About us
School Wellbeing is a trading name of Make A Difference (UK) Limited is a UK company, registration
number 04476666. Our ICO license number is ZA786690.
Make A Difference (UK) Limited is committed to ensuring the personal data of member organisations
and their staff is protected. This Privacy Notice provides details of the information that we may process
to assist with the administration and management of this service.
Make A Difference (UK) Limited acts as a Data Controller for all personal data processed when a Member
organisation enquires about or contracts our services. We may also collect and process personal data
when Member organisations complete voluntary surveys or otherwise provide feedback on services, or
communicate with us by phone, email, letter, via our website or social media platforms.
Make A Difference (UK) Limited acts as the Member organisation’s data processor when receiving and
handling personal data related to staff eligible for wellbeing services. The member organisation must
meet their data protection obligations concerning the disclosure of this data, and also document their
lawful basis for providing this data to us in their Privacy Notices.
This notice applies to:
- Organisations that have begun the process of entering into an agreement for Wellbeing
services. - The staff and other authorised stakeholders of a Member organisation who manage and
administer the organisation’s account with us.
This notice applies to data collected: - Via our website
- Over the phone
- Via email or other written communication, including social media
- Face to Face e.g., at conferences and exhibitions
Data Protection Principles
Personal Data must be processed following the six Data Protection Principles. It must be:
- Used lawfully, fairly and in a transparent way.
- Collected only for valid purposes that we have clearly explained to you and not used in any
way that is incompatible with those purposes. - Relevant to the purposes we have told you about and limited only to those purposes.
- Accurate and kept up to date.
- Kept only as long as necessary for the purposes we have told you about. • Kept securely
This Privacy Notice sets out how Make A Difference (UK) Limited complies with these data processing
principles.
Where we might collect personal data from
Depending on the information required we may collect personal data from various sources, including:
- The potential/actual Member organisation
- You (the data subject) as one of our Member’s stakeholders
We may, from time to time, receive information about you from the third parties we work with. This,
for example, could be from a business partner, third-party processor or payment service provider.
Categories of personal data we collect
We collect different categories of personal data depending on your relationship with us:
Potential Member Organisation
If you are considering purchasing Wellbeing services, we may collect:
- Details of the decision-makers within the organisation including name, role/position, email
address, and telephone number. - Marketing preferences and customer satisfaction surveys.
- Phone calls may be recorded for training or monitoring purposes, and other communications
Member Organisation
If your organisation has an agreement, we may collect:
- Contact details of staff responsible for decision making and administration of the contract in
- the Member organisation, including name, role/position, email address, and phone number.
- Phone calls which may be recorded for training or monitoring purposes and other
communications - Marketing preferences and client satisfaction surveys,
The organisation will also be required to share with us personal data related to staff eligible for wellbeing
services including name, date of birth, gender, marital status, home address and medical history. The
sharing and processing of this data are governed by the Member organisation’s privacy notices as the
Data Controller.
How we use personal data
We use personal data to:
- Provide quotations on request
- Set up your account
- Manage your agreement
- Deliver wellbeing services
- Comply with our legal obligations
- Manage complaints
- Analyse the performance of our service
- Send marketing, promotional or customer service communications.
Lawful Bases for Processing
Where Make a Difference (UK) Limited is acting as a Data Controller in its own right our lawful bases
for processing are:
- Pursuant to a contract, or to take steps to enter into a contract in respect of Membership of
- the services provided therein.
- To comply with a legal obligation
- To protect the vital interests of the data subject or another natural person
- In pursuit of our legitimate interests as a business providing wellbeing services to Member
organisations including:
o monitoring capacity and quality to deliver an appropriate level of service to our
Member organisations o marketing our services including providing information
about services that are or may be of interest to you and building relationships with
current and prospective Member organisations. - The data subject has freely given clear consent
Special category data is processed under the following lawful bases:
- The data subject has given their explicit consent
- To establish, exercise or defend legal claims
Data Storage and Retention
All data is kept on encrypted servers and encrypted backup servers in the UK.
