• To provide benefits and related services to you as a member.
• To keep accounts and records.
• We may, if you do not object, send you information about Trust benefits by email, text or post. We use MailChimp in the US to do this by email. Please note that we track whether emails are opened and whether links are clicked on.
• To prepare case studies.
• To get feedback from members.
• To develop and evaluate benefits.

Look in Part 2.

It tells you how to withdraw any consent you’ve given and how to object to both direct marketing and to our use where it’s based on a balancing test (called “legitimate interests”) which involves weighing our interests or a third party’s interests against your rights.

Other information

Look in Part 3 for GDPR-required information; here’s what’s in the different sections.

• Sections a: our contact details
• Section c: the purposes and legal basis for our use of your personal information
• Section d: the legitimate interests often underpinning our use of your personal information
• Section e: the types of personal information we may get from someone other than you
• Section f: third parties with whom we may share your personal information
• Section g: transfers (exports) of personal information
• Section h: storage periods
• Section i: your GDPR rights
• Section j: withdrawing consent
• Section k: complaints to the ICO
• Section l: information you must provide (either by law or under a contract)
• Section m: sources of personal information (where you aren’t the source).
• Section n: automated decisions

Look in Part 4 for further information about our website and emails.

Look in Part 5 for further an overview of sharing with providers/those who support member benefits.

Look in Part 6 for information about cookies and similar technologies.

Members can find further member-specific information on application forms and in benefit-specific documentation and terms and conditions.

• To receive agreed services from you or your employer or company.
• To keep accounts and records.

• To receive agreed services from you or your employer or company.
• To keep accounts and records.

• To enter into a services or employment contract or similar contract with you.

• To respond to your enquiry or complaint.

• Our member of staff may give us your name, address and date of birth which we may use to contact you in an emergency.

• We don’t make any routine use of your personal information (such as an online identifier) other than in statistical form, i.e. Google Analytics statistics about the online “footfall” to our site.
• Unless you log in as a member, we probably can’t identify you.

• Sections a: our contact details
• Section h: storage period
• Section i: your GDPR rights
• Section k: complaints to the ICO

Look in Part 4 for further information about our website.

Look in Part 6 for information about cookies and similar technologies.

Identity and contact details and, where applicable, of the representative

Eaga Partnership Trustee Two Limited, company number 03729659, ICO Z3033869

• These are the two corporate trustees of the employee benefit trust.
• Each company is a joint controller with the other.
• The two companies act as one in all respects in determining the purposes and means of processing, with joint privacy notices, joint responses to individuals’ requests and a single point of contact for individuals.
• They are known as “the eaga Trust”.

eT Business Funding Limited (Company No. 08026173) (eTBF), ICO ZA024813

• eTBF provides business funding loans to members.

address (operating): 25 Main Street, Ponteland, Northumberland, NE20 9NH

address (registered): 3rd Floor, Citygate, St. James Boulevard, Newcastle upon Tyne NE1 4JE

email: contact@eagatrust.com

It would be very helpful if you would tell us exactly why you are contacting us. For example to exercise a right, please put the name of the right in the subject line of the email. Thank you.

Contact details of the data protection officer, where applicable

The purposes of the use for which the personal information is  intended as well as the legal basis for the use

Here’s a key to the second column:

Consent: your consent to one or more specific purposes

Contract: entering into a contract with you or performing a contract with you

Legal obligation: we’re required by law to do this

Legitimate interests: we’ve identified this as a legitimate interest of ours or a third party; we consider that use of your personal information is necessary to achieve that legitimate interest; and we’ve balanced all that against your interests, rights and freedoms

The third column gets a bit more technical. Where we’re dealing with sensitive personal information we need not one legal basis but two, from a different list (and the list is a lot longer).

The main ones are:

Explicit consent: your explicit consent to one or more specific purposes

Legal claims: to establish, exercise or defend a legal claim

Prevention/detection of unlawful acts: this is where we must use personal information without consent so as not to prejudice preventing or detecting unlawful acts

Regulatory requirements relating to unlawful acts and dishonesty etc.: this is where we must use personal information without consent to comply with (or help someone else comply with) a regulatory requirement that involves establishing if someone has committed an unlawful act or is dishonest etc.

