Privacy Notice 


TABLE OF CONTENTS

 

1. Welcome 

Welcome to our privacy notice (“Privacy Notice”). At Collinson Assistance Services Limited ("we, us, our,"), we respect and commit to protecting your personal data. Our Privacy Notice, together with our Terms and Conditions, will explain how we collect, use, store, share and look after your data: 

 

  1. When you visit or use our website to register and book for Covid-19 Testing, or 
  2. If you use any of our products, services and or applications (together “services”). 

 

For ease, we have divided our Privacy Notice into sections. At the end of our Privacy Notice, we have also included a Glossary to explain some of the terms mentioned.  

                                                                  

2. About Us 

Collinson Assistance Services Limited is a company registered in England and Wales with company number 11908215 and offices in Cutlers Exchange, 123 Houndsditch, London, EC3A 7BU, United Kingdom, and a subsidiary of the Collinson Group Limited (the “Collinson Group”).

Under Applicable Data Protection Law, we are the Controller of your Personal Data we process.

Please see Section 13 for details about the Oneworld Research Trial (Only applicable to participant of the Oneworld Research Trial)

 

3. Contact Details 

The Collinson Group has appointed a Group Data Protection Officer (“DPO”). If you would like to  contact the DPO or the Data Protection Team please contact us  by email at privacycovid@collinsongroup.com.

 

4. Our Global Presence  

We are a company with a global presence and must meet many data protection and privacy law requirements in the countries we operate. Therefore, to stay consistent and comply with all relevant laws we apply the highest standard of data protection and privacy laws, the General Data Protection Regulation (GDPR). 

 

5. Personal Data we collect about you.

If you have any pre-existing medical conditions or concerns such as vulnerabilities, you can discuss this with the nurse at your testing location. The nurse will only use the information you share to provide direct care and will always remain confidential. If the nurse needs your medical consent to care for you, they will get this from you at the time.

 

We will collect your Personal Data from:  

  • You e.g. when you reach out to us, either online or via email, mobile, phone or post, or in person and you provide us with your details for a Covid-19 test.
  • your devices e.g. when you visit or use our Website.   
  •  cookies we use on our websites to keep our it safe, offer you personalised experiences. 
  • From testing location 
  • Oneworld, as part of the research trial, to register and track you.  (For participants on the research trial only)

Different testing types will need slightly different details. Your Personal Data we may collect is  outlined in the table below.   

Purpose 

Type of Personal Data 

Data collected to register and take the test  

Name, email address, telephone number, mobile number, address 

your customer username or number, password, Sample number, 

Passport number, nationality 

Payment method used, credit and debit card, bank details

Any Personal Data you provide us when you contact us. We also record your calls with us.  We collect and store all copies of emails sent. 

Medical data that directly relate or may prevent you from undertaking the Covid-19 testing.

Test method (e.g. PCR)

Test result (i.e. COVID-19 +ve/-ve)

Genetic data (genetic swabs) 

 

Sample taken date

Sample type

Result date

Name of laboratory

Device details: Traffic information, IP address, time of access, date of access, location, web pages visited, device identifiers.

Website use data. Please see our cookie policy.

Specific data required from Passengers arriving to the UK

Sex

Date of birth 

NHS number (if known and applicable)

Ethnicity 

Date of arrival to UK

Coach number

Flight number 

Vessel name (as appropriate)

 

Date on which you last departed from or transited through a non-exempt country or territory, or a non-exempt region of a country or territory ‒ a destination not on the travel corridors list.

 

The country or territory you travelled from when you arrived in the UK, and any country or territory you transited through as part of that journey.

 

Research Data (data collected specifically for the Oneworld research trial)

Previous Covid-19 diagnosis

 

Collection of this additional data is voluntary; the data will be removed from your profile within 10 days and anonymised before it will be used for research. For We collect this data only on behalf of Oneworld, as a Processor. 

 

Marketing and Advertising Purpose

Your marketing preferences and responses to our direct marketing, e.g. when and if you have open, read and deleted our marketing emails, links clicked in marketing emails. 

 

If the parent or guardian has granted consent, we will undertake a Covid-19 testing on your child. 

6. How we use your Personal Data

 We will use your Personal Data in the following circumstances: 

 

  • To perform a contract, we have with you (Terms and conditions – to allow us to carry out the test) or about to enter with you. 
  • For our Legitimate Interest (or those of another company), but only when your rights and freedoms do not override our legitimate interest. Our legitimate interest is, to help us improve our services and products and to obtain feedback from you. 
  • to comply with a legal and regulatory obligation.
  • Where we have your consent:
    1. for direct marketing from Collinson or a third party 
    2. to collect data specifically for the research trial on behalf of Oneworld (Covid-19 diagnosis prior to the trial, once collected we will anonymise this information within 10 working days, you can withdraw your consent during this time). Only applicable for participants on the Oneworld research trial. 

