Privacy Notice 


  1. Welcome 
  2. About Us 
  3. Contact Details 
  4. Our Global Presence 
  5. Personal Information we collect about you 
  6. How we use your Personal Data
  7. Marketing and your Personal Data 
  8. How we share your Personal Data 
  9. Transferring your Personal Data outside Europe 
  10. Retention of your Personal Data 
  11. Security of your Personal Data 
  12. Your rights under Applicable Data Protection Law  
  13. Updates to the Privacy Notice 
  14. Glossary 

 

1. Welcome 

Welcome to our privacy notice (“Privacy Notice”), at Collinson Assistance Services Limited ("we, us, our,"). We respect and commit to protecting our customers’ (“you”) and associated persons’ Personal Data and privacy.  This Privacy Notice, together with our Terms and Conditions aims to inform both passengers on arrival and departure how we collect, use, store, share and look after your Personal Data: 

 

  1. When you interact or use our website to register and book for Covid-19 Testing, or 
  2. If you use any of our products, services and or applications (together “services”). 

 

To help with working your way through this Privacy Notice, we have separate it into sections to provide an outline of the full Privacy Notice and the choice to select the section you would like to read in detail. We have also included a Glossary at the end of the Privacy Notice for some terms used (highlighted in bold).        

                                                                                                                                                                                                                                                                                                                                                                                       

2. About Us 

Collinson Assistance Services Limited, is a company registered in England and Wales with company number 11908215 and offices in Cutlers Exchange, 123 Houndsditch, London, EC3A 7BU, United Kingdom, and a subsidiary of The Collinson Group Limited (the “Collinson Group”).

Under Applicable Data Protection Law, we are the Controller of the Personal Data we process.

 

 

 

Applicable to participants on the Oneworld Research Trial only

In circumstances where we process personal data on behalf of OneWorld and the carriers (American Airlines or British Airways) for those data elements we will carry out such processing only in accordance with their instructions. In processing such personal data, we will be the processor and either:

a)         British Airways and /Oneworld Management Company will be the joint data controllers if your flight prior to the test we conducted under the testing trial was with British Airways; or 

b)         American Airlines and Oneworld Management Company /OMC as joint data controllers if your flight prior to the test we conducted under the testing trial was with American Airlines as joint data controllers.  

This is only applicable for the collection of the following optionally provided data which is collected based on consent/explicit consent (as applicable): 

  1. Covid-19 diagnosis prior to the Trial
  2. Ethnicity 
  3. Salary Range
  4. Occupation 

 

3. Contact Details 

The Collinson Group has appointed a Group Data Protection Officer (“DPO”). If you have any questions about this Privacy Notice  or would like to know how we handle your Personal Data under data protection law, please contact the DPO or the Data Protection Team by post at The Data Protection Officer, Culters Exchange,123 Houndsditch, London , EC3A 7BU or by email at data.protection@collinsongroup.com 

 

4. Our Global Presence  

As a company with a global presence, we are subject to the varying requirements of data protection and privacy regulation and legislation in jurisdictions we operate. We aim to be as consistent as possible and obey all applicable laws and apply the highest standard of data protection and privacy laws to our approach. For example, if you are in the EU, we are bound by EU local laws, including the General Data Protection Regulation (GDPR). 

 

5. Personal Data we collect about you.

Any pre-existing medical conditions or concerns such as vulnerabilities can be discussed with the nurse at the location. Please note the data provided will only be used to provide direct care and it will always remain confidential. Where we need your medical consent to provide you with care, this will be obtained from you at the relevant time

 

We will collect Personal Data about you from:   

  • You e.g. when interacting with us, either online or via email, mobile, phone or post, or in person and you provide us with your details for a Covid-19 test.
  • your devices e.g. when you connect to our Website, use our Website.  
  • through cookies we use on our Websites to secure our Website, offer you personalised experiences. 
  • From airlines [GB1] 
  • From Oneworld as part of the research trial to allow us to register and track participants. (For participants on the research trial only)

Each test option will require slightly different details. The Personal Data we may need from you are outlined in the table below.  

