Lancashire Outdoor Education Service
To comply with the UK General Data Protection Regulation (UK GDPR), where personal data relating to a data subject is collected, Lancashire County Council would like to provide you with the following details.
Contact details of this Lancashire County Council service
Note that for queries intended for this specific service, do not contact the Data Protection Officer (DPO) mailbox, instead please direct your query to the following point of contact:
outdoor.education@lancashire.gov.uk
Reasons for processing your personal data
Lancashire County Council processes personal data to plan, manage and deliver outdoor education activities safely, effectively and in line with our public responsibilities.
The Outdoor Education Service provides day visits, residential stays and activity programmes for children, young people and adults, working with schools, organisations, families and individual participants. To do this, we need to collect and use certain personal information for the following reasons:
Planning and organising activities
Use of artificial intelligence (AI) technologies
We are increasingly utilising AI technologies to process your personal data. This is primarily utilised within Lancashire County Council using Microsoft Copilot Web and Microsoft Copilot 365. Please consult our Artificial Intelligence privacy notice for more details of how we use these specific platforms.
We do not use AI to make automated decisions. There is always a human intervention to review and approve any outputs from the AI tools. Decisions are not made solely by automated means.
Currently Lancashire Outdoor Education does not use AI technologies for the processing of personal data.
Legal basis for processing personal data
The legal basis for processing your personal data, in accordance with the UK GDPR Article 6 is:
(a) the data subject has given consent to the processing of your personal data for one or more specific purposes
Article 6(1)(a) – Consent is not used for core service delivery, but is relied on only where you have a genuine choice, such as for:
Use of photographs or video for promotional purposes
Optional communications (e.g. newsletters)
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (the law gives us a power to do it, but it is not an obligation)
For the core management and delivery of outdoor education activities, Lancashire County Council relies primarily on Article 6(1)(e) – Public Task.
This means personal data is processed because it is necessary to carry out the council’s public functions, including planning, organising and safely delivering outdoor education services.
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, where the data subject is a child.
In some limited operational contexts, Article 6(1)(f) – Legitimate Interests may also apply, where processing is necessary to support service delivery and does not override your rights and interests.
Legal basis for processing special categories of personal data
The legal basis for processing special categories of personal data relating to you, in accordance with the UK GDPR Article 9 is:
(a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where domestic law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject.
In some limited circumstances, Article 9(2)(a) – Explicit Consent may also be relied upon, where:
The information is not strictly required for safe delivery, and
You have a genuine and informed choice (for example, optional uses of images or media)
This type of consent is clearly explained and can be withdrawn.
(g) processing is necessary for reasons of substantial public interest, based on domestic law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
Where the Outdoor Education Service needs to process special category personal data (such as health, medical, disability or dietary information), it primarily relies on Article 9(2)(g) – Substantial Public Interest.
This applies where the information is necessary to safely plan and deliver activities, protect your wellbeing, and meet safeguarding and duty‑of‑care responsibilities.
In practice, this allows the service to understand and respond appropriately to medical conditions, additional needs or vulnerabilities that may affect participation.
This processing is supported by UK legislation, including provisions that allow the use of such information to:
Support you with medical conditions or disabilities
Safeguard children and individuals at risk
Information we process about you
Depending on your relationship with the Lancashire Outdoor Education Service, we may process the following types of personal information:
Basic personal details
Names, ages or dates of birth, and gender of participants and accompanying adults.
We only process information that is relevant and necessary for planning, delivering and managing outdoor education activities, and we take care to limit access to those who need it to carry out their role.
Recipients of the personal data that we process about you
Your personal data may be shared with the following recipients, where this is necessary to plan, deliver and manage outdoor education activities:
Lancashire County Council staff
Employees who are involved in booking management, administration, safeguarding, health and safety, and the delivery of outdoor education activities.Instructors and delivery staff
Including associate tutors, freelance instructors and agency staff who support activity delivery and require access to limited information to carry out their role safely and effectively.Schools, organisations and group leaders
Where appropriate, to coordinate visits, manage supervision arrangements, or support the safe participation of individuals.Service providers acting on our behalf
Organisations that provide IT systems, payment services or other operational support, who process personal data under our instructions and subject to appropriate safeguards.Emergency services or relevant authorities
Where necessary to protect the safety and wellbeing of participants, or where we are legally required to share information.
We only share personal data on a need‑to‑know basis, ensure it is used only for relevant purposes, and apply appropriate safeguards whenever information is shared.
Any transfers to another country
No
Retention periods
Lancashire County Council will only store your information for as long as is legally required or in situations where there is no legal retention period they will follow established best practice.
Booking and enquiry records
Details provided to arrange and manage visits and activities, including contact and booking information.
Stored in secure council-approved systems with access limited to authorised staff.
Retained for up to 7 years after the end of the activity, then securely deleted.
Participant registers and group lists
Records of individuals attending activities, including names, ages and group allocations.
Restricted access; secure digital storage and controlled use during delivery.
Retained for up to 7 years. Where an incident occurs, records may be kept longer in line with safeguarding or legal requirements.
Health, medical and support information
Information needed to support safe participation, such as medical conditions, allergies or additional needs.
Handled confidentially with access limited to staff who need the information for safety and wellbeing purposes.
Retained only as long as necessary for the activity and related records, normally up to 7 years, or longer where required for safeguarding or legal reasons.
Residential accommodation records
Rooming lists and overnight supervision information for residential visits.
Secure digital storage and, where used on site, kept in controlled locations.
Retained for up to 7 years. Extended retention may apply where an incident has occurred.
Activity programmes and schedules
Details of planned activities, staffing and daily timetables.
Access restricted to staff and instructors involved in delivery.
Retained for up to 7 years or longer were linked to an incident or investigation.
Photographs and video recordings
Images or recordings taken during activities where appropriate permissions have been given.
Stored securely with controlled access.
Reviewed periodically and retained only while consent remains valid or the material is required.
Financial and invoicing records
Invoices, payments and related financial administration records.
Stored within secure financial systems with restricted access.
Retained in line with council financial retention requirements.
Correspondence and feedback
Emails, messages and feedback relating to visits and service delivery.
Stored in secure systems with access limited to relevant staff.
Retained in accordance with council retention schedules and then securely deleted.
Your rights
You have certain rights under the UK General Data Protection Regulation (UK GDPR), these are those rights:
to be informed via Privacy Notices such as this.
to withdraw your consent. If we are relying on your consent to process your data, then you can remove this at any point.
of access to any personal information the council holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this, we will contact you. You can request a subject access request, either via a letter or via an email to Information Governance Team, address below.
of rectification, we must correct inaccurate or incomplete data within one month.
to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.
If you want to exercise any of these rights, then you can do so by contacting:
Information Governance Team
Lancashire County Council
PO Box 78
County Hall
Preston
PR1 8XJ
Email: dpo@lancashire.gov.uk
To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what council service you were involved with.
Identity and contact details of the data controller
Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ
Contact details of the data protection officer
Our Data Protection Officer is Joanne Winston. You can contact her at dpo@lancashire.gov.uk or Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ
Further information
For more information about how we use personal information see Lancashire County Council's full privacy notice.
If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter.
Lancashire County Council, PO Box 78 County Hall, Fishergate, Preston, Lancashire, PR1 8XJ or email: dataprotection@lancashire.gov.uk
If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).