 

Special Category Data is processed under the following additional legal basis: 

  • to comply with our legal obligation.
  • Necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health.

 

  • Explicit consent for collecting special category data on behalf of Oneworld, specifically for the research trials (Covid-19 diagnosis before the trial, once collected we will anonymise this information within 10 working days, you can withdraw your consent during this time). Only applicable for participants on the Oneworld research trial.  

 

 

The table outlines the lawful basis we can rely on to process your Personal Data.  

 

What we use your information for

 Legal basis

Confirming the appointment to the regional test site

 

To perform a contract, we have with you or about to enter with you. 

 

Performing a security and ID verification at the regional test site

To perform a contract, we have with you or about to enter with you. 

Performing your test 

To perform a contract, we have with you or about to enter with you. 

To process payment for the test 

To perform a contract, we have with you or about to enter with you. 

Receiving and processing your test

To perform a contract, we have with you or about to enter with you. 

Sharing all results with Public Health England (if you live in England) to help plan and respond to COVID-19

 

To comply with our legal obligations

 

 

Necessary for reasons of public interest in the area of public health, such as protecting against   serious cross-border threats to health.

 

 

As of 22 November 2020, both positive and negative test results will be shared.

Provide access to Covid-19 Test results

To perform a contract, we have with you or about to enter with you. 

Respond to any enquiries from you regarding our service

To perform a contract, we have with you or about to enter with you. 

Where we share your personal data and sensitive personal data with regulators and governmental agencies. 

To comply with our legal obligations

 

Necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health.

To provide you with information about goods and services which we believe may be of interest to you from us or trusted third parties. 

Where we have your consent.

To provide you with access to our website and or our mobile app.

To perform a contract, we have with you or about to enter with you.

To help develop and improve our products, services and the way in which we communicate with you, and to carry out internal research and development that allows us to better serve our customers.

Legitimate Interest to help understand how we can improve our services.

 

To receive feedback from you to help us improve on our product services 

Legitimate Interest to help understand how we can improve our services 

To collect data specifically for the research trials on behalf of Oneworld (Covid-19 diagnosis prior to the trial). Only applicable for participants on the Oneworld research trial.  

 

Where we have your consent. 

 

Where we collect ethnicity data and your Covid-19 diagnosis prior to the trial, we require your explicit consent. You can voluntarily provide us this information. 

 

Once collected we will anonymise this information within 10 working days, you can withdraw your consent during this time. 

To provide customer support services 

For the performance of a contract. 

 

Other use         

  1. We may also keep and use your Personal Data to comply with our legal obligations, resolve disputes, and enforce our agreements. 
  2. We may access, use and preserve your Personal Data to comply with law, in anticipation of litigation, or to protect our rights or property or those of third parties, even if your Personal Data  is subject to a deletion request from you. We may also provide information to law enforcement or authorities to protect the safety of you, other users of our services or others.
  3. Sale, acquire, merger, or change of ownership. If we merge with another company, or our equity securities or all or a part of our assets are sold to a third party, your Personal Data may be transferred to the buyer or successor entity. We will notify you and other users of any transfer to a different legal entity.

 

7. Marketing and your Personal Data 

WE do NOT sell your Personal Information.

Marketing within the Collinson Group 

We are part of the Collinson Group. If you consent to receive marketing from other companies within the Collinson Group, we will share your Personal Data with these companies so they can send you information about their products and services and any news that may be of interest to you. Each entity will be a separate Controller for the marketing they send to you and will handle your Personal Data, and any opt outs as set out in their Privacy Notice on their website.

Third Party Marketing 

With your consent we may share your information with selected third parties and partners outside the Collinson Group for marketing purposes. If you consent, we will share your Personal Data with these partners and third parties. They will handle your Personal Data, and any opt outs as set out in their Privacy Notice on their website. 

Marketing on behalf of Third Parties 

With your consent we may send you updates and news about products and services on behalf of trusted third parties. When marketing on behalf of third parties all communications will come from us and we will not share your details with these carefully selected third parties for marketing purposes.

Opting out of Marketing   

Where you consent to receive communication for marketing purposes, you have the right to opt-out.  You can opt-out of receiving marketing communication from us at any time by following the opt-out links or options in any marketing messages sent to you or by contacting us any time at customerrelations@collinsongroup.com.

If you opt-out of marketing, you will stop receiving marketing from us within 8 days. Please note, this does not apply to service communication, market research or customer surveys or any other processing outside marketing.  

If opting out of marketing by post, please expect 8 days for the marketing to stop. 

 

Where you consent to receive marketing from our selected partners, third parties or companies within the Collinson Group we do not control the use of your Personal Data by these partners, third parties or Collinson companies. You should contact them directly to opt-out of receiving their marketing communications.