Public domain: you’ve deliberately put your sensitive personal information into the public domain

You can find more details on the ICO website at https://ico.org.uk

Where the use of information is based on the legitimate interests condition, the legitimate interests pursued

Our legitimate interests are:

• Operation and improvement of the employee benefit trust
• Member relationship management: this may include keeping your details on our member and email databases, corresponding with you and keeping accounts and records
• Employee relationship management, including for job applicants
• Supplier relationship management: this will mainly be limited to keeping accounts and records but we may also use it where appropriate to improve services; this might include information about your performance in providing services to us
• Fraud prevention
• Informing members by email, text or post of benefits and managing our subscriber lists
• Internal administration of member and employee personal information within our group
• Network and information security
• Reporting possible criminal acts/threats to competent authorities

Others’ legitimate interests

We may also use your personal information because it is in our members’ legitimate interests as well as or instead of our own. For example, our research and planning will look at individual members’ details to create benefits for all members and improve the administration of the employee benefit trust.

The categories of personal information collected indirectly

• Registration details, from a member, where that member is registering their child as a member.
• Details of third parties on official birth or marriage or civil partnership certificates or other official documentation, where we are seeking to prove a prospective member’s eligibility. In the UK and some other countries, this information is publicly available.
• A range of feedback and related information from some benefit providers.
• A range of feedback and related information from third parties we work with to provide benefits (for example confirmation from the Student Loans Company that their own payment has been received by the university, which triggers our payment).
• Feedback on holiday home stays, from agents at our holiday homes, who will inform us, for example, if ID checks have failed or property has been damaged.

Members can find out more in part 5, Overview for members.

The recipients or categories of recipients of the personal information, if any

Members:

• Our email services provider, to send email newsletters (we use MailChimp, see section 4.2)
• Benefit providers and those who support the provision of benefits. Members can find out more in part 5, Overview for members.
• Third party research organisations to carry out surveys and produce reports.

Job applicants:

• We will share your personal information with recruitment agents.

All types of individuals:

• Our group companies, for internal administration purposes
• Our external accounting supplier, who will also receive your bank details if necessary to pay taxes, make payments and administer benefits
• Our auditors, to audit our accounts
• Our website providers, if you use our site
• Our IT providers, to support our hardware, systems, communications, databases and software
• Our legal advisers, if necessary for legal advice and claims.
• Our processors, who process personal information on our behalf.

We will not otherwise disclose your personal information to any third party unless required or permitted to do so by law.

Where applicable, the fact that personal information is to be transferred to a third country or international organisation and the existence or absence of an adequacy decision by the European Commission, or in the case of transfers subject to appropriate safeguards or non-repetitive, limited transfers based on compelling legitimate interests, reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.
A “third country” is a country which is outside the EEA (European Economic Area) and/or the UK.

1. We transfer email subscribers’ personal information to MailChimp, our US email service provider. The basis for the transfer is our reliance on standard contractual clauses in place with MailChimp. See section 4.2 for more about MailChimp.
2. We will transfer your personal information to a third country if you are a member that lives in that country. The transfer will normally be on the basis that it’s necessary to enter into or perform the membership “contract” with you. However some countries’ laws give equivalent protection to UK data protection laws. Parts of Canada that are covered by the main Canadian privacy law are an example. If you live in one of those countries/regions, then those countries/regions’ laws will be the basis on which we’ll transfer your personal information.
3. We will also transfer a member’s personal information to a third country for the purpose of administering the HE Bursary benefit, if you are a member who is studying there, as well as where a member is staying in a holiday home in a third country. This again is on the basis of the “contract” – to administer the benefit and provide the HE Bursary.

Transfers 2 and 3 are (or may be) based on exceptions (for contracts) rather than on safeguards like standard clauses or an adequacy decision, which aren’t available to us in those situations. This creates possible risks for individuals. In the EEA and the UK individuals have certain rights and remedies if the use of their personal information is unlawful. Individuals may not have the same rights and remedies if their personal information is used in a third country or by an international organisation. For example, the third country might not have a supervisory authority (a data protection authority like the UK ICO) and may not provide for data protection principles or individual data protection rights.

The period for which the personal information will be stored, or if that is not possible, the criteria used to determine that period

• Membership records will be retained for the life of the employee benefit trust
• Supplier and consultant data may be retained for up to 7 years after the end of the supplier relationship
• Job applicant data will be retained for 6 months after the campaign if the applicant is unsuccessful, otherwise for up to 7 years after the end of the employment relationship
• Interested persons’ data will be retained at least in order to respond to the enquiry or complaint and any follow up
• Relatives’ personal data will be stored with the member of staff’s data for up to 7 years after the end of the employment relationship
• Website logs are kept for approximately 6 months
• Cookies are retained until their expiry date or you delete them, whichever is earlier.

Storage periods may be extended for the purpose of any legal claim.

