Privacy Policy (Version 5)

Privacy Notice

Through ISO 9001:2015 accreditation, Aspire Active Education Group Ltd are committed to maintaining our highly regarded and respected quality service.

Aspire Active Education Group is committed to protecting personal information and being clear about how we collect, use, store and share it.

This Privacy Notice explains:

• What personal information we collect

• How and why we use it

• The lawful bases we rely on

• Who we may share it with

• How long we keep it

• How we protect it; and

• Your rights in relation to your personal information.

We process personal information in accordance with applicable UK data protection and privacy legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended.

About us:

The Aspire Active Education Group (AAE) comprises of the following organisations:

• Aspire Active Education Group (company number 10156357)

• Aspire Active Camps Ltd (company number 06533710)

• Aspire Active Education Ltd (company number 13499677)

• Aspire Active Partnerships Ltd (company number 11785251)

• Aspire Training Solutions (UK) Ltd (company number 08430411)

• Swim:ED Ltd (company number 17025847)

Throughout this Privacy Notice, references to “Aspire”, “AAEG”, “we”, “our” or “us” mean the relevant Aspire Active Education Group organisation responsible for processing your personal information.

Our main business and correspondence address is:

Unit 6, Holly Park Industrial Estate Spitfire Road

Erdington Birmingham B24 9PB

Telephone: 0121 663 1979

Email: info@aaeg.co.uk

Our Data Protection Lead can be contacted directly here:

Personal information is any information relating to an identified or identifiable individual. This can include information such as your name, contact details and date of birth, as well as information about your use of our services.
Some personal information requires additional protection under data protection law. This is known as special category data and includes information about health, ethnicity and certain other personal characteristics.

Information about criminal convictions and offences is also subject to additional legal safeguards.

Any reference to “you” or “your” refers to you, or anyone whose personal information we process.

What information do we collect

The information we collect depends on your relationship with us and the services you use.

ASPIRE ACTIVE CAMPS

Where you make a booking or your child attends one of our camps, we may collect:

• Parent or carer name and contact details

• Child’s name, date of birth and relevant school information

• Emergency contact information

• Information required to keep your child safe while attending

• Payment and transaction information

• Communications, feedback and complaints

• Account and booking history
  
  
• Website and technical information.

We only collect information about children that we reasonably need to safely provide and administer our services.

ASPIRE ACTIVE EDUCATION AND SWIM:ED

When working with schools and other organisations, we may collect:

• Names and contact details of school staff and other professional contacts

• Information required to manage contracts and deliver services

• Pupil information where required to deliver a service

• Relevant health, medical or additional needs information where this is necessary for safe participation

• Attendance, participation and assessment information where relevant

• Transaction and payment information

• Feedback and survey responses

• Website and technical information

The information we hold about individual pupils will depend on the service being provided and our relationship with the school.

ASPIRE ACTIVE PARTNERSHIPS

We may collect information relating to employees, prospective licensees, licensees, contractors and business contacts, including:

• Name and contact details

• Information required to assess or manage a business relationship

• Contractual information

• Payment and transaction information

• Correspondence

• Feedback and survey responses

• Website and technical information

ASPIRE TRAINING SOLUTIONS

When you enquire about, apply for or undertake training or an apprenticeship with us, we may collect:

• Name, address and contact details

• Date of birth
  
  

• Information required to establish eligibility for training or apprenticeship funding;

• Previous employment and work history

• Qualifications and previous learning

• Employment details

• Learning, assessment, progress and achievement records

• Information required by apprenticeship funding, awarding, assessment or regulatory bodies

• Relevant health, disability or additional learning support information

• Ethnicity and other equality monitoring information where required or appropriate

• Payment and transaction information where applicable

• Correspondence and feedback

• Website and technical information

Where we are required to collect particular information to meet apprenticeship funding, regulatory or contractual requirements, we will explain this when the information is collected.

JOB APPLICANTS, EMPLOYEES AND WORKERS

If you apply to work with us or work for us, we may collect:

• Name and contact details

• Date of birth

• Employment history and qualifications

• References

• Right-to-work information

• Payroll, pension and taxation information

• Attendance and employment records

• Training and performance information

• Relevant health or medical information

• Equality monitoring information

• Information relating to safeguarding requirements

• Criminal conviction information where a DBS or other appropriate check is required. 

