Record of Processing Activities (RoPA)

Whose Data	Purpose & Activities	Type of data	Lawful basis for processing
Salon clients	To register new salon clients:
(a) Collect Identity, Contact & Marketing Preferences	(a) Identity
(b) Contact	(a) Performance of a contract with salon clients
(b) Necessary for our legitimate interests to recover debts owed to us
Salon clients	To process and deliver salon services including:
(a) Manage payments, fees and charges
(b) Send information
(c) Collect and recover money owed to us	(a) Identity
(b) Contact
(c) Financial
(d) Transaction	(a) Performance of a contract with salon clients
(b) Necessary for our legitimate interests to recover debts owed to us
Salon clients	To add salon clients to marketing lists:
(a) Record of email marketing preferences
(b) Record of postal marketing preferences	(a) Identity
(b) Contact
(c) Profile
(d) Marketing & Communications	(a) Where consent has been given (consent can be withdrawn at any time)
Salon clients	To manage our relationship with you which will include:
(a) Notification by email about changes to our terms or privacy policy
(b) Asking via email/SMS to leave a review or take a survey
(c) Notification by post/email/phone call about salon clients' regular stylists (e.g. promotion/maternity/return from maternity/departure)	(a) Identity
(b) Contact
(c) Profile	(a) Performance of a contract with salon clients
(b) Necessary to comply with a legal obligation
(c) Necessary for our legitimate interests to keep our records updated and to study how customers use our products/services
(d) Necessary for our legitimate interests to provide good customer service and maintain business performance
Salon clients	To reduce non-attendance of appointments:
(a) Send salon appointment confirmation and reminders via email/SMS
(b) Making phone calls to confirm attendance or enquire regarding non-attendance	(a) Identity
(b) Contact	(a) Necessary for our legitimate interests to provide good customer service and maintain business performance
Salon clients	Recording of salon client visit history:
(a) Colour formula record
(b) Salon clients' stylist preference
(c) Service and product history
(d) Analysis & reporting (anonymous)	(a) Identity
(b) Contact
(c) Financial
(d) Transaction	(a) Necessary for our legitimate interests to provide good customer service and maintain business performance
(b) Necessary for our legitimate interests to provide salon client safety
(c) Necessary for our legitimate interests to measure business performance
Salon clients	Providing hairdressing services to under-16 year olds	(a) Identity	(a) Necessary for our legitimate interests to maintain an appointment schedule. No contact information of under-16s is recorded, or parent/guardians contact data is taken in place
Salon clients, Website customers or any other potential customers	To enable you to partake in a prize draw, competition or complete a survey	(a) Identity
(b) Contact
(c) Profile
(d) Usage
(e) Marketing & Communications	(a) Performance of a contract with entrants
(b) Necessary for our legitimate interests to study how customers use our products/services, to develop them and grow our business
Salon clients & any other visitors	CCTV recording equipment on our premises	(a) Identity	For monitoring and security services. When necessary CCTV footage may be shared with the Police
Website customers	To process and deliver your website order, including:
(a) Manage payments, fees and charges
(b) Send ordered items to your delivery address
(c) Collect and recover money owed to us
(d) Analysis & reporting (anonymous)	(a) Identity
(b) Contact
(c) Financial
(d) Transaction	(a) Performance of a contract with website customers
(b) Necessary for our legitimate interests to recover debts owed to us
(c) Necessary for our legitimate interests to provide good customer service and maintain business performance
(d) Necessary for our legitimate interests to measure business performance
Website users & customers	To record login credentials for website customers that register accounts:
(a) Collect Identity, Contact & Marketing Preferences
(b) Recording website customer passwords (encrypted)	(a) Identity
(b) Contact
(c) Profile	(a) Necessary for our legitimate interests to provide good customer service
N.B. It is possible for website customers to purchase from collingeandco.com without having to create an account, and therefore no Profile data will be collected
Website users & customers	To manage our relationship with you which will include:
(a) Notifying you about changes to our terms or privacy policy
(b) Asking you to leave a review or take a survey	(a) Identity
(b) Contact
(c) Profile	(a) Performance of a contract with website users and customers
(b) Necessary to comply with a legal obligation
