Privacy Appendix

In accordance with Healing Multi Academy Trusts Privacy Notice, this appendix applies specifically to the sharing of pupil data with Morrisons plc Corporate, to deliver meals to pupils in self-isolation during the Covid19 Global Pandemic.

Pupils and their families

Pupils eligible to receive Free School Meals will have access to the Morrisons Corporate “Service to feed self-isolating school children” scheme.  Parental consent will be sought by Lincoln Castle Academy to share pupil data, including forename, surname, address and telephone number.

We will not share information about you with third parties without your consent, unless the law allows us to. Under Article 6 of GDPR the processing of data is necessary to fulfil the contractual obligation for the Multi Academy Trust and for the purpose of School Census under Section 537A of the Education Act 1996.

How long Morrisons will store personal data?

Morrisons plc Corporate only hold on to your information for as long as they actually need it for the purpose it was acquired for in the first place which includes providing you with the service requested, meeting legal and regulatory obligations, resolving disputes and enforcing agreements.

In most cases, this means Morrisons plc will keep your information for as long as you continue to use their service, and for a period of time afterwards for tax purposes.

After that Morrisons plc will either delete it or anonymise it so that it cannot be linked back to you.

Requesting access to your personal data

Under data protection legislation, parents and pupils have the right to request access to information about themselves that we hold. To make a Subject Access Request for your personal data, contact the schools’ Headteacher/Principal.

You also have the right to:

  • object to processing of personal data that is likely to cause, or is causing, damage or distress
  • prevent processing for the purpose of direct marketing
  • object to decisions being taken by automated means
  • in certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed.

A separate request to have your data erased or removed can be made directly with Morrisons plc Corporate at dataprotection@morrisonsplc.co.uk