Further information may be provided through specific recruitment and employee privacy information

WEBSITE USERS AND ENQUIRIES

When you visit our websites, submit an enquiry or interact with our digital services, we may collect:

• Name and contact details

• Details of your enquiry

• IP address

• Browser and device information

• Website usage information

• Communication preferences

• Information collected through cookies and similar technologies

Further information about cookies is available through the relevant website’s Cookie Notice or cookie management tool.

Children's personal information

A number of our services are provided to children and young people and we recognise that children’s personal information requires particular protection.

Depending on the service, information about a child may be provided directly by a parent or carer, by a school or other organisation responsible for the child, or collected as part of providing the service.

We aim to collect only the information that is reasonably necessary to provide the service, safeguard the child and meet our legal and contractual responsibilities. Where we process personal information on behalf of a school or another organisation, that organisation may be the data controller and Aspire may act as its data processor. In these circumstances, we process the information in accordance with our agreement with that organisation and its instructions. Where Aspire determines the purposes and means of processing personal information, the relevant Aspire company will act as the data controller. In some circumstances, more than one organisation may jointly determine the purposes and means of processing and may therefore act as joint controllers.

Special category and criminal offence information 

Some of our services require us to process information that receives additional protection under data protection law. This may include:

• Health and medical information
  

• Disability or additional support needs

• Ethnicity
  

• Other equality monitoring information
  

We will only process special category information where we have both a lawful basis under Article 6 of the UK GDPR and an appropriate condition for processing under Article 9 and, where required, the Data Protection Act 2018.
Where we process criminal conviction or offence information, including information associated with DBS checks, we will only do so where permitted by law and with appropriate safeguards in place. We will only retain information relating to criminal record checks for as long as necessary and in accordance with applicable legal, regulatory and safeguarding requirements.

How we collect personal information 

We may collect personal information:

• Directly from you

• From a parent or carer

• From schools, employers or other organisations that engage our services

• Through our websites, booking systems and online platforms

• When you contact us by telephone, email, social media or another communication channel

• From apprenticeship, awarding, funding or regulatory organisations where appropriate

• From recruitment and employment processes

• From service providers acting on our behalf

• From publicly available sources where appropriate and lawful

Where personal information has not been obtained directly from you, we will provide the information required by data protection law unless an exemption applies.

How we use your information and our lawful basis

We will only use personal information where we have a lawful reason to do so. Depending on the circumstances, we may rely on the following lawful bases.

CONTRACT
We may process your information where this is necessary to take steps at your request before entering into a contract, or to perform a contract with you. This can include managing bookings, delivering training, processing payments and providing services you have requested.

LEGAL OBLIGATION
We may process information where this is necessary for us to comply with a legal obligation.  This may include employment, taxation, safeguarding, health and safety, apprenticeship funding and regulatory requirements.

LEGITIMATE INTERESTS

We may process personal information where this is necessary for our legitimate interests or those of a third party, except where those interests are overridden by your interests, rights or freedoms.

This can include:

• Managing our relationship with customers, schools and employers

• Improving our services

• Maintaining the security of our systems

• Preventing fraud

• Responding to enquiries and complaints 

• Understanding how our services are used

• Certain business-to-business marketing activities

Where we rely on legitimate interests, we consider the purpose of the processing, whether the processing is necessary and the potential impact on the individual.

RECOGNISED LEGITIMATE INTERESTS
In limited circumstances, we may process personal information where UK data protection law recognises a specified legitimate interest as a lawful basis for processing. These circumstances are defined by law and can include certain processing for safeguarding, crime prevention, emergencies and public security.

CONSENT
In some circumstances, we will ask for your consent.  Where we rely on consent, you can withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

VITAL INTERESTS

In exceptional circumstances, we may need to process information where this is necessary to protect someone’s vital interests, for example in a medical emergency.

PUBLIC TASK

Where applicable to a particular activity, we may process information where this is necessary for the performance of a task carried out in the public interest or in the exercise of official authority. We will only rely on this basis where the legal requirements for doing so are met. The lawful basis that applies will depend on the particular processing activity.
Additional conditions apply where we process special category or criminal offence information.

