A school trip runs on personal information. Consent forms, medical needs, dietary requirements, emergency contacts, passport details. Most of it is sensitive, much of it concerns children, and it often passes between the school, the travel provider and suppliers in several countries.
Parents are right to ask what happens to it. Here is how it should be handled, and how we handle it at BFC.
Collect only what the journey needs
Data protection starts with not collecting more than you need. For most trips, that means consents, medical and dietary information, emergency contacts and, for travel abroad, passport details. If a piece of information does not help keep students safe or make the journey work, it should not be asked for.
Know who is responsible
Under the UK and EU General Data Protection Regulation (GDPR), someone has to be responsible for each use of personal data. For most school trips, the school decides what is collected and why, so it acts as the controller. A travel provider like BFC usually acts as a processor, handling the data on the school’s instructions. We offer schools a data processing agreement that sets this out.
Share it only with the people who need it
A hotel needs a rooming list. An activity provider may need to know about a medical condition. Neither needs everything. Information should be shared on a need-to-know basis, securely, and never by unprotected email attachments where it can be avoided.
At BFC, trip information is held on Ildána, our school trip platform, where it is seen only by the people who need it for the journey.
Delete it when it is no longer needed
Keeping data “just in case” is a risk in itself. Our approach is simple:
- Medical details are deleted after the trip, unless there was an incident that needs a record.
- Enquiries that do not become bookings are deleted within two years.
- Requests from parents or students to see or correct their data are answered within one month.
Questions to ask any travel provider
- What data do you need from us, and why?
- Where is it stored, and who can see it?
- Which suppliers will receive it, and in which countries?
- When will it be deleted?
- Will you sign a data processing agreement with us?
Good answers should be quick and specific. You can read exactly how we handle personal information in our privacy policy.
Planning a journey? Tell us what you want students to learn and we’ll design the trip around it. Start your brief.