The existence of the right to request access to and rectification or erasure of personal information or restriction of use concerning the individual or to object to use as well as the right to data portability

• for access to your personal information
• for rectification or erasure of your personal information
• for restriction of processing concerning you
• to object to our processing which is based on legitimate interests
• to object to archiving in the public interest, research and statistics
• to port (transfer) personal information you have provided to us, either to you or to another provider.

These rights are more complicated than the simple summary above. To find out more about them, please visit the Information Commissioner’s website. To exercise your rights, please contact us or ask us for a form. Our contact details are in the “Identity and contact details” section a above.

Please make it clear which right(s) you want to exercise, for example by putting “right to object” in the subject line of the email if you wish to exercise the right to object. Thank you.

Where the use is based on consent (for ordinary or sensitive personal information), the existence of the right to withdraw consent at any time, without affecting the lawfulness of use based on consent before its withdrawal

To withdraw consent to cookies, please adjust your browser settings (please see our cookie policy for further details).

To exercise your right to withdraw in any other case, please contact us. Our contact details are in the “Identity and contact details” section a above.

Please make it clear you want to exercise this right, for example by putting “Withdrawal of consent” in the subject line of the email, and if it applies to a particular benefit, provide the name of the benefit. Thank you.

The right to lodge a complaint with a supervisory authority

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
England

Telephone: 0303 123 1113 (local rate) or +44 1625 545 700 (from outside the UK).

Website: https://ico.org.uk which includes a live chat on the ‘contact us’ page.

Whether the provision of personal information is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the individual is obliged to provide the personal information and of the possible consequences of failure to provide that information

There is no legal obligation to provide information.

Contract requirement

If you are a member, supplier, job applicant or interested person, we’ll normally need your personal details (name and contact details) to provide benefits, receive goods and services, process your application or answer your query or complaint. For members, suppliers and prospective employees, we may also need your financial details (e.g. bank details and, for suppliers, VAT number where applicable) so we can pay you. Our external accounting supplier looks after the financial details and tax/payment side for us.

If any personal information is required for member registration or for members to receive a benefit, that will be clear on the application form or in the accompanying documentation.

The source of the personal information and if applicable, whether it came from publicly accessible sources

Members can find out more in part 5, Overview for members.

The existence of automated decision-making, including profiling. This means a decision based solely on automated profiling which produces legal effects concerning the individual, and which must not be based on special categories of (i.e. sensitive) personal information without explicit consent or substantial public interest, with safeguards. Meaningful information about the logic involved, as well as the significance and the envisaged consequences of the processing for the individual must also be provided.

• Please see members’ area of the website for details.

Shared

• None

Provided

• None

• Please see members’ area of the website for details.

Shared

• None

Provided

• None

(please see their terms and conditions and cookie policy)

• Please see members’ area of the website for details.

Shared

• None

Provided

• None

(note this is a US site – please see their terms and conditions of use and sale and their privacy policy)

• Please see members’ area of the website for details.

Shared

• None
• We will share your name, date of birth, NI number and business area with Carillion PLC and their liquidators PwC, for tax purposes.
• We will share your details with our external accounting supplier in order to make payment.

Provided

• Please see members’ area of the website for details.

Shared

• We will share your personal details with a credit reference agency in order to obtain a credit check.
• We will share your name, date of birth, NI number and business area with Carillion PLC and their liquidators PwC, for tax purposes.
• We will share your details with our external accounting supplier in order to make payment.

Provided

• The credit reference agency will provide us with a credit check.

• Please see members’ area of the website for details.

Shared

• We will share your name, date of birth, NI number and business area with Carillion PLC and their liquidators PwC, for tax purposes.
• We will share your details with our external accounting supplier in order to make payment.

Provided

• None.

• Please see members’ area of the website for details.

Shared

• If you live and study in the UK, we will send the Student Loan Company (SLC) your name, address, NI number, date of birth, unique reference number and SLC number so they can match you to their own records.
• We may share your name, email, telephone/mobile, University, course and year of study with the benefit auditor, Origin Associates Limited (the Bursary Auditor) for fraud prevention/detection purposes.
• We will share your name, date of birth, NI number and business area with Carillion PLC and their liquidators PwC, for tax purposes.
• We will share your details with our external accounting supplier in order to make payment.