Purpose 

Type of Personal Data 

Data collected to register and take the test  

Name, email address, telephone number, mobile number, address 

your customer username or number, password, Sample number, 

Passport number, nationality 

Payment method used, credit and debit card, bank details

Any Personal Data you provide us when you contact us. We also record your calls with us.  We collect and store all copies of emails sent. 

Medical data that directly relate or may prevent you from undertaking the Covid-19 testing.

Test method (e.g. PCR)

PCR test result (i.e. COVID-19 +ve/-ve)

Genetic data (genetic swabs) 

 

Sample taken date

Sample type

Result date

Name of laboratory

Device details: Traffic information, IP address, time of access, date of access, location, web pages visited, device identifiers.

Website use data. Please see our cookie policy.

Specific data required from Passengers arriving to the UK

Sex

Date of birth 

NHS number (if known and applicable)

Ethnicity 

Date of arrival to UK

Coach number

Flight number 

Vessel name (as appropriate)

 

Date on which you last departed from or transited through a non-exempt country or territory, or a non-exempt region of a country or territory ‒ a destination not on the travel corridors list.

 

The country or territory you travelled from when you arrived in the UK, and any country or territory you transited through as part of that journey.

 

Research Data (data collected specifically for the Oneworld research trial)

Ethnicity

Previous Covid-19 diagnosis

Salary Band

Occupation 

 

Collection of this additional data is voluntarily; the data will be removed from your profile within 10 days and anonymised before it will be used for research. For We collect this data only on behalf of Oneworld, as a Processor. 

 

Marketing and Advertising Purpose

Your marketing preferences and responses to our direct marketing, e.g. when and if you have open, read and deleted our marketing emails, links clicked in marketing emails.

 

If the parent or guardian has granted consent, we will undertake a Covid-19 testing on your child. 


6. How we use your Personal Data

 We will use your Personal Data in the following circumstances: 

  •  
  • For a Legitimate Interest (or those of a third party), only when your rights and freedoms do not override our legitimate interest. Our legitimate interest, to help us improve our services and products and to obtain feedback from you. 
  • For the performance of a contract (Terms and condition – to allow us to carry out the test) 
  • to comply with a legal and regulatory obligation.
  • Consent:
    1. for direct marketing from Collinson or a third party 
    2. to collect data specifically for the research trial on behalf of Oneworld (Covid-19 diagnosis prior to the trial, ethnicity, salary range, occupation, once collected we will anonymise this information within 10 working days, you can withdraw your consent during this time). Only applicable for participants on the Oneworld research trial. 

 

Special Category Data is processed under the additional legal basis: 

  • to comply with our legal obligation.
  • Necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health.
  • Explicit consent for the collection of special category data on behalf of Oneworld specifically for the research trials (Covid-19 diagnosis prior to the trial and ethnicity, once collected we will anonymise this information within 10 working days, you can withdraw your consent during this time). Only applicable for participants on the Oneworld research trial.  

 

 

 

The information is only used for the purpose of testing for Covid-19 and or where applicable for the Oneworld research trial . The table outlines the lawful basis we can rely on to process your Personal Data.  

 

What we use your information for

We rely on the Controllers legal basis

Confirming the appointment to the regional test site

 

For the performance of a contract

Performing a security and ID verification at the regional test site

For the performance of a contract

Performing your test 

For the performance of a contract 

 

To process payment for the test 

For the performance of a contract

Receiving and processing your test

For the performance of a contract

Sharing all results with Public Health England (if you live in England) to help plan and respond to COVID-19

 

To comply with our legal obligations

 

 

Necessary for reasons of public interest in the area of public health, such as protecting against   serious cross-border threats to health.

 

 

As of 22 November, both positive and negative test results will be shared.

Provide access to Covid-19 Test results

For the performance of a contract

Respond to any enquiries from you regarding our service

For the performance of a contract

Where we share your personal data and sensitive personal data with regulators and governmental agencies. 

