your Rights under the General Data Protection Regulation

1. Context

The General Data Protection Regulation (Regulation (EU) 2016/679), known as the GDPR, is a new regulation which, from May 25th 2018, replaces the Data Protection Regulation (Directive 95/46/EC). This regulation, applying to all EU member states and their citizens, enhances privacy rights for individuals and provides a strict framework within which commercial organisations can legally operate.

The UK government has signalled its intention for the GDPR to remain part of UK law after the country leaves the EU in March 2019 and has accordingly introduced a Data Protection Bill to replace the current Data Protection Act. Your rights under the GDPR are set out below.
This policy sets out how Blue Stamp Travel Ltd (“Blue Stamp”, “we”, “us”, “our”), as “Data Controller” in respect of the personal data detailed below, obtain and use your personal data as well as your rights regarding our possession and processing of such data.

GDPR Government Guidance

2. Who we are

Blue Stamp Travel is a tour operator specialising in immersive language courses and overseas work experience placements.

• We collect the personal data of the following types of people to allow us to undertake our business.
• Teachers organising school group bookings
• Details of passengers on booked packages required to facilitate bookings
• Employees at companies tendering and providing the services we require to fulfil the requirements of our packages: Eg Coach companies, language schools etc.
• Employees, contractors and temporary workers at Blue Stamp
• Employees at companies who provide services directly to Blue Stamp

3. When and how we obtain your Personal Data

We will collect information from you

• when you request Blue Stamp quote your school/association for a package
• when recording phone calls for training and monitoring purposes
• in order to fulfil the contractual obligation of your confirmed (by means of a signed contract) booking
• when you tender to provide a service to Blue Stamp, including
  • Hotel accommodation
  • Coach bookings
  • Ferry bookings
  • Event / attraction bookings
• when you request Blue Stamp to arrange a work experience or language course placement
• when you sign up for our mailing list either through one of our websites or at a convention or exhibition
• when you fill in an enquiry form on any of Blue Stamp’s website
• when you download any Blue Stamp resource file
• when you apply to work at Blue Stamp, or as part of your contract of employment at Blue Stamp
  • we will collect information about you from a third party – e.g. References and DBS
• when required to do so to fulfil our contractual obligations relating to a booked tour or visit, i.e. when you are on the passenger/guest list of a confirmed tour or placement
• when you are providing a service as part of a tour or visit booked through Blue Stamp, e.g. as a Coach driver

4. How we process your Personal Data

School or group tour enquiry and quoting

At the enquiry/quoting stage we will collect and process the following personal data

• Your name
• Your address
• Your email address and telephone number

We may use your data to

• create a quotation tailored to your group’s exact requirement
• personalise the quotations we build and ensure these quotations reach you
• communicate with you up to the point of confirming your booking

Once you confirm your booking or notify us you are not proceeding we will cease processing your data for this purpose.

Arranging/supporting your confirmed booking of a school or group tour

Once you have confirmed your booking with us by means of signing our booking form, or electronically consenting to the same effect, we will collect and process the following personal information in order to fulfil our contractual obligations to you regarding your tour/visit

• Your name
• Your address
• Your email address and telephone number
• Full passenger list of all travelling on the tour/visit, including
  • Names as per passport
  • Passport number and date of expiry
  • Date of birth
  • Gender
  • Nationality
  • Emergency contact details
  • GP contact details
  • *Medical information including details of allergies and conditions requiring specific assistance or consideration where necessary to fulfil tour/visi
  • *Specific dietary requirements of passengers

To fulfil our contractual obligations in providing your tailored tour/visit we may use this data

• to issue an invoice, an ATOL Certificate and insurance for your group
• to book flights/ferry or Eurotunnel crossings
• to book visits/attractions specific to your tour. (Certain visits/attractions require the full passport information of your group for reasons of security)
• to ensure hotels, coach companies, airlines are aware of the medical needs of passengers on the tour so they can provide any specific assistance required
• to send details of dietary restrictions and requirements to hotels, restaurants, airlines, etc. to ensure
• appropriate and suitable meals are provided for your group
  • to contact you upon your return to seek feedback following your tour
• to ask if you would like to submit some photographs of your group whilst on tour to our “Photo competition”

Following the completion of your tour, and allowing such time to complete the feedback and Photo Competition processes mentioned above and collect any remaining monies owed, we will cease processing your data for this purpose.

