Last updated

19/08/2026

Who we are and what we do

Who we are

We are The Shine Group (“Shine”, “TSG”, “we”, “us”, “our”) which consists of the following organisations:

Entity	Company Number	ICO Registration Number
Shine Wraparound Care Limited	09588978	ZA452322
GoShine Sports Facilities Limited T/A GoShine	16187099	ZB898407
GoShine Gordano Limited T/A GoShine	16642349	ZC054151
TeamTech4 Limited	15536125	ZC089340
The Shine Franchise Company Limited	15681796	ZC089344

Purpose of this privacy notice

The purpose of this privacy notice is to explain what Personal Data we collect about you when you work for us and how we process it. This notice does not form part of any contract of employment or other contract to provide services.

This privacy notice also explains your rights, so please read it carefully. If you have any questions or you wish to make a complaint, you can contact us using the information provided below under the section called “How to Contact Us”.

Who this privacy notice applies to

This privacy notice applies to you if you work for us as an employee, consultant, worker, contractor or volunteer and whether that is on a temporary, permanent or freelance basis, full time or part time.

What Personal Data is

‘Personal Data’ means any information from which someone can be identified either directly or indirectly. For example, you can be identified by your name or an online identifier.

‘Special Category Personal Data’ is more sensitive Personal Data and includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purposes of uniquely identifying someone, data concerning physical or mental health or data concerning someone’s sex life or sexual orientation.

Personal Data we collect

We collect the following types of personal data:

Personal details such as name, home address, date of birth, gender, marital status, number of dependents, photographs, titles and academic degrees
Contact information such as email address, phone number, emergency contact details and next of kin details
Identification and right to work documentation such as passport, birth certificate, certificate of naturalisation, immigration status documents, proof of address and other identification documents
Recruitment information such as application information, CV, covering letter, interview notes, references and correspondence
Employment information such as employment history, area of responsibility and general employment records
HR and performance information such as attendance, annual leave, training attendance and results, promotions, disciplinary records, grievance records and performance records
Payroll and financial information such as National Insurance number, bank details, payroll records, pension information, P45 information and other financial information
Family and leave information such as maternity pay and maternity leave information
Business communication and IT usage information such as business email address, email content and attachments, and internet or traffic monitoring records
DBS and compliance information such as DBS check information and supporting verification documents

How we collect your personal data

We collect your Personal Data in a variety of ways. For example, we would have collected your Personal Data directly from you as part of the recruitment process and you would have provided this to us via your CV, application form and correspondence and through interviews, meetings or other assessments. We will also continue to collect Personal Data about you during the course of your employment.

We may have also collected personal data about you from third parties, such as references supplied by your former employers and pre-employment screening checks, but this is only carried out with your consent.

Purposes, lawful bases and retention periods

We will only use your Personal Data when the law allows. We may collect and use the following types of personal data about you for the purposes explained below.

