Privacy Policy

Gapforce Privacy Notice for Customers

This privacy notice (Notice) explains how Gapforce (London) Limited (Gapforce, we, our, us) collects, uses and shares the personal data of participants of our courses, gap year programs and expeditions (you, your) and your rights in relation to the personal data we hold.

Data controller and contact details

Gapforce is the data controller of your personal data and is subject to the General Data Protection Regulation and the UK Data Protection Act 2018 (Data Protection Legislation).If you have any questions about this Notice, or if you would like to exercise any of your legal rights in respect of your personal data, please contact us using the following details:

Email: operations@gapforce.org
Telephone: [0207 384 3028];
Post: Gapforce, 4th Floor, Silverstream House, 45 Fitzroy Street, Fitzrovia, London W1T 6EB

We will endeavour to update you to any significant changes to this Notice. This Notice was last updated in [June 2018].

How we collect your information

We may collect your personal information:

from the information you provide to us when you fill in forms on our website (for example, to create an online account, to submit an enquiry or sign up for our newsletters);
from the application forms (including medical forms) that you complete to participate in our courses, programs and expeditions;
when you correspond with us by phone; email, or by other means;
when you participate in our courses, programs and expeditions we may take photos, and record details;
from the information provided to us when you browse our website;
from your school or doctor where you are participating in a schools’ program;
from publicly available sources where it is necessary to obtain your name, role and contact details to contact you about our services (for example, where you are a teacher who may be interested in our school programs).

The types of information we collect

We may collect and process the following personal information about you:

your name, title, gender and date of birth;
your address, email address, social media username and phone number;
your next of kin details (in which case you confirm that you have the right to pass this information to us for use by us in accordance with this Notice);
passport and visa details;
medical details (including information about allergies, medical conditions, disabilities and dietary requirements) that you provide on our medical forms;
criminal record information (we may ask you to provide a Disclosure and Barring Services (DBS) check; for example, where you will work with children or vulnerable groups);
personal information provided by you when you attend our courses or participate in a program or expedition;
your financial and credit card information when you purchase our services;
your history of participating in our programs and expeditions;
your company or school name (and contact details) and your role within the organisation;
your image, as captured in photographs and videos;
technical information gained from your use of our website, including your internet protocol (IP) address, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform; and
information about your website visit (such as which pages you visited, products you browsed, how you navigated to our website, and how long you spent browsing our website).

How we use your information, our legal basis for using your information and who we share your information with

Where we have a contractual relationship with youWe will process your personal data because it is necessary for the performance of a contract with you (for example, when you attend a course or participate in an expedition or program) or to take steps at your request prior to entering into a contract. In this respect, we use your personal data for the following:

to administer your participation in a course, program, or expedition, including to book transport, accommodation, activities and courses;
to assess your performance on a course and your suitability to participate in an expedition or program;
to carry out our other obligations arising from any contracts entered into between you and us, including processing payment transactions;
to assist with visa requirements (whilst it is not our responsibility to arrange visas, there may be occasions where we will assist you; for example, by providing a letter supporting your application);
to interact with you before you enter into a contract with us, such as when you express your interest in our programs (for example, to send you information about our programs or answer enquiries about them).

In this respect we will provide your data to expedition and course leaders, and service providers (such as hotels, project co-ordinators and activity providers). We will also share your data with our subcontractors as necessary whom we engage to assist us in conducting our business, such as our IT and website providers and payment providers.Legitimate interestsWe also process your personal data because it is necessary for our or a third party's legitimate interests. Our legitimate interests include our commercial interests in operating our business in a sustainable and reputable manner. In this respect, we may use your personal data for the following:

to create and maintain a unique user account for you if you register for an individual account on our website;
to improve and customise the website for our users;
filming, photographing or otherwise recording expeditions, programs and courses and publishing such content on our website, social media accounts and other formats where it would not be necessary or practicable to obtain your specific consent (for example, we may seek specific consent for prominent uses (such as using your photo on advertising materials), but typically not for group shots, background inclusion or internal use). Please do let us (and your expedition leader) know if you object to us using photos and videos for this purpose;
for advertising and marketing purposes (unless it is required or appropriate to gain your consent – please see our section below on Marketing and advertising);
for analytical purposes including conducting market research;
if our business (or a part of it) undergoes a sale, financing, merger or transfer, we may disclose your personal information to a counterparty and their professional advisors for due diligence purposes and to complete the transaction. Such transfer will be subject to an appropriate confidentiality agreement between the relevant parties.