(c) Necessary for our legitimate interests to keep our records updated and to study how customers use our products/services
Website users & customers	To add website customers to marketing lists:
(a) Record of email marketing preferences
(b) Record of postal marketing preferences	(a) Identity
(b) Contact
(c) Profile
(d) Marketing & Communications	(a) Where consent has been given (consent can be withdrawn at any time)
Website users & customers	To inform or remind you by email of any incomplete website tasks, such as an abandoned basket	(a) Identity
(b) Contact
(c) Usage	(a) Necessary for our legitimate interests to improve the shopping experiences of our customers and grow our business
Website users & customers	To administer and protect our business and our site (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	(a) Identity
(b) Contact
(c) Technical	(a) Necessary for our legitimate interests for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise
(b) Necessary to comply with a legal obligation
Website users & customers	To deliver relevant content and advertisements to you and measure and understand the effectiveness of our advertising	(a) Identity
(b) Contact
(c) Profile
(d) Usage
(e) Marketing & Communications
(f) Technical	(a) Necessary for our legitimate interests to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy
Website users & customers	To use data analytics to improve our website, products/services, marketing, customer relationships and experiences	(a) Technical
(b) Usage	(a) Necessary for our legitimate interests to define types of customers for our products and services, to keep our site updated and relevant, to develop our business and to inform our marketing strategy
Website users & customers	To make suggestions and recommendations to you about goods or services that may be of interest to you	(a) Identity
(b) Contact
(c) Technical
(d) Usage
(e) Profile	(a) Necessary for our legitimate interests to develop our products/services and grow our business
Apprenticeship Applicants	To assess apprenticeship applications:
(a) To notify applicants of their applications
(b) To assess an applicants suitability
(c) To check applicants eligibility
(d) To meet business and government Equality & Diversity policy needs	(a) Identity
(b) Contact
(c) Education
(d) Learning Support
(e) Health Data
(f) Ethnicity Data
(g) Gender Data
(h) Nationality & Residency status	(a) Performance of a contract with apprentices & employers
(b) To comply with a legal or regulatory obligation
(c) Necessary for our legitimate interests to provide a good service to employers & apprentices
Apprentices	To store apprentice learning records:
(a) To provide evidence of learning
(b) To contact apprentices in case of any changes to their training schedule
(c) To contact apprentices on completion of their training to record their employment or education status	(a) Identity
(b) Contact
(c) Education
(d) Learning Support
(e) Health Data
(f) Ethnicity Data
(g) Gender Data
(h) Nationality & Residency status	(a) Performance of a contract with apprentices & employers
(b) To comply with a legal or regulatory obligation
(c) Necessary for our legitimate interests to provide a good service to employers & apprentices
Apprentices	To support apprentices whilst on programme:
(a) To provide adequate Health & Safety cover
(b) To provide personalised learning plans
(c) To provide individual learning support	(a) Identity
(b) Contact
(c) Learning Support
(d) Health Data
(e) Ethnicity Data
(f) Gender Data	(a) Performance of a contract with apprentices & employers
(b) To comply with a legal or regulatory obligation
Apprentices	To monitor apprentices' progress whilst on programme:
(a) Lesson planning
(b) To provide login credentials to our e-portfolio platform
(c) Analysis & Reporting (anonymised)
(d) To share apprenticeship progress with apprentices and employers	(a) Identity
(b) Contact
(c) Profile
(d) Education
(e) Learning Support
(f) Health Data
(g) Ethnicity Data
(h) Gender Data	(a) Performance of a contract with apprentices & employers
(b) To comply with a legal or regulatory obligation
Apprentices	To claim funding for apprenticeship programmes:
(a) Sending apprentice lists including apprentice personal data and sensitive personal data to the DWP (previously the ESFA) for the purposes of claiming funding for apprenticeships	(a) Identity
(b) Contact
(c) Education
(d) Learning Support
(e) Health Data
(f) Ethnicity Data
(g) Gender Data	(a) Performance of a contract with apprentices, employers and the DWP (previously the ESFA)
(b) To comply with a legal or regulatory obligation
Apprentices	To meet Safeguarding & Prevent initiatives	(a) Identity
(b) Contact
(c) Technical
(d) Usage
(e) Profile	(a) Necessary for our legitimate interests to protect apprentices/learners