Purpose of processing	Lawful Basis	Condition to Process Special categories of personal data.
To verify right to work status and comply with employment and immigration requirements.		Article 6(1)(c) Legal Obligation	Article 9(2)(b) Employment, social security and social protection law
Collecting all necessary information to onboard a new employee	Article 6(1)(b) Contract	Article 9(2)(b) Employment, social security and social protection law
To administer employment contracts and employee benefits, including life insurance schemes.	Article 6(1)(f) – Legitimate Interest - It is necessary to offer benefits to employees as incentives	Not Applicable
To administer employment contracts, maintain employee records, and manage HR processes.	Article 6(1)(f) – Legitimate Interest - It is necessary to manage its employees throughout their employment with us through general HR processes.	Not Applicable
To process payroll, expenses, tax deductions, and meet financial and statutory obligations.	Article 6(1)(c) Legal Obligation	Not Applicable
To administer workplace pensions, process contributions, and comply with pension obligations.	Article 6(1)(c) Legal Obligation	Not Applicable
To manage maternity and paternity related employment obligations and comply with employment legislation.	Article 6(1)(c) Legal Obligation	Article 9(2)(b) Employment, social security and social protection law
To provide workplace adjustments, support employee wellbeing, and maintain a safe working environment.	Article 6(1)(c) Legal Obligation	Article 9(2)(b) Employment, social security and social protection law
To assist with performance management and succession planning	Article 6(1)(f) – Legitimate Interest - It is necessary to provide training to support the development of its employees.	Not Applicable
displaying employees across various channels to increase	company culture, number of applicants and for marketing purposes	Article 6(1)(f) – Legitimate Interest - It is necessary to publish materials about the company to raise awareness, demonstrate company culture for marketing and recruitment purposes.	Not Applicable
includes the use of email, telephone and Internet by employees for work and personal purposes.	Article 6(1)(f) – Legitimate Interest - It is necessary to provide effective communication methods to its employees to help with everyday business function.	Not Applicable
to manage employee data the moment an employee departs the company and to terminate the employment relationship.	Article 6(1)(f) – Legitimate Interest - It is necessary to terminate an employee’s access to all systems and retain any necessary personal data in line with our retention schedule.	Not Applicable
To provide, administer, maintain, and secure the organisation’s IT infrastructure, networks, servers, cloud services, databases, and business applications.	Article 6(1)(f) – Legitimate Interest - It is necessary to ensure secure, reliable, and efficient operation of the organisation’s IT systems, infrastructure, and business services, including protecting systems from disruption, failure, and unauthorised access	Not Applicable
To create and manage user accounts, authenticate users, allocate system permissions, and maintain secure access to systems and data.	Article 6(1)(f) – Legitimate Interest - It is necessary to maintain secure authentication, appropriate access controls, and accountability within systems to protect organisational data, systems, and confidential information.	Not Applicable
To provide technical support, troubleshoot issues, manage service requests, and maintain operational continuity for employees and contractors.	Article 6(1)(f) – Legitimate Interest - It is necessary to provide effective technical support and maintain operational continuity to enable employees and contractors to perform their roles securely and efficiently.	Not Applicable
To monitor systems for security threats, prevent unauthorised access, investigate incidents, manage vulnerabilities, and protect organisational systems and data.	Article 6(1)(f) – Legitimate Interest - It is necessary to detect, prevent, and respond to cybersecurity threats, unauthorised access, malicious activity, and security incidents in order to protect organisational systems, personal data, customers, and business operations.	Not Applicable
To record and review system activity, maintain audit logs, monitor system usage, and support security investigations and compliance obligations.	Article 6(1)(f) – Legitimate Interest - It is necessary to maintain audit trails, monitor system activity, support security investigations, and ensure the integrity, security, and appropriate use of systems and data.	Not Applicable
To configure, maintain, secure, and monitor company-issued devices and authorised personal devices used for business purposes.	Article 6(1)(f) – Legitimate Interest - It is necessary to secure and manage devices used for business purposes to protect organisational systems, data, and networks from security risks, data loss, and unauthorised access.	Not Applicable
To deploy, update, maintain, test, and support software applications, ecommerce platforms, and integrated business systems.	Article 6(1)(f) – Legitimate Interest - It is necessary to ensure business applications and technology platforms remain secure, functional, updated, and fit for operational and commercial purposes.	Not Applicable
To back up organisational data, restore systems following incidents, and ensure resilience and continuity of business operations.	Article 6(1)(f) – Legitimate Interest - It is necessary to protect organisational resilience by maintaining backups, restoring systems after incidents, and ensuring continuity of operations and access to critical data.	Not Applicable
To securely store organisational data and manage retention, archiving, and deletion processes in accordance with legal and business requirements.	Article 6(1)(f) – Legitimate Interest - It is necessary to securely administer data storage, retention, archiving, and deletion processes to support governance, operational efficiency, security, and risk management.	Not Applicable
To administer relationships, integrations, access controls, and support arrangements with external technology service providers and software vendors.	Article 6(1)(f) – Legitimate Interest - It is necessary to manage technology provider relationships, integrations, support arrangements, and access controls to ensure the secure, effective, and reliable delivery of IT and business services.		Not Applicable
To detect and prevent fraudulent activity, misuse of systems, and unauthorised activities affecting the organisation or customers.	Article 6(1)(f) – Legitimate Interest - It is necessary to prevent fraud, protecting systems and data, safeguarding customers and the organisation from financial loss, misuse, and unauthorised or unlawful activity.	Not Applicable
To develop, test, implement, and improve systems, applications, integrations, and technology solutions prior to deployment into production environments.	Article 6(1)(f) – Legitimate Interest - It is necessary to develop, test, and improve systems, applications, and integrations to ensure they operate securely, effectively, and meet organisational and user requirements prior to deployment.	Not Applicable

Sharing your data

Your Personal Data will be shared internally with members of the HR and payroll teams, your line manager, other managers of the business and IT staff. Only that information which is necessary to enable us to fulfil our duties is processed.

Third parties with whom we might share your Personal Data

We share your Personal Data with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so. This may include our third-party service providers for reasons including payroll, pension administration, benefits provision and administration, and IT services. We have instructed Evalian Limited as our outsourced Data Protection Officer and we may share your Personal Data with them in relation to data protection matters, if necessary.

Obligations on third parties with whom we share your Personal Data

All our third-party service providers with whom we share your Personal Data are required to take appropriate security measures to protect your Personal Data in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your Personal Data for specified purposes and in accordance with our instructions.

