Holiday Activities and Food Programme (HAF) privacy notice

Last updated: November 2025 

What this notice is about 

This notice explains how we use your information for the Holiday Activities and Food (HAF) programme.  

The HAF programme is funded by the Department for Education and provides activities and healthy food for children aged 5–16 (including 4-year-olds in reception at Islington schools) who are eligible for free school meals or have other vulnerabilities, including those who have an Educational Health and Care Plan, an allocated Social Worker or Family Support Practitioner, or who are known to other targeted and specialist support services.  This notice explains how we process your personal data when you engage with this programme. 

You should also read our Children’s Services privacy notice and main privacy notice, which gives more details about your rights and how to contact us.  

What information we collect, hold and use 

We collect your information so children, young people and families can take part in the Holiday Activities and Food programme. 

When you apply, we collect: 

• personal information, such as name, date of birth and address 
• school name 
• characteristics, such as gender and ethnicity 
• vulnerability status, Special Educational Needs or Disabilities (SEND) status, Free School Meal status  
• allergies and dietary requirements 
• number of days you attend the programme.

We also work with and collect information from other places, such as: 

• the council’s internal systems and records 
• Holiday Activities and Food programme providers. 

Where we get your information from 

We get information from: 

• you provide it to us 
• other council departments 
• schools and HAF programme providers.

How we use this information 

We use your information to check if you are eligible.  We also use it to organise and run the programme, and to report to funders. 

Our legal reasons for processing (using) your data 

Under UK General Data Protection Regulations (UK GDPR), the Data Protection Act 2018 (DPA 2018) and the Data Use and Access Act 2025 (DUAA 2025) we use your data because: 

• we are doing something in the public interest or as part of our official duties (public task) 
• in other situations where you give your consent (you say that we can).

For special category (sensitive) data, such as information about your health, ethnicity, or SEND status, we rely on: 

• Article 9(2)(g) – Substantial public interest: supported by the Data Protection Act 2018, Schedule 1, Part 2 (e.g. safeguarding of children and individuals at risk). 
• Article 9(2)(h) – Provision of health or social care: where the data is needed to manage dietary needs or support children with SEND. 
• Article 9(2)(c) – Vital interests: where processing is necessary to protect someone’s life or prevent serious harm. 

Other laws that apply to our services 

The other laws that apply are:

• Section 31 Grant Determination for the Holiday Activities and Food programme 2022 
• Local Government Act 2003 
• Childcare Act 2006 
• Education Act 1996. 

Who we share your information with 

Your information will be shared with the following organisations: 

• the Department for Education 
• other council departments 
• relevant Holiday Activities and Food programme providers. 

How we store your data 

We keep your information safe and only let staff who need it see it. 

To find out how long we keep your data, check our main privacy notice and retention schedule. 

Your rights

You have rights over your personal data. For more details see our main privacy notice and the page about your individual rights.  

Complaints 

If you are unhappy with how we use your data, please see the council’s main privacy notice to find out how to make a complaint.