Blue Stamp Travel will continue to store your personal data after the end of a tour so as to comply with our legal obligations concerning your tour, and to establish, exercise or defend legal claims as required.

* denotes special category data

Arranging/supporting your work experience abroad or language school course

To arrange your work experience abroad or language school course we will collect and process the following personal data

• Your name
• Your address
• Your email address and telephone number
• Full passenger list of all travelling on the tour/visit, including
  • Names as per passport
  • Passport number and date of expiry
  • Image of passport photo page
  • Copy of signature (digitally created on booking)
  • Date of birth
  • Gender
  • Nationality
  • Medical information* including details of allergies and conditions requiring specific assistance or consideration where necessary to fulfil tour/visit
  • Specific dietary requirements of passengers*
  • Emergency contact details (e.g. telephone numbers)
  • Details of students’ GP
  • Payment details from students (or parents/carer of students) traveling, e.g. credit card details
  • ID Photos of students traveling
  • Emergency contact numbers for group leaders of students traveling
  • Language levels / abilities of students
  • Details of courses studied
  • Intended career
  • Hobbies and interests
  • Experience

We may use your data

• to create a quotation tailored to your or your group’s exact requirement
• to communicate with you regarding the booking process
• to issue travel and medical insurance for you or your group
• to book flights/ferry or Eurotunnel crossings
• to ensure language schools, host families, restaurants and hotels are aware of the needs of your group.
  This may include our transferring medical information, including dietary and allergy information, so that they can provide appropriate and necessary accommodation, access to facilities, and to ensure appropriate and suitable meals are provided for you and your group
• to ensure coach companies, airlines, ferry operators are aware of the medical needs of passengers so they can provide any specific assistance required, including the provision of appropriate and suitable meals for you or your group
• to contact parents or next-of-kin in case of emergency
• to contact students’ GPs in case of emergency
• to provide easy identification of students traveling (passport photo)
• as proof of payment for our records (payment details)
• to place students on the appropriate level of language course
• to allow us to contact you upon your return to seek feedback following your tour
• Following the completion of your tour, and allowing such time to complete the feedback and Photo Competition processes mentioned above, and collect any remaining monies owed, we will cease processing your data for this purpose.

Blue Stamp will continue to store your personal data after the end of a tour so as to comply with our legal obligations concerning your tour, and to establish, exercise or defend legal claims as required.

* denotes special category data

Marketing purposes

If you have subscribed to our email newsletter, made a booking with us, or requested a quote, brochure or other information from us, we may send you direct marketing that we think may be of interest to you, based on your subject interest or school location.
For marketing purposes we will collect and process the following personal data

• Your name
• Your email address

We use this data to contact you with, or make available to you, information relating to our services, brochures, new products, forthcoming events and special promotions. We will endeavour to tailor the information you receive or see so it is as relevant to your needs as we are able to make it.

You have the right at any time to request we desist from such processing of your data. The mechanism for doing so is detailed below in Section 12 of this policy. Every marketing communication (email and postal) you receive will include details of how to exercise these rights.