Marketing and communications

We may contact you about Aspire services, resources, events and opportunities that we believe are relevant to you.
We will only send electronic marketing where permitted under UK GDPR and PECR. The rules that apply can differ depending on whether we are communicating with an individual consumer or a professional contact within a company, school or other organisation.
Where consent is required, we will obtain it before sending marketing communications. In other circumstances, we may rely on a permitted existing-customer relationship, sometimes referred to as the “soft opt-in”, where the legal conditions are met, or on legitimate interests where permitted by law.

You can opt out of marketing communications at any time by:

• Using the unsubscribe link included in our marketing emails

• Updating your communication preferences please click here

• Contacting us at info@aaeg.co.uk

Opting out of marketing will not prevent us from contacting you where we need to communicate with you about a booking, contract, apprenticeship, employment matter or another service you are using.

We may retain limited information on a suppression list to ensure that we continue to respect your request not to receive marketing.

Cookies and similar technologies

Our websites and digital services may use cookies and similar storage and access technologies. Where consent is required by PECR, we will ask for it before using the relevant technology. UK law permits certain storage and access technologies to be used without consent in specified circumstances,
including some low-risk uses. Further information about the technologies used, their purposes and the choices available to you is provided through the relevant website’s Cookie Notice or cookie management tool.

Who we share personal information with

We do not sell your personal information. We only share personal information where we have a lawful reason to do so.

Depending on the service, this may include sharing information with:

• Organisations providing IT, hosting, CRM and communications services

• Booking and payment service providers

• Schools, employers and organisations commissioning our services

• Apprenticeship funding, awarding, assessment or regulatory organisations

• DBS, identity and right-to-work checking providers

• Professional advisers, auditors and insurers

• Safeguarding authorities and relevant agencies

• HMRC and other government departments

• Regulators, including the Information Commissioner

• Police and law enforcement agencies where legally required

• Other organisations where disclosure is necessary to establish, exercise or defend legal claims

Where an organisation processes personal information on our behalf, we require appropriate contractual and data protection safeguards to be in place. We will not provide your personal information to another organisation for that organisation’s own marketing purposes unless there is an appropriate lawful basis and any applicable PECR requirements have been met.

Our service providers

We use third-party systems and suppliers to help us operate our  organisation and deliver our services.

These may include systems such as:

• HubSpot

• Kajabi

• Microsoft 365 and SharePoint

•  Google services

• Meta/Facebook

• LinkedIn

• Specialist platforms used by  individual Aspire businesses

Our suppliers and systems may change over time. We carry out appropriate due diligence and require suitable data protection arrangements where personal information is processed on our behalf.

International transfers

Some organisations that provide services to us may process or store personal information outside the UK.

Where this involves a restricted transfer of personal information outside the UK, we will ensure that the transfer complies with
applicable UK data protection law.

Depending on the organisation and destination, this may include reliance on:

UK adequacy regulations

The UK Extension to the EU-US Data Privacy Framework, where applicable
The UK International Data Transfer Agreement
The UK Addendum to the EU Standard Contractual Clauses
Another transfer mechanism or safeguard permitted under UK data protection law.

Where required, we will assess whether the protections provided for transferred information are not materially lower than those provided under UK data protection law and take any additional measures that are appropriate.

Data security

We take appropriate technical and organisational measures to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Access to personal information is limited to employees, contractors and service providers who have a legitimate need to access it.

People who process personal information on our behalf are required to handle it securely and confidentially.

We maintain procedures for identifying, investigating and managing personal data breaches.

Where required by law, we will report a personal data breach to the Information Commissioner and inform affected individuals.

How long we keep personal information

We only keep personal information for as long as it is reasonably necessary for the purpose for which it was collected, including meeting

legal, regulatory, contractual, safeguarding, accounting or reporting requirements.

Different types of information therefore have different retention periods.

When deciding how long information should be retained, we consider:

• Why we collected it

• How long we reasonably need it

• Legal and regulatory requirements

• Safeguarding requirements

• Potential legal claims

• The nature and sensitivity of the information.