8. How we share your Personal Data 

We may share your Personal Data with the following types of companies (Controllers or Processors) for the reasons explained in section 6. 

 

Also, to help us deliver our services and provide the Covid test administration, we may share Personal Data with our medical practitioners who provide you with results of your Covid-19 test and analyse data from the Biotech laboratory. They will be under a duty of confidentiality and will handle your data securely. 

 

Companies (Processors) we will share your Personal Data with include:

  1. Our lab service providers. Prenetics, Igenomix, Circular one, Alpha bio labs, Nonacus
  2. Our providers who host our websites or platform such as Salesforce. 
  3. IT service providers, data disposal service providers and data storage service providers.
  4. Companies within the Collinson Group acting as our processor, to help us provide our services to you e.g. our customer service function to handle your enquiries.

 

If we share your Personal Data with our Processors, we will have contracts with them to make sure they keep your data safe in line with Data Protection Law and this Privacy Notice.  

 

Companies (Controllers) we will share your Personal Data with include: 

  1. Our payment service providers.
  2. Public Health England. We must inform you that COVID-19, the disease caused by infection with SARS-CoV-2, is classified as a NOTIFIABLE DISEASE by the government of the United Kingdom. Therefore, we or our testing laboratory providers have a legal obligation to report any results for COVID-19 testing to Public Health England. From 22nd November 2020, both positive and negative test results will be shared. As such, you should be aware that all results for your COVID-19 testing, your personal information that is in our possession, will be sent to Public Health England, along with your COVID-19 testing result status. Your data will be transferred to Public Health England using only the methods approved by the standard reporting protocols. Further details and information about notifiable diseases and reporting to Public Health England is available here. Further details on how Public Health England uses, discloses and processes all personal data we share with them can be found in its privacy notice here.
  3. Airline Carriers you are travelling with or the Airport where you have taken your test, for marketing purposes, where we have your consent. We may also share aggregated data or anonymised data for analytics or research purposes. No medical data identifying an individual will be shared. Please read the respective Airport and Airline Carrier’s Privacy Notice for information about how they will process your Personal Data.
  4. with American Airlines/ British Airways and Oneworld Management Company, as part of the Oneworld research Trial (a contract is in place outlining each party’s data protection obligations). Only applicable for participants on the Oneworld research trial.  
  5. Companies within the Collinson Group to offer you services or products, where we have your consent.
  6. Other third parties outside the Collinson Group to offer you services or products, where we have your consent.
  7. We may share your Personal Data with courts, law enforcement, and governmental authorities and other third parties if required by law, subpoena, a directive from a regulatory authority or as otherwise necessary to comply with legal requirements or to protect our rights or property or those of third parties. 

 

Where we share your Personal Data with a Controller, we comply with Data Protection Laws. As Controllers, they will also have their obligations under data protection law they must meet. 

If we have links to other sites promoting our partners and clients, please read their Privacy Notices on their website to see how they use your Personal Data. Our Privacy Notice will not cover their use of your Personal Data. 

9. International Transfer of your Personal Data

We may send your data to countries outside the UK and the EEA (transfers outside the EEA include transfers to the UK), where different data protection laws may apply.  These transfers will only happen when:

  • we use service provider companies outside the UK or EEA; 
  • there is a legal or regulatory obligation; or 
  • we have your consent. 

 

Where we transfer your data to a service provider company outside the UK or the EEA, we will implement safeguards so that your data continues to be protected. We protect your data by making sure:

  • the country has adequacy protection approved by the European Commission or UK; or
  • we conduct a security and data protection transfer assessment and implement measures and put an appropriate contract in place with approved UK or European Commission standard contractual clauses between the company and us. 

 

10. Retention of your Personal Data 

 

We will not keep your data for longer than we need to and will only use your data for the purposes outlined in this Privacy Notice. 

We may keep your data if we have a legal obligation to do so or to establish, exercise or defend a legal claim. In most circumstances, this means we will not keep your data for more than 7 years after the end of your relationship with us.

Your swab samples will be securely discarded immediately after testing. 

We will remove additional data we collect for the Oneworld research trial, e.g. your previous Covid status, from your profile shortly after we collect it, and we will anonymise it to not link it to you.  Only applicable for participants on the Oneworld research trial.  

 

 

11. Security of your Personal Data 

We use appropriate technical, organisational and administrative security measures to protect any information we hold in our records from loss, misuse, and unauthorised access, disclosure, alteration and destruction. We have written procedures and policies regularly audited, and the audits are reviewed at a senior level. 

12. Your rights under Applicable Data Protection Law   

 

Under Applicable Data Protection Law, you may have certain rights. The table below outlines your rights. If you would like to request to exercise your rights, please email customerrelations@collinsongroup.com.  Your request will be reviewed and responded to as quickly as possible.