Tendering for, or supplying services for, our tours/visits

When you tender to or supply a service to Blue Stamp, depending on the type of service you are providing, we will collect and process the following personal data

Coach Travel

• Name, address, email address, and telephone number of company owner
• Name, email address, and telephone number of the transport manager
• Names as listed on the operator’s licence
• Names as listed on the insurance documents
• Names and telephone numbers of all drivers on the tour

Hotels/Agents

• Name, telephone number, email address and signature of the hotel manager or person in charge of groups
• Names and signatures of persons responsible for public liability and insurance at the hotel
• Names and signatures of persons responsible for Health and Safety and the completion of the hotel audits
• Name, email address, telephone and mobile numbers of the director of the agency

Visits/Attractions/Reps

• Name, email address and mobile phone number of reps or tour guides
• Bank details, address and contact details for any personal guides

We may use your data

• to contact you regarding the tender process, to send confirmation of bookings, and to send necessary tour documentation
• to contact you, including out of hours, should our groups require assistance in an emergency
• to enable us to meet the necessary requirements for the School Travel Forum (including obtaining operators’ licences from coach operators, Standard Audit forms and necessary insurance documentation
• to contact the drivers of vehicles providing transport during the tour to issue payment for services provided

Following the completion of the tour, and allow for a suitable period of time to ensure all payments are made and issues relating to any issues on the tours are resolved, we will cease processing your data for this purpose.

• We will thereafter maintain your details on our system so as to comply with our legal obligations concerning any tours your supplied a service to, and to establish, exercise or defend legal claims as required, and so we are able contact you in future to request your tendering services to future tours.
• You have the right at any time to request we desist from such processing of your data. The mechanism for doing so is detailed below in Section 12 of this policy.

Supplying a service to Blue Stamp

• When you supply a service directly to Blue Stamp, whether on behalf of another company or personally, we may collect the following personal data
• Your name
• Contact details (may include your home address, email address and telephone number)
• Bank details if we make payment directly to you

We may use your data

• to contact you in order to make appointments for you to visit our premises
• to issue payment for services supplied to Blue Stamp
• to follow up on incidents relating to services provided by you to us

Following your successful provision of the services for which you were contracted, we will cease processing your data for this purpose.

We will thereafter maintain your details on our system so as to comply with our legal obligations concerning the services you supplied, and to establish, exercise or defend legal claims as required, and so we are able contact you in future to request future services from you.

You have the right at any time to request we desist from such processing of your data. The mechanism for doing so is detailed below in Section 12 of this policy.

Internal Practices – Staff

Recruitment Stage (incl. Interview)

• When you apply for a position at Blue Stamp or you are forwarded as a candidate by a recruitment agency we will collect the following personal data
• Your name
• Your address
• Your email address and telephone number
• Your CV detailing employment history
• Details of medical conditions* which may require specific assistance or consideration when attending an interview

We may use your data

• to contact you regarding your application, including to arrange an interview
• to enable us to evaluate whether your skillset and experience match our requirements regarding the position you are applying for
• to ensure all specific assistance and consideration you may require in order to attend an interview at our offices can be provided
• to provide feedback to recruitment agencies and government bodies regarding your attendance of an interview, as required
• to contact the references you provide ahead of making job offers to prospective employees

Following the application stage, whether you were successful or unsuccessful, Blue Stamp will cease processing your data for this purpose. We will however be required to hold data to comply with our legal obligations concerning the application process, e.g. confirming your attendance of interviews.

* Denotes special category data

Employment Stage

As part of your employment at Blue Stamp we will collect and process the following additional items of personal data

• Your signature
• Your National Insurance number
• Bank account information
• Details of your next of kin, including name and contact details
• Details of prescription should you claim a refund for an eye test
• Your pension number
• Details of your student loan, where applicable
• Details of your childcare provider, where applicable
• Details relating to bonus payments and performance reviews
• Details relating to any disciplinary or grievance issues
• Details of annual leave requests, sickness or other absences
• Training records
• Accidents or incidents occurring at Blue Stamp or on Blue Stamp business
• References given by third parties
• Details of medical conditions which may require specific assistance or consideration in the workplace *