Make A Difference (UK) Limited will only keep personal information for as long as reasonably necessary
to fulfil the relevant purposes for which the data was originally obtained. This will generally be for as
long as:
- the Member organisation’s agreement is in force
- necessary to comply with any legal and/or regulatory obligations, and
- governed by the Limitation Act (1980)
Make A Difference (UK) Limited typically keeps personal data for up to 7 years following the termination
of your agreement. Occasionally, such as if there is a dispute or legal action, we may be required to keep
personal information until the issue is resolved.
Who do we share personal data with?
To provide wellbeing services, we need to share personal data with other third-party service providers.
These service providers may include:
- Be Well Support
- Specific Medical and Wellbeing service providers
In all instances Make A Difference (UK) Limited will:
- Establish a data-sharing agreement with the supplier or contractor, either in the contract or as
- a standalone agreement, to ensure the fair and lawful processing of personal data in
- accordance with your policies, our policies and the Data Protection legislation.
- Only share data to the extent that the supplier or contractor needs it to deliver their service,
and to keep them safe while working with you and us.
We may also share the contact details of your organisation with other companies within the group if
we believe their services would be of interest and benefit to you.
Data Security
Make A Difference (UK) Limited have put in place appropriate security measures to prevent personal
information from being accidentally lost, used or accessed in an unauthorised way, altered or
disclosed.
In addition, access to personal information is limited to those employees, consultants, service
providers and other third parties who have a business need to know. They will only process your
personal information on our instructions, and they are subject to a duty of confidentiality.
We have in place procedures to deal with any suspected data security breach and will notify you and
any applicable regulator of any actual or suspected breach where we are legally required to do so and
in accordance with our Data Security Policy and Breach Procedure.
Your Data Subject Rights
Individuals have the right to:
- Make a Subject Access Request (SAR) (see below)
- Withdraw consent to data processing at any time where consent is the sole lawful basis for the
processing of that data. - The rectification, erasure or restriction of processing of personal data, or object to the
processing of it (in certain circumstances) - Prevent the use of personal data for direct marketing
- Challenge processing which has been justified based on legitimate interests
- Request a copy of agreements under which personal data is transferred outside of the United
Kingdom, if relevant - Object to decisions based solely on automated decision making or profiling. Make A Difference
(UK) Limited does not use automated decision making and/or profiling in any of its processes
and procedures - Prevent processing that is likely to cause damage or distress
- Be notified of a data breach in certain circumstances
- Make a complaint to the ICO
- Ask for personal data to be transferred to a third party in a structured, commonly used and
machine-readable format (in certain circumstances).
Your Duty to Inform us of Changes
The personal information we hold relating to your organisation and its staff must be accurate and
current. Please keep us informed of any changes during the term of your agreement.
Subject Access Requests (SAR) and other Data Subject Rights Requests
Where we act as a Data Controller, data subjects have rights as listed above. If you wish to exercise
any of your data subject rights, please contact us directly (See ‘Contacts’ below).
The data we hold relating to the registration and provision of wellbeing services for your staff belongs
to you – the Member organisation. Where a SAR or any other data subject rights’ request is received
relating to personal data belonging to a Member organisation (Data Controller), and where Make A
Difference (UK) Limited is acting as the Data Processor, the request will be forwarded to the Member
organisation without response to the data subject.
Make A Difference (UK) Limited shall assist the Data Controller in the fulfilment of their obligation to
respond to any data subject rights request if the response requires our assistance and the provision of
information and documentation.
Contacts
Make A Difference (UK) Limited, 44 Tyndall Court, Peterborough, United Kingdom, PE2 6LR
If you have any questions or concerns about how we process personal data, please email your query to
dpo@uk-sas.co.uk
Or write to:
Data Protection Officer, Trigg House, 11 Maisies Way, South Normanton, Derbyshire, DE55 2DS.
If you have concerns that we are not able to resolve to your satisfaction you can register a concern
with the UK’s data protection regulator, the Information Commissioner’s Office by following this link
https://ico.org.uk/make-a-complaint/