International Transfers

Your Personal Data may be processed outside of the UK. This is because the organisations we use to provide our service to you are based outside the UK.

We have taken appropriate steps to ensure that when your Personal Data is processed in a country outside the UK, it does not have a materially lower level of protection than that guaranteed in the UK. We do this by ensuring that:

Your Personal Data is only processed in a country which the Secretary of State has confirmed has an adequate level of protection (an adequacy regulation) or
We enter into an International Data Transfer Agreement (“IDTA”) with the receiving organisation and adopt supplementary measures, where necessary. (A copy of the IDTA can be found here https://ico.org.uk/media2/migrated/4019538/international-data-transfer-agreement.pdf; or
When transferring your Personal Data to America, we rely on the UK-US Data Bridge, where appropriate.

How long we keep your data

We only retain your Personal Data for as long as is necessary to fulfil the purposes for which we collected it, including satisfying any legal, accounting, or reporting requirements. We keep the majority of your personal data for the duration of your employment plus a further six (6) years with the odd exceptions such as information relating to pensions.

Further information on our retention periods applicable to employee Personal Data please contact us on the information under “How to Contact Us”.

Automated Decision-making

We do not make any decisions about you based solely on automated decisions.

Your rights

You have certain rights in relation to the processing of your Personal Data, including to:

Right to be informed

You have the right to know what personal data we collect about you, how we use it, for what purpose and in accordance with which lawful basis, who we share it with and how long we keep it. We use our privacy notice to explain this.

Right of access (commonly known as a “Subject Access Request”)

You have the right to receive a copy of the Personal Data we hold about you.

Right to rectification

You have the right to have any incomplete or inaccurate information we hold about you corrected.

Right to erasure (commonly known as the right to be forgotten)

You have the right to ask us to delete your Personal Data.

Right to object to processing

You have the right to object to us processing your Personal Data. If you object to us using your Personal Data for marketing purposes, we will stop sending you marketing material.

Right to restrict processing
You have the right to restrict our use of your Personal Data. This means you can ask us to suspend the processing of your Personal Data, in certain circumstances, such as where you contest the accuracy of the Personal Data.
Right to portability

You have the right to ask us to transfer your Personal Data to another party.

Automated decision-making.

You have the right not to be subject to a decision based solely on automated processing which will significantly affect you.

Right to withdraw consent

If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so.

How to exercise your rights

You will not usually need to pay a fee to exercise any of the above rights. However, we may charge a reasonable fee if your request is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

If you wish to exercise your rights, you may contact us using the details set out below within the section called ‘How to Contact Us’. We may need to request specific information from you to confirm your identity before we can process your request. Once in receipt of this, we will process your request without undue delay and within one month. In some cases, such as with complex requests, it may take us longer than this and, if so, we will keep you updated.

Complaints

You have the right to complain if you consider that we have not complied with the data protection law when handling your Personal Data. We will acknowledge receipt of your complaint within 30 days, investigate the matter without undue delay, and keep you informed of the progress and outcome. If you wish to complain please use the contact details given below under “How to Contact Us”.We will do our best to resolve the matter to your satisfaction.

If you are not satisfied with the outcome of your complaint, you can complain with the relevant supervisory authority. The supervisory authority in the UK is the Information Commission who can be contacted online at:

Contact us | ICO
Or by telephone on 0303 123 1113

For supervisory authorities in other countries within the EU see the link below:

https://edpb.europa.eu/about-edpb/about-edpb/members_en

Your duty to update us

It is important that the Personal Data we hold about you is accurate and up to date. Please keep us informed if your Personal Data changes during your working relationship with us.

What if you do not provide Personal Data to us

You have obligations under your employment contract to provide us with your Personal Data. You are required to report absences from work and may be required to provide information about disciplinary or other matters under the implied duty of good faith. You may also have to provide us with data in order to exercise your statutory rights, such as in relation to statutory leave entitlements. Failing to provide the data may mean that you are unable to exercise your statutory rights.

Certain information, such as contact details, your right to work in the UK and payment details, may be required to enable us to enter into a contract of employment with you and pay you. If you do not provide the required information this will hinder or prevent us from administering the rights and obligations arising as a result of the employment relationship.

How To Contact Us

For further information regarding your personal data or about The Shine Group’s approach to data protection in general please contact our Data Protection Officer at:

Shine Sports Ground

Lime Trees Road

Bristol

BS6 7XW

(e) dataprotection@shine-group.co.uk

(t) 01174 033 033

Changes to this privacy notice

We may update this privacy notice from time to time in response to changes in applicable laws and regulations and our processing practices. When changes are made, we will update the effective date at the top of this document.

CHURCHILL ACADEMY

FESTIVE HOLIDAY CLUBS - CHURCHILL ACADEMY