To comply with our legal obligations

 

Necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health.

To provide you with information about certain other goods and services which we believe may be of interest to you from us or trusted third parties. 

Where we have your consent.

To provide you with access to our website and or our mobile app.

For the performance of a contract

To receive feedback from you to help us improve on our product services 

Legitimate Interest to help understand how we can improve our services 

To collect data specifically for the research trials on behalf of Oneworld (Covid-19 diagnosis prior to the trial, ethnicity, salary range, occupation). Only applicable for participants on the Oneworld research trial.  

 

Where we have your consent. 

 

Where we collect ethnicity data and your Covid-19 diagnosis prior to the trial, we require your explicit consent. You can voluntarily provide us this information. 

 

Once collected we will anonymise this information within 10 working days, you can withdraw your consent during this time. 

To provide customer support services 

For the performance of a contract. 

 

Other use 

We may still use aggregated and anonymised Personal Data that does not identify any individual for analysis to support operational decisions, to improve the full end-to-end testing process or for research purposes. We may also retain and use your information as necessary, for example, to comply with our legal obligations, resolve disputes, and enforce our agreements. 

We may provide Personal Data to courts, law enforcement, and governmental authorities and other third parties if required by law, subpoena, directive from a regulatory authority or as otherwise necessary to comply with legal requirements or to protect our rights or property or those of third parties. We may access, use and preserve data to comply with law, in anticipation of litigation, or to protect our rights or property or those of third parties, even if the data is subject to a deletion request from you. We may also provide information to law enforcement or authorities to protect the safety of users our services or others.

Sale, acquire, merger, or change of ownership. If we merge with another company, or our equity securities or all or a part of our assets are sold to a third party, your Personal Data may be transferred to the buyer or successor entity. We will notify all users of any transfer to a different legal entity.

7. Marketing and your Personal Data 

WE do NOT sell your Personal Information.

Marketing within the Collinson Group 

We are part of the Collinson Group, if you have provided your consent to receive marketing from other companies within the Collinson Group. We will share Personal Data with those companies to allow them to send you information about their current services and news that may be of interest to you, each entity will be a separate controller for the marketing they send to you. 

Third Party Marketing 

Before sharing your information with third parties outside the Collinson Group for marketing purposes, you will need to consent and opt-in to receiving marketing communication from selected partners and third parties. Where you have consented and opted-in, your Personal Data will be shared with these partners and third parties and will be handled under their Privacy Notice on their website. 

Opting out of Marketing   

Where you consent to receive communication for marketing purposes, you have the right to opt-out.  You can opt-out of receiving marketing communication at any time by following the opt-out links or option in any marketing messages sent to you or by contacting us any time at passenger.testing@collinsongroup.com  

If you opt-out of marketing, you will stop receiving marketing from us within 8 days. Please note, this does not apply to service communication, market research or customer surveys or any other processing outside marketing.  

If opting out of marketing by post, please expect 8 days for the marketing to stop. 

Where you consented to receive marketing from our selected partners or third parties, we do not control the use of your Personal Data by these partners and third parties. You should contact them directly to opt-out of receiving their marketing communications.


8. How we share your Personal Data 

We may share your Personal Data with the following categories of third parties, which may be Controllers or Processors in respect of your Personal Data, for the purposes explained in section 6. 

In addition, to help us deliver our services and provide the administration of the Covid test we may share Personal Data with our medical practitioners who provide you with results of your Covid-19 test and analyse data from the Biotech laboratory. They will be under a duty of confidentiality and will handle your data securely. 

 

Processors we will also share Personal Data with include:

  1. Our lab service providers.
  2. Our providers who host our websites or platform such as Salesforce. 
  3. IT service providers, data disposal service providers and data storage service providers.
  4. Companies within the Collinson Group acting as our processor, to help us provide our services to you e.g. our customer service function to handle your enquiries.

