TripPA Subject Access Request (SAR) Policy

Last updated: 4th May 2025

TripPA Ltd (“we”, “us”, “our”) is committed to protecting and respecting your privacy.
 This Subject Access Request (SAR) Policy outlines how we handle requests for access to personal data under the UK General Data Protection Regulation (UK GDPR).

Under the UK GDPR, individuals (referred to as “data subjects”) have the right to access their personal data that we hold. This policy explains how you can request access to that data and how we will respond.

A Subject Access Request (SAR) is a request from an individual for a copy of the personal data that we hold about them. Data subjects have the right to request the following:

  • Confirmation that we are processing their personal data.
  • Access to their personal data.
  • Information about the purposes of processing, the categories of data concerned, the recipients of the data, and the retention period (or criteria used to determine it).

1. Data Controller and Data Processor Roles

TripPA acts as both a data processor and data controller depending on the type of user:

  • For Users from Subscribing Schools:
    • Data Controller: The Subscribing School (the organisation that collects and owns the student data) is the data controller.
    • Data Processor: TripPA is the data processor for personal data provided by the Subscribing School. As a data processor, we are responsible for assisting the Subscribing School in fulfilling Subject Access Requests (SARs) from parents, students, and school staff regarding their personal data entered into the platform.
  • For Trial Users (Using Sample Student Data):
    • Data Controller: TripPA is the data controller for any personal data provided by individuals during the trial account creation (e.g., name, email, etc.).
    • If you are a trial user, any SAR you submit will be handled directly by TripPA, as we control and process the data associated with trial accounts.
  • For Website Users (Cookies):
    • Data Controller: TripPA is the data controller for any data collected via cookies on our website. If you wish to request information related to your browsing activities or data collected through cookies, please refer to our Cookie Policy at https://trippa.net/cookie-policy-uk/ for more information on how we handle such data.
  • For Newsletter Subscribers:
    • Data Controller: TripPA is the data controller for any personal data (e.g., name, email address, location) collected when you subscribe to our newsletter. If you are a newsletter subscriber, you can submit a SAR to request the data we hold about you, including any details of newsletter interactions and preferences.

2. Making a Subject Access Request

If you are a trial user, newsletter subscriber, and would like to make a Subject Access Request to access your personal data, please send a written request to the following contact details:

You should provide the following information to help us locate your data:

  • Your full name
  • Details of the information you are requesting
  • Your user type (e.g., subscribing school member, trial user, etc.)

If you are a user from a Subscribing School, please reach out to the relevant school contact for SAR requests regarding student or staff data. As TripPA is the data processor for users from Subscribing Schools, we will refer any SAR received directly to the Subscribing School.

3. Responding to a SAR

For Subscribing Schools:

  • As a data processor, TripPA will assist the school (data controller) in fulfilling the SAR by providing access to data processed by TripPA within the platform, as required.
  • The school is responsible for responding to the SAR, as it owns and controls the student and staff data within the platform.
  • TripPA will collaborate with the school to fulfill your request promptly and in compliance with the GDPR.

For Trial Users:

  • As the data controller, TripPA is responsible for processing SARs made by trial users related to personal data provided during the trial account setup.
  • TripPA will respond directly to your SAR within 30 calendar days (or sooner if required by law).
  • We will provide the personal data we hold about you during the trial period (e.g., name, email address, account activity), or inform you if we hold no relevant data.

For Website Users (Cookies):

  • If you are a website user wishing to request information related to cookies or data collected through cookies, we will process your request in accordance with our Cookie Policy. You can request access to the data collected via cookies by contacting us directly.

For Newsletter Subscribers:

  • As the data controller, TripPA will respond directly to your SAR and provide access to any personal data we hold about you, including name, email address, location, and interactions with our newsletter content.
  • We will also comply with any request for deletion of your data in accordance with the GDPR.

4. Timeframe for Response

We will respond to all valid SARs within 30 calendar days of receiving the request. If the request is complex or numerous, we may extend this period by an additional two months and will notify you of the extension.

5. Data Deletion Requests

If you wish to request that your personal data be deleted:

  • For Users from Subscribing Schools: Deletion requests for personal data related to students or staff will be handled by the school (data controller), and TripPA will assist in deleting or providing access to the relevant data, as necessary.
  • For Trial Users or Newsletter Subscribers: You can request the deletion of your personal data directly from TripPA, and we will comply with the request in accordance with the GDPR.

For further information on Account and Data Deletion see trippa.net/request-account-and-data-deletion-for-trippa.

6. Exemptions and Limitations

In some cases, we may not be able to fulfill your request due to legal exemptions under the GDPR. These may include, but are not limited to:

  • If the request is manifestly unfounded or excessive.
  • If fulfilling the request would infringe on the rights of others (e.g., the right to confidentiality or intellectual property).
  • If the personal data is subject to legal obligations or ongoing legal proceedings.

7. Data We May Hold

We may hold various types of personal data depending on your interactions with TripPA, such as:

  • Account details (name, email address, role within the school, etc.).
  • Usage data related to how you interact with the TripPA app or website.
  • Trip planning and event data for school trips (if you are a teacher or school staff member).
  • Communication records (emails, support queries, etc.).

8. How We Will Provide Your Data

If we fulfil your SAR, we will provide your data in a commonly used, machine-readable format (such as CSV, PDF, or similar). In most cases, we will provide the data electronically, unless you request otherwise.

If you are entitled to a copy of the data, we will send it via email or post, as requested.

9. Your Rights Under UK GDPR

In addition to the right to access, you have other rights under the UK GDPR, including:

  • Right to Rectification: If your personal data is inaccurate or incomplete, you can request that it be corrected.
  • Right to Erasure: In some circumstances, you can request the deletion of your personal data.
  • Right to Restriction of Processing: You can request that we limit how we process your personal data.
  • Right to Data Portability: You can request that we transfer your personal data to another service provider in a structured, commonly used, and machine-readable format.

10. Security

We take security seriously and have measures in place to protect your personal data (see the security statement at https://trippa.net/security-statement/). However, to ensure that we are providing your data to the correct person, we may ask you for identification and further details before releasing any information.

11. Changes to This Policy

We may update this SAR Policy from time to time to reflect changes in our practices or legal requirements. Any changes will be published on our website, and we will notify you of any significant updates.

12. Contact Details for SARs

If you are a trial user, newsletter subscriber, or need to contact TripPA directly regarding your SAR, please use the following details:

If you are a user from a subscribing school, please reach out to the relevant school contact for SAR requests regarding student or staff data.