  

 

Your rights:

Meaning:

The right to object to the processing

You have the right to object to the processing of your Personal Data in certain situations.

You have an absolute right to stop your Personal Data being used for direct marketing.

The right to information

You have the right to be informed whether and to what extent we process your data. E.g. this Privacy Notice  

The right of access

You have the right to request access to your Personal Data we hold. You also have the right to request a copy, and we will provide you with this unless legal exceptions apply. 

The right to rectification

If the Personal Data that we process is incomplete or incorrect, you have the right to request their completion or correction at any time.

The right to Erasure (also known as the “right to be forgotten”)

You have the right to request we delete your Personal Data.  

This is not an absolute right and only applies in certain circumstances, for example, we cannot delete information if there is a legal or regulatory obligation on us to keep it.

The right to restrict the processing

You have the right to request that we restrict the processing of your Personal Data in certain situations. 

The right to data portability

You have the right to request that we provide your Personal Data to you in a machine-readable format. 

 

This right can only be used where the processing relies on your consent or contract and is carried out by automated means.  

Your rights in relation to automated decision making and profiling

You have the right to object to decisions based exclusively on the automated processing of your Personal Data. 

 

We do not engage in profiling or any processing related to automated decision-making activity.

The right to withdraw your consent

If your Personal Data is processed based on your consent, you have the right to withdraw your consent at any time. 

 

If you withdraw your consent, this will not affect the lawfulness of how we used your personal data before you withdrew consent, and we will let you know if we can no longer provide you with your chosen service.

 

We will keep a copy of your request. Further, we may charge a reasonable fee or refuse to act on your request if such a request is excessive, repetitive or manifestly unfounded. 

 

If you make a request, where required, we will confirm your identity and ask you for more information to help us with your request. 

 

We have one month from receiving your request (provided we verify your identity and have enough information to locate your data) to respond. 

 

Please note that for a complex request, we may extend the one month by an additional two months. To exercise your rights please contact customerrelations@collinsongroup.com 

 

Making a complaint 

If you have any questions, concerns or complaints about this Privacy Notice, please contact privacycovid@collinsongroup.com 

If you are unsatisfied with our response, you can contact the UK’s Supervisory Authority, the Information Commissioner at: 

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire, United Kingdom
SK9 5AF

 Phone: 0303 123 1113 (local rate) or 01625 545 745 (national rate)

If located within the EU you can also make a complaint to our lead supervisory authority in Malta at:

Office of the Information and Data Protection Commissioner 

Floor 2, Airways House,
Triq Il-Kbira,
 Tas-Sliema SLM 1549,

Malta

 

13. About the Oneworld Research Trial 

 

Applicable to participants on the Oneworld Research Trial only

We use your Personal Data on behalf of OneWorld and the carriers (American Airlines or British Airways), under their instructions. In this case, we use your Personal Data, as a processor and either:

  1. British Airways and /Oneworld Management Company would be the joint controllers of your data if you flew with British Airways prior to your covid-19 testing; or 

 

  1. American Airlines and Oneworld Management Company /OMC would be the joint controllers of your data if you flew with American Airlines prior to your covid-19 testing.   

We are the processor strictly for the following data, which is only collected and used with your consent/explicit consent: 

  1. Covid-19 diagnosis before the Trial

 

 

14. Updates to the Privacy Notice  

We keep our Privacy Notice under regular review, and we will make new versions available on our Privacy Notice page on our website. This Privacy Notice was last updated 07/04/2021. 

 

 

15. Glossary 

 

Term 

Definition 

Applicable Data Protection Law  

means all applicable worldwide legislation and regulation relating to data protection and privacy including without limitation UK and European Applicable Data Protection Law, 

Controller 

is a person(s) or company (either alone or jointly or in common with other persons) who decides how Personal Data will be processed. 

Criminal Data 

Data about criminal proceedings or convictions. Criminal Data should be treated in the same way as Special Category Data.

Legitimate Interest 

Processing Personal Data for our activities and needs including providing you with the best service and experience we can offer. We will balance its interests against any possible impact on to you (both positive and negative), your rights or freedom. Where our interest and needs are overridden by your interests, rights or freedom, we will not process your Personal Data (unless you provide us with your consent or required by law). 

Personal Data 

Information relating to an identifiable living person, who can be directly or indirectly identified by reference to an identifier.

Privacy Notice

Also referred to as a Fair Processing Notice) or a Privacy Policy)– Privacy Notice is a document explaining to data subject what Personal Data is processed and how a company will process it

Processor 

is an external company or other third parties that collects and processes Personal Data on behalf of a Collinson. For the Oneworld Research trial – Collinson acts as a Processor. 

Special Category Data 

Also referred to as sensitive data, is defined as Personal Data relating to the following, race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health, sex life or sexual orientation.