 

Where we share your Personal Data with our Processors, we will enter into contracts with them to ensure they also protect your Personal Data in line with Applicable Data Protection Law and to this Privacy Notice.  

 

Controllers we will also share Personal Data with include: 

  1. Our payment service providers.
  2. Public Health England (an independent Controller of your data). We must inform you that COVID-19, the disease caused by infection with SARS-CoV-2, is classified as a NOTIFIABLE DISEASE by the government of the United Kingdom. Therefore, we or our testing laboratory providers have a legal obligation to report any results for COVID-19 testing to Public Health England. From 22nd November both positive and negative test results will be shared. As such, you should be aware that all results for your COVID-19 testing, your personal information that is in our possession, will be sent to Public Health England, along with your COVID-19 testing result status. Your data will be transferred to Public Health England using only the methods approved by the standard reporting protocols. Further details and information about notifiable diseases and reporting to Public Health England is available here. Further details on how Public Health England uses, discloses and processes all personal data we share with them can be found in its privacy notice, here.
  3. Airline Carriers you are travelling with or the Airport where you have taken your test, for marketing purposes, where we have your consent. We may also share aggregated data or anonymised data for analytics or research purposes. No medical data identifying an individual will be shared. Please read the respective Airport and Airline Carrier’s Privacy Notice for information about how they will process your Personal Data
  4. with American Airlines/ British Airways and Oneworld Management Company, as part of the Oneworld research Trial (a contract is in place outlining each party’s data protection obligations). Only applicable for participants on the Oneworld research trial.  
  5. Companies within the Collinson Group acting as an independent Controller, to offer you services or products, where we have your consent.

 

Please note where we have shared your Personal Data with a Controller, we have done so in compliance with data protection laws, as Controllers they will have their own obligations under data protection law that they must comply with. 

Where we have links to other sites promoting our partners and clients. Please read their Privacy Notices available on their website to find out how they process Personal Data. This Privacy Notice will not cover their use of Personal Data. 

9. International Transfer of your Personal Data

As per section 7, some of the third parties are in a country outside the European Economic Area (EEA) or where different data privacy laws apply. Therefore, where we will transfer your Personal Data from the UK or within the EEA to outside the EEA, we will ensure it is sent securely and protected by only transferring where;  

  • there is a legal or regulatory obligation reason to do so;
  • the European Commission’s considers the country where the company resides provides an adequate level of protection for your Personal Data; 
  • there is an appropriate contract in place with approved European Commission standard contractual clauses between us and the company; or 
  • there is consent from you. 

 

10. Retention of your Personal Data 

 

We will not keep your Personal Data for longer than is necessary. Please note Personal Data may be retained if there is a legal obligation to keep the information or your personal data would be used for the establishment, exercise or defence of legal claims (Article 9(2)(f)) (the "Legal Claims Derogation").

Your swab samples will be discarded immediately after the testing have been conducted. 

Covid testing result data will be kept for 10 working days from the date of testing to deletion.

Your profile data, including your contact and registration data will be kept for one year. 

Data solely collected for the Oneworld research purposes – previous Covid status, salary band and occupation will be removed from your profile shortly after collection and anonymised. It will not be linked to you. Please note Ethnicity data will be collected and remain on all profiles from the 1st January as required by Public Heath England. Please visit here for more details 

 

Where we retain your Personal Data for analytics and research purposes. Such data will be deleted after the analytics or research purpose has been completed and no longer required. 

If you opt-out of receiving marketing, some Personal Data will be retained and added to our suppression list to ensure we do not market to you again. 

 

11. Security of your Personal Data 

We use appropriate technical, organisational and administrative security measures to protect any information we hold in our records from loss, misuse, and unauthorised access, disclosure, alteration and destruction. We have written procedures and policies regularly audited, and the audits are reviewed at a senior level. 

12. Your rights under Applicable Data Protection Law  

 

Under Applicable Data Protection Law, you may have certain rights. The table below outlines your rights. If you would like to request to exercise your rights, please email passenger.testing@collinsongroup.com.  Your request will be reviewed and responded to as quickly as possible.