We may use your data

• to generate your contract of employment and other relevant legal documents regarding your employment at Blue Stamp
• to enable us to instruct our payroll team to set you up as an employee
• to allow us to pay you a salary and to make payments for any bonuses earned
• to contact your next of kin in case of emergency
• to refund you for the cost of an eye test/glasses
• to liaise with your pension provider and to allow us to make contributions into your pension
• to make requested deductions for your student loan
• to make payments to your childcare provider
• to monitor and record your performance throughout your employment at Blue Stamp
• to record details of any grievances raised and the records of outcomes
• to know when staff are on annual leave and to identify patterns of illness
• to record training you undertake to comply with the requirements of the School Travel Forum
• to comply with the H&SE requirements. Details of any work place accidents must be stored for a minimum of 3 years after the accident takes place

Blue Stamp will cease processing your data for purposes relating to your employment once all contractual matters relating to your employment are concluded, including but not limited to final payments for your period of employment. However Blue Stamp may continue to process your data as and when we obliged to do so in order to comply with our legal obligations, or as requested by you, for instance to provide details of your period of employment to a third party.

5. Special Category Data

Blue Stamp will store and process special category data, including details of medical conditions, special dietary requirements, religious beliefs, and racial and ethnic origin, only when it is required that we do so, for example to fulfil our contractual obligations arranging and supporting your tour, or to provide such assistance or consideration as is required for you to visit our offices or facilitate your employment at Blue Stamp. We will only do so when we have your explicit consent by means including

• Your signing a contact of employment with Blue Stamp
• Our receiving a signed booking form confirming a tour with us

Once the reason for our processing this data is completed we will cease processing this data.

6. Storage and Security of Personal Data

Data we collect from you will be stored on Blue Stamp’s secure servers located in the United Kingdom or secure cloud-based servers located within the European Union at GDPR compliant cloud-storage providers. These include the following but does not preclude the use of other facilities that meet the aforementioned criteria: Ionos web services, Google, Microsoft O365, Microsfot Azure, Dot Digital.

We will store and process your Personal Data only for as long as it is reasonably necessary for us to perform the services/activities we are undertaking on your behalf or that fall within our legitimate interest, as well as to comply with our legal obligations. You may at any time request that we cease processing your data or remove it from our systems. Details for how to make such request can be found in Section 12 in this document.

As the transmission of information via the internet is not completely secure we cannot guarantee the security of your Personal Data in the course of being transferred to us; any transmission is at your own risk. Once we have received your Personal Data, we will use strict procedures and security features to try to prevent unauthorised access. Should such a breach occur we will, in compliance with articles 33 and 34 of the GDPR notify the supervisory authority and all affected individuals upon our discovering the breach.

7. Legal Basis for holding and processing your Personal Data

Blue Stamp will rely on the following legal bases for holding and processing your personal data

A. Necessary for the fulfilment a contract, i.e. booking a tour or visit
We have a legitimate interest to store and process your data in order to ensure the smooth organisation of your tour. We are unable to make the necessary arrangements for any tour without processing the data outlined in this policy.

B. Necessary for compliance with a legal obligation
We will hold information on you when we are required to do so to comply with Blue Stamp’s legal obligations. For example we hold details of passengers on tours and visits we organise against potential future legal actions resulting from these

C. Legitimate Interest.
We will hold and process your information for purposes relating to our legitimate interests. This includes the marketing of our services to you.

D. Consent
We will store and process your personal data when we have your explicit consent to do so. This includes your signing up to Blue Stamp’s mailing lists online or at an exhibition, etc.

8. With whom we share your data

No personal data will be shared with any third party prior, excepting our use of a GDPR compliant mailing company for the purpose of marketing (when the data used is restricted to your name and email address necessary to send marketing emails), to your confirming a booking with Blue Stamp by means of signing our booking form.

When you confirm a booking with Blue Stamp it will become necessary for us to share information with certain third parties so that we may fulfil the terms of the contract we have entered into with you. These third parties may include

• Airlines
• Coach companies
• Ferry operators
• Eurotunnel
• Hotels
• Visits and attractions
• Insurance companies
• Ground handling agents

Some of these parties may be based outside of the European Economic Area (EEA) or the list of countries considered by the European Union to provide an adequate level of data protection in accordance with Article 45 of the GDPR (details of this list can be found on the European Union website here https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en). Organisations that are based outside of the EEA may not be subject to the same level of controls in regard to data protection as exist within the UK and the EEA.