In this respect, in addition to the third parties named above, we will provide your data to third parties who assist us in our marketing operations, operate our website and provide IT services.Legal obligationsWe also process your Personal Data for our compliance with our legal obligations. In this respect, we may use your Personal Data for the following:

to meet our legal and regulatory obligations, such as safeguarding duties, our tax reporting requirements and in exercising the data protection rights of others;
to assist with investigations (including criminal investigations) carried out by competent authorities.

For these purposes we will provide your data to our auditors, the police and other competent authorities.ConsentWe will process your personal data where we have your specific consent to do so (for example, where we have sought and obtained your consent to send you direct marketing by email, or for the use of cookies on our website). If you have given your consent and you wish to withdraw it, please contact us using the contact details set out above.Where we process special categories of personal data such as the medical information or criminal records information we will request your explicit consent to process this data, unless it is in your vital interests (for example, to provide emergency treatment).Please note that where our processing of your personal data relies on your consent and where you then withdraw that consent, we may not be able to provide all or some aspects of our services to you and/or it may affect the provision of our services.

Marketing and advertising

We use cookies and similar technologies to engage in online behavioural advertising or interest-based advertising. This includes advertisements relevant to your online activities that are served to you after you leave our website.Third parties that have content embedded on our website (such as buttons, widgets, and other embedded features or content) may set cookies on your browser or obtain information about the fact that you visited our websites from a certain IP address. Our service providers may also collect personal information as described in the section above using an embedded button or similar technology.Marketing emailsWhen you subscribe to an email list or an electronic newsletter we will provide you with the option to opt-out of receiving those communications. If you unsubscribe, we will make reasonable efforts to discontinue these email communications as soon as practicable.

International transfers of data outside of the European Economic Area (EEA)

Where you participate in an overseas program it is necessary to transfer your personal information to a country outside of the EEA. For example, we will transfer your data to secure a place on an overseas project, to book accommodation and transport and to ensure that your expedition leader has the information necessary to run the program or expedition. We will transfer this information on one of the following grounds:

There is a European Commission (EC) adequacy decision in pace for the recipient country in respect of its data protection safeguards (this will apply to countries such as Argentina and New Zealand);
Where there is no adequacy decision and it is practicable for us to do so, we will enter into a data sharing agreement with the recipient organisation that incorporates EC approved standard contractual clauses;
Where it is not practicable to enter into standard contractual clauses, we will transfer your data on the basis that it is necessary for the performance of the contract between you and us or, where you are not a party to the contract (for example, our contract is with your school or parent) that it is necessary for the conclusion of a contract that is in your interests.

We may also share data with IT and marketing service providers such as Mail Chimp who will transfer your data to storage centres in the USA. In such instances data will be transferred under the Privacy Shield gateway.How long your information is keptWe will retain your personal data for as long as is required for legal purposes and our legitimate business purposes after the termination of our relationship with you. In particular:

in relation to personal data relating to the programs, courses and expeditions you have participated in, we will retain that data for a period of seven years after that activity has concluded in case any legal claims arise out of the provision of those activities;
we will retain criminal record information for a period of 12 months;
we will retain your details on our marketing database until you inform us that you no longer wish to receive our marketing communications or for a period of [two years] since you last communicated with us. However, where you do unsubscribe from our marketing communications we will keep your details on a suppression list to ensure that we do not send you information you have asked not to receive.

Your rights

Under the GDPR you have the following rights in relation to our processing of your personal data:

to obtain access to, and copies of, the personal data that we hold about you;
to require us to correct the personal data we hold about you if it is incorrect;
to require us to erase your personal data in certain circumstances;
to require us to restrict our data processing activities in certain circumstances (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal);
to receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for transmitting that personal data to another data controller;
to object, on grounds relating to your situation, to any of our processing activities where you feel this has a disproportionate impact on your rights;
to complain about the processing of your data to the relevant supervisory authority (for example, in the UK this is the Information Commissioner’s Office).

Please note that the above rights are not absolute, and we may be entitled to refuse your requests where exceptions apply. For example, if you ask for your personal data to be erased, we may nevertheless continue to maintain certain details about you for our accounting and audit purposes and to comply with our legal obligations.

Gapforce Privacy Notice for Customers

More Information