  

 

Your rights:

Meaning:

The right to object to the processing

You have the right to object to the processing of your Personal Data in certain situations.

You have an absolute right to stop your Personal Data being used for direct marketing.

The right to information

You have the right to be informed whether and to what extent we process your data. E.g. this Privacy Notice  

The right of access

You have the right to request access to your Personal Data we hold. You also have the right to request a copy, and we will provide you with this unless legal exceptions apply. 

The right to rectification

If the Personal Data that we process is incomplete or incorrect, you have the right to request their completion or correction at any time.

The right to Erasure (also known as the “right to be forgotten”)

You have the right to request we delete your Personal Data.  

This is not an absolute right and only applies in certain circumstances, for example, we cannot delete information if there is a legal or regulatory obligation on us to keep it.

The right to restrict the processing

You have the right to request that we restrict the processing of your Personal Data in certain situations. 

The right to data portability

You have the right to request that we provide your Personal Data to you in a machine-readable format. 

 

This right can only be used where the processing relies on your consent or contract and is carried out by automated means.  

Your rights in relation to automated decision making and profiling

You have the right to object to decisions based exclusively on the automated processing of your Personal Data. 

 

We do not engage in profiling or any processing related to automated decision-making activity.

The right to withdraw your consent

If your Personal Data is processed based on your consent, you have the right to withdraw your consent at any time. 

 

If you withdraw your consent, this will not affect the lawfulness of how we used your personal data before you withdrew consent, and we will let you know if we can no longer provide you with your chosen service.

 

We will keep a copy of any request. Further, we may charge a reasonable fee or refuse to act on a request if such a request is excessive, repetitive or manifestly unfounded. 

If you make a request, where required, we will confirm your identity and ask you to provide us with information to help us deal with your request. We have one month from receiving your request (provided we have verified your identity) to respond. 

Please note that for a complex request, we may extend the one month by two months. To exercise your rights please contact passenger.testing@collinsongroup.com  

 

Making a complaint 

If you have any questions, concerns or complaints about this Privacy Notice, please contact our Data Protection Team and or our Data Protection Officer at data.protection@collinsongroup.com

If you are unsatisfied with our response, you can contact the UK’s Supervisory Authority, the Information Commissioner at: 

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire, United Kingdom
SK9 5AF

 Phone: 0303 123 1113 (local rate) or 01625 545 745 (national rate)

You can also make complaint to your local privacy supervisory authority where: 

  • you reside;
  • you work; or
  • the matter you are complaining about took place.

 

13. Updates to the Privacy Notice  

We keep our Privacy Notice under regular review, and we will make new versions available on our Privacy Notice page on our website. This Privacy Notice was last updated on 13 November 2020. 

 

14. Glossary 

 

Term 

Definition 

Applicable Data Protection Law  

means all applicable worldwide legislation and regulation relating to data protection and privacy including without limitation UK and European Applicable Data Protection Law, 

Controller 

is a person(s) or company (either alone or jointly or in common with other persons) who decides how Personal Data will be processed. 

Criminal Data 

Data about criminal proceedings or convictions. Criminal Data should be treated in the same way as Special Category Data.

Legitimate Interest 

Processing Personal Data for our activities and needs including providing you with the best service and experience we can offer. We will balance its interests against any possible impact on to you (both positive and negative), your rights or freedom. Where our interest and needs are overridden by your interests, rights or freedom, we will not process your Personal Data (unless you provide us with your consent or required by law). 

Personal Data 

Information relating to an identifiable living person, who can be directly or indirectly identified by reference to an identifier.

Privacy Notice

Also referred to as a Fair Processing Notice) or a Privacy Policy)– Privacy Notice is a document explaining to data subject what Personal Data is processed and how a company will process it

Processor 

is an external company or other third parties that collects and processes Personal Data on behalf of a Collinson. 

Special Category Data 

Also referred to as sensitive data, is defined as Personal Data relating to the following, race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health, sex life or sexual orientation.