Provided

• If you are from the UK and study in the UK, the SLC will share your name, NI number, date of birth, SLC number, unique reference number, University, course and course start date so we can match that to our own records.
• If you are from the UK and study in the UK, then up to 9 times during your course, the SLC will confirm that it has validated its own loan payment, or notice that it has not been able to do so (used by us to trigger or withhold payment).
• If you are from the UK but studying outside the UK, or if you are not from the UK, then we will validate your attendance at your university before we make payment. To do that, we will need to share your details with your university, which may involve a transfer of your personal information to a third country; we will receive further information about you from your university (e.g. confirming your attendance) – that may contain sensitive personal information
• We may receive a report and possibly further clarifications from the Bursary Auditor – this may contain sensitive personal information
• We may receive ancillary information e.g. from the Bursary Auditor or (if you are from the UK and study in the UK) from the SLC – this may also contain sensitive personal information.

• Please see members’ area of the website for details.

Shared

• We will share your name, date of birth, NI number and business area with Carillion PLC and their liquidators PwC, for tax purposes.
• We will share your details with our external accounting supplier in order to make payment.

Provided

• None

• Please see members’ area of the website for details.

Shared

• We will share your name, date of birth, NI number and business area with Carillion PLC and their liquidators PwC, for tax purposes.
• We will share your details with our external accounting supplier in order to make payment.

Provided

• We will pay childcare support payments directly into your Government Childcare account.

(paid by the eaga Trust)

• Please see members’ area of the website for details.

Shared

• We will share your name, date of birth, NI number and business area with Carillion PLC and their liquidators PwC, for tax purposes.
• We will share your details with our external accounting supplier in order to make payment.

Provided

• We will pay the course provider’s invoice on your behalf.

(paid by the eaga Trust)

• Please see members’ area of the website for details.

Shared

• We will share your name, date of birth, NI number and business area with Carillion PLC and their liquidators PwC, for tax purposes.
• We will share your details with our external accounting supplier in order to make payment.

Provided

• We will pay tutoring support payments directly to Kip McGrath

(paid by the eaga Trust)

• None.

Provided

• Aviva will contact our Insurance Broker Gallaghers, who will contact the Trust to inform us you have enquired about making a claim.

Shared

• We will confirm your membership (your full name, date of birth, address details and membership number) and therefore inclusion within the programme to Gallaghers who will share it with Aviva. We will keep a record of our correspondence with Gallaghers.
• We will share your name, date of birth, NI number and business area with Carillion PLC and their liquidators PwC, for tax purposes.

(paid by the eaga Trust)

• Please see members’ area of the website for details.

Shared

• We will share your name and membership number with Co-Op Legal Services.
• We will share your name, date of birth, NI number and business area with Carillion PLC and their liquidators PwC, for tax purposes.
• We will share your details with our external accounting supplier in order to make payment.

Provided

• We will pay the benefit provider’s invoice on your behalf.

• None.

Shared

• We will share your title, first name, surname, address, email address, date of birth and membership number with BUPA.
• We will share your name, date of birth, NI number and business area with Carillion PLC and their liquidators PwC, for tax purposes.
• We will share your details with our external accounting supplier in order to make payment.

Provided

• We receive a ‘claim summary’ report from BUPA once a year, however this does not contain any identifying data.

(paid by the eaga Trust)

• Please see website booking requirements and holiday home terms and conditions.
• If you are staying at the Hyning Estate, CCTV is in operation. These are for the purposes of public and staff safety and crime detection and prevention. In all locations, signs are displayed notifying you that CCTV is in operation and providing details of who to contact for further information about the scheme. We will only disclose CCTV images to others, where required by law or to help prevent crime etc. Images captured by CCTV will not be kept for longer than necessary. However, on occasions there may be a need to keep images for longer, for example where a crime is being investigated. You have the right to see CCTV images of yourself and be provided with a copy of the images. However, the images may be withheld if the images also identify a third party.

Shared

• We will share your booking details with the management agents. This varies according to the holiday home but will typically include your first name and surname, month and year of birth, arrival/departure dates and how many are in your party and may include your telephone number and email address.
• We will share your name, date of birth, NI number and business area with Carillion PLC and their liquidators PwC, for tax purposes.
• We will share your details with our external accounting supplier in order to make payment.

Please note that you will also be required to share personal information with the management agent(s) for the holiday home. Please see the holiday home terms and conditions.

• Information about your use of our website and any emails, texts or letters you send to us or which is recorded by us as a result of calls from you.
• Information from our surveys or research that you participate in.
• Something you tell us in raising an issue or making a complaint, which may include sensitive personal information.

We use Google Analytics – see how Google uses your data here: www.google.com/policies/privacy/partners.

We use Vimeo, the video-sharing website, to provide videos to you on our site. Vimeo will set third party cookies if you watch one of those videos.

Please see https://vimeo.com/ for further details.