(b) To comply with a legal or regulatory obligation
Apprentices	To record apprentices' progress post programme:
(a) To analyse programme performance
(b) To share apprentices' Destination Data evidence with the DWP (previously the ESFA) and Ofsted	(a) Identity
(b) Contact
(c) Career	(a) Performance of a contract with the DWP (previously the ESFA)
(b) To comply with a legal or regulatory obligation with the DWP (previously the ESFA) and Ofsted
(c) Necessary for our legitimate interests to provide a good service to employers & apprentices
Employers of apprentices	To process and deliver employer training services including:
(a) Manage payments, fees and charges
(b) Collect and recover money owed to us
(c) To pay funding eligible to employers of 16-18 year-old apprentices	(a) Identity
(b) Contact
(c) Financial
(d) Transaction
(e) Marketing & Communications	(a) Performance of a contract with employers of apprentices
(b) Necessary for our legitimate interests to recover debts owed to us
Employers of apprentices	To manage our relationship with employers of apprentices which will include:
(a) Notifying you about changes to our terms, contract of services or privacy policy
(b) Asking you to leave a review or take a survey
(c) To send out newsletters by post or email	(a) Identity
(b) Contact
(c) Profile
(d) Marketing & Communications	(a) Performance of a contract with employers of apprentices
(b) Necessary to comply with a legal obligation
(c) Necessary for our legitimate interests to keep our records updated and to study how customers use our services
Employers of apprentices	To inform employers of apprentices with recruitment updates of apprenticeship applicants	(a) Identity
(b) Contact	(a) Performance of a contract with employers of apprentices
Employers of apprentices	To update employers of apprentices: (a) Updates of their apprentice's apprenticeship progress
(b) To provide login credentials to our e-portfolio platform
(c) To contact employers of apprentices with training schedule changes	(a) Identity
(b) Contact
(c) Profile	(a) Performance of a contract with employers of apprentices
(b) Necessary for our legitimate interests to provide a good service to employers & apprentices
Employees of Collinge & Co	The storage of employee personnel files:
(a) To make salary payments
(b) To fulfill SSP and SMP regulations
(c) To follow the company's Disciplinary & Grievance Procedures
(d) To be able to make pension payments
(e) To be able to make NI contributions
(f) To comply with H&S legislation and good H&S practice
(f) To fulfil the Terms & Conditions of employment contracts and statutory employment legislation
(g) To carry out DBS checks for employees taking part in regulated activity
(h) Proof of the right to work in the UK	(a) Identity
(b) Contact
(c) Profile
(d) Financial
(e) Health
(f) Education
(g) Nationality or visa status	(a) Performance of a contract with employees
(b) To comply with a legal or regulatory obligation
(c) Necessary for our legitimate interests to follow good employment practices
(c) Necessary for our legitimate interests to follow good business practices and provide good customer service
Employees of Collinge & Co and their nominated emergency contacts	To store emergency contact information	(a) Identity
(b) Contact	(a) Necessary for our legitimate interests to protect the safety and welfare of our employees
Employees of Collinge & Co	To make available the online staff handbook	(a) Identity
(b) Contact
(c) Profile	(a) Performance of a contract with employees
(b) To comply with a legal or regulatory obligation
(c) Necessary for our legitimate interests to share business practices
Applicants for employment with Collinge & Co	To assess applications:
(a) To notify applicants of their applications
(b) To assess an applicants suitability	(a) Identity
(b) Contact
(c) Education
(d) Health Data
(e) Ethnicity Data
(f) Gender Data	(a) Necessary for our legitimate interests to recruit applicants best suited to job descriptions
(b) To comply with a legal or regulatory obligation N.B. It is likely applicants will disclose types of data not requested or required for assessment

The table above outlines how and what the company uses Personal Data for, stating:

Whose data is being processed;
What activity and purpose the data is used for;
What types of personal data are processed; and
On what lawful basis the data is processed.

Personal Data should not be processed for any other activity or purpose than stated in the RoPA. If a new activity or purpose is needed, it must be signed off by the Data Compliance Officer and added to the RoPA.

The RoPA is accessible via the Collinge & Co Website Privacy Policy (on collingeandco.com) and the Collinge & Co Data Protection Policy.

Policy Review

</aside>