For example, certain financial and contractual records may need to be retained for six years or longer, while other operational information

may be deleted considerably sooner.

Apprenticeship, safeguarding, employment and other regulated records may be subject to specific retention requirements.

We maintain internal retention arrangements appropriate to the different types of information we process.

When information is no longer required, it will be securely deleted, destroyed or anonymised.

Your data protection rights

Depending on the circumstances, UK data protection law gives you a number of rights.

RIGHT TO BE INFORMED

You have the right to receive information about how your personal information is collected and used.

RIGHT OF ACCESS

You can ask us for access to the personal information we hold about you. This is commonly known as a Subject Access Request. Requests can be made verbally or in writing.

We will respond within the time period required by law. In most cases this is one month, calculated in accordance with current data protection
legislation. The response period may be extended where the law permits.

Where reasonably necessary, we may ask you for information to confirm your identity. In some circumstances, where we process a large amount of information about you, we may also ask you to specify the information or processing activities to which your request relates before we carry out a reasonable and proportionate search.

RIGHT TO RECTIFICATION

You can ask us to correct personal information that is inaccurate or complete information that is incomplete.

RIGHT TO ERASURE

In certain circumstances, you can ask us to delete your personal information.

This right is not absolute. We may need to retain information where we have a lawful reason or legal requirement to do so.

RIGHT TO RESTRICT PROCESSING

In certain circumstances, you can ask us to restrict the way we use your personal information.

RIGHT TO DATA PORTABILITY

In certain circumstances, you can ask us to provide personal information you have given us in a structured, commonly used and machine-readable
format, or transfer it to another organisation where technically feasible.

This right applies only in specified circumstances, including where processing is based on consent or contract and carried out by automated
means.

RIGHT TO OBJECT

You may have the right to object to processing based on legitimate interests.

You have an absolute right to object to your personal information being used for direct marketing.

RIGHTS RELATING TO AUTOMATED DECISION-MAKING

You have rights and safeguards in relation to certain decisions based solely on automated processing that produce legal effects or similarly significant effects.

Automated decision making and profiling

We may use information to understand engagement with our services and communications and to help make our communications more relevant.

We do not currently use solely automated decision-making to make decisions about individuals that produce legal or similarly significant effects.

If this changes, we will provide the information required by law and apply appropriate safeguards, including any additional restrictions that apply to special category personal information.

Keeping your information accurate

We want the information we hold about you to be accurate and up to date.

Please let us know if your information changes or you believe information we hold is incorrect.

Data protection complaints

If you believe that we have infringed data protection law in connection with your personal information, you have the right to make a complaint directly to us.

We will facilitate the making of data protection complaints and provide an appropriate way for you to submit a complaint, including electronically.

 You can make a complaint by contacting:

Letitia Lea

 Email: letitia.lea@aaeg.co.uk

Telephone: 0121 663 1979

Or by writing to:

Aspire Active Education Group

Unit 6, Holly Park Industrial Estate

Spitfire Road

Birmingham

B24 9PB

We will:

• Acknowledge receipt of your data protection complaint within 30 days of receiving it

• Take appropriate steps, without undue delay, to investigate and respond to the complaint

• Make appropriate enquiries into the subject matter of the complaint

• Keep you informed about the progress of the complaint where appropriate

• Inform you of the outcome without undue delay.

You also have the right to complain to the UK’s data protection regulator, the Information Commissioner.

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire SK9 5AF

Telephone: 0303 123 1113

Website: www.ico.org.uk

You do not have to make a complaint to us before contacting the Information Commissioner.

Making a data privacy request

If you would like to exercise one of your data protection rights, you can contact us using the details in this Privacy Notice or use our
online data privacy request facility.

Data privacy request form:
https://na1.hs-data-privacy.com/request/r23PFTpYnX0mWg6O5Sk4SA

We may need to ask for information to confirm your identity before responding to your request.

Contact us

For questions about this Privacy Notice or how Aspire Active Education Group uses personal information, please contact:

Aspire Active Education Group

Unit 6,

Holly Park Industrial Estate
Spitfire Road

 Birmingham

B24 9PB

Telephone: 0121 663 1979

Email: info@aaeg.co.uk