In order for you to travel overseas, we may be required to disclose some of your personal data to Government bodies or other authorities in the UK and in other countries, such as those responsible for immigration, border control, security and anti-terrorism. Even if it is not mandatory for us to provide information to such authorities, we may exercise our discretion to assist them where appropriate.

9. Your rights

A. Right of Access
Under Article 15 you have the right to access the personal data we hold about you and confirmation of how it is being processed by us

B. Right to Rectification
Under Article 16 you have the right to request that incomplete or inaccurate personal data information we hold about you is corrected.

C. Right to Erasure
Under Article 17 you have the right to have the personal data we hold about you deleted if

• The personal data is no longer necessary for the purpose it was originally collected or processed for
• Blue Stamp has no legitimate interest to continue to hold and process your data
• When you have exercised your right to object to processing (see below)
• Blue Stamp has processed your data unlawfully

Blue Stamp may refuse such a request if the storing of your data is required for

• complying with a legal obligation
• establishing, exercising or defending future legal claims

The right to erasure will not apply to special category data if

• Its processing is necessary for public health purposes, e.g. for protecting against serious cross-border threats to health

D. Right to Restriction of Processing

Under Article 18 you have the right to restrict to our processing of your data if

• You contest the accuracy of your personal data and/or you are verifying the accuracy of your data
• You believe your data has been unlawfully processed by us
• The personal data is no longer necessary for the purpose it was originally collected or processed for but you require us to hold your data for the establishment, exercise of defence of legal claims
• You have lodged a request under Article 21, the Right to Object (see below), and this request is being processed

E. Right to Data Portability

Under Article 20 you have the right to request Blue Stamp to transfer such personal data we hold about you in a structured, commonly used, and machine readable format to you or another party as you request, should it be practical to do so.

F.Right to Object

Under Article 21 you have the right to object to our processing your personal data, as detailed above in section 4. This includes the right to object to our processing your data for direct marketing purposes Blue Stamp can refuse such a request if

• We can demonstrate legitimate grounds for continuing to process personal data which overrides the interests, rights and freedoms of the individual
• We require the processing of personal data to establish, exercise or defend legal claims

10. How to exercise your rights

The above rights can be exercised by contacting Blue Stamp;

By email:
Admin@BlueStampTravel.com

By phone:
0115 9404 5000, during our office hours (Monday – Friday 08:30-17:30)

By post:
Blue Stamp Travel. The Old Bank, 2 Nottingham Road, Daybrook. Nottingham. NG5 6JQ.

Blue Stamp will act upon all requests under GDPR without undue delay and will respond within one calendar month of receiving the request. In cases where the request is complex or when you have submitted multiple requests to us, we may extend this time by an additional two months. We would notify you in this eventuality within one calendar month of receiving the request.

If we have doubt over the identity of the individual making the request we will ask for additional information before proceeding. We will notify you within one month of receiving your request should we require more information. Failure to provide this information would result in your request being denied.

All requests will be made free of charge although if any request is deemed to be manifestly unfounded or excessive, Blue Stamp reserve the right to impose an administration fee of £50 to comply with the request.

Blue Stamp reserves the right to refuse to comply with a request if

• it is deemed to be manifestly unfounded or excessive
• we are unable to confirm the identity of the requestor
• we request an administration fee which is not paid
• doing so would prevent us
  • complying with a legal obligation
  • establishing, exercising or defending future legal claims

The exercising of any of these rights under GDPR will not prejudice you in anyway regarding any other rights you have or the future levels of service you would expect to receive from us in the event of future enquiries or bookings.

11. Making a complaint

Should you be unhappy with our response to your request, including cases when we refuse to comply with the request, you have the right to lodge a complaint with the supervisory body tasked with overseeing the GDPR. The supervisory body for the U.K. is the Information Commissioner’s Office. The ICO can be contacted at: https://ico.org.uk/concerns/