Introduction
We, Harlow & District Sports Trust (HDST), are ‘controllers’ of the information which we collect from or about you – ‘Personal Data’. As controllers, we are responsible for the security and processing of your personal data. This Privacy Notice explains why and how we process your data.
The word ‘process’ covers most things that can be done with personal data, including collection, storage and destruction of that data.
HDST is a charitable social enterprise, charity registration no. 301328, and our contact details are:
- Address
- Registered Office: Harlow Leisurezone, Second Avenue, Harlow, Essex, CM20 3DT
- privacy@harlowleisurezone.co.uk
Your personal data
‘Personal data’ is any information that relates to a living, identifiable person. This data can include your name, contact details, and other information we gather as part of our relationship with you. It can also include ‘special categories’ of data, which is information about a person’s race or ethnic origin, religious, political or other beliefs, physical or mental health, trade union membership, genetic or biometric data, sex life or sexual orientation. The collection and use of these types of data is subject to strict controls. Similarly, information about criminal convictions and offences is also limited in the way it can be processed.
We are committed to protecting your personal data, whether it falls into ‘special categories’ or not, and we only process data if we need to for a specific purpose, as explained below.
We collect your personal data mostly through our contact with you, the Leisurezone mobile app and our website, and the data is usually provided by you, but in some instances we may receive data about you from other people/organisations. We will explain when this might happen in this Notice.
Data, why it will be processed and our legal basis for processing
| Personal data description | Processing reason | Legal condition or basis for processing |
|---|---|---|
| Customer’s name, address, email address, telephone number(s), date of birth, age, bank details, credit card information, customer membership number, customer account no., photographic images, telephone recordings, marketing preferences, details of financial transactions, goods or services provided/activities undertaken, location, date and time of visits, disability status or special needs information, family structure and lifestyle, social circumstances, forces number (for funded sessions), concessionary information (to receive concessionary benefits). | Provision of services or facilities under a contract; keeping and updating of records and details associated with that contract; Membership and bookings administration and service updates.
Protection of the business from financial risk; provision of applicable discounts and benefits; keeping of mandatory financial records. | Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Processing is necessary for compliance with a legal obligation to which the controller is subject (financial and auditing regulations). Processing is necessary for the purposes of our legitimate interests – in providing services including customer service, protecting the business and maintaining and providing a secure environment. |
| Personal appearance and behaviour (all customers visiting the facility). | Collection and monitoring of CCTV images for the purpose of security, the prevention and detection of crime; protection of assets and property; to assist with parking control; to facilitate the investigation of incidents and general health & safety.
Monitor staff when carrying out work duties; to facilitate in the management and support of staff. | Maintaining and providing a secure environment.
Processing is necessary for the purposes of our legitimate interests – protection and management of business risks. |
| Attainment/Progression/Goals – in relation to children and adults attending lessons (e.g. swimming lessons) and gym members with personalised training programmes. | To track progression and achievement of those taking lessons in various sports, to ensure their progression onto the next level making lessons relevant productive and value for money for the customer; to ensure appropriate levels of skills in each class. | Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. |
| Next of kin/emergency contacts (in relation to customers, and workers including volunteers). | To contact next of kin or parent in an emergency or in the case of injury illness or death. | Processing is necessary for the purposes of our legitimate interests – we need to be able to get in touch with someone who may be able to help in the event of you becoming ill or injured, or in any other kind of emergency. |
| Personal details, contact information and medical history, accident/injury details, occupation and job location of individuals who have suffered injury or illness or been involved in an incident at one of our venues (all affected customers or visitors); witness contact details. | To keep report on and submit required records of incidents, accidents and near misses. | Processing is necessary for compliance with a legal obligation to which HDST is subject (e.g. HSE legal obligations of reporting).
Processing is necessary for the purposes of our legitimate interests – to investigate facts around incidents and accidents and ensure compliance and improvements. For providing relevant information to our insurers. |
| Car registration, name and company name in relation to visiting contractors and workmen. | To maintain accurate records of persons present in the building in case of evacuation; to keep accurate logs of maintenance visits. | Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Processing is necessary for compliance with a legal obligation to which HDST is subject (e.g. HSE legal obligations of reporting). |
| Consequence of not providing the above data: HDST will be unable to enter into a contract with you for the provision of services or facilities. | ||
Consent-based processing
| Personal data description | Processing reason | Legal condition or basis for processing |
|---|---|---|
| Name, email address, gender, phone number, preferred method of contact and marketing preferences. | Promotions and marketing including newsletters. | Consent – you have given consent to the processing of your personal data for one or more specific purpose. |
| Fitness Goals and fitness and activity interests, attainment and progression (all customers taking up membership). | To provide a relevant and effective personalised fitness programmes and advice; motivational feedback and promote a sense of achievement; to ensure marketing and promotional information provided is relevant to your interests. | Consent – you have given consent to the processing of your personal data for one or more specific purpose. |
| You may withdraw your consent to the processing of the personal data in this section at any time. Please see Withdrawing consent. | ||
Special category data
| Special category data | Processing reason | Legal condition or basis for processing |
|---|---|---|
| Racial or ethnic origin; Religious or other beliefs of a similar nature – (all customers visiting a facility). | In the capture of photographic or CCTV images; in the registration for activities or services available for people of a specific race or ethnic origin. | Processing is necessary for the purposes of our legitimate interests – in providing services including customer service, protecting the business and maintaining and providing a secure environment.
Explicit consent will also be requested. If consent is refused or withdrawn, we will be unable to provide the contracted services. |
| Health information (if relevant and necessary) of individuals who have suffered injury or illness or been involved in an incident at our organisation.
Health information / status prior to exercising. | To keep report on and submit required records of incidents, accidents and near misses.
To provide information to emergency services if required. | Processing is necessary for compliance with a legal obligation to which HDST is subject (e.g. HSE legal obligations of reporting).
Processing is necessary for the purposes of our legitimate interests – to investigate facts around incidents and accidents and ensure compliance and improvements. For providing relevant information to our insurers and to provide safe professional exercise guidance and programming. Processing is necessary in order to protect the vital interests of the data subject or of another natural person. Explicit consent will also be requested. If consent is refused or withdrawn, we will be unable to provide the contracted services. |
| Physical or mental health details for example, anthropometric data, relevant medical history and assessment notes. | To safely provide, and allow participation in, health related schemes or services, including but not limited to cardiac rehab, weight management, use of some fitness facilities. | Consent – the data subject has given consent to the processing of his or her personal data for one or more specific purposes. Explicit consent will also be requested. If consent is refused or withdrawn, we will be unable to provide the contracted services. |
| Offences and alleged offences, criminal proceedings, outcomes and sentences – in relation to prospective and current workers (including volunteers). | For the purpose of meeting safeguarding obligations. | Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
Processing is necessary in order to protect the vital interests of the data subject or of another natural person. Processing shall be carried out as authorised by the Police Act 1997 and the Rehabilitation of Offenders Act 1974 as amended. |
Data received from third parties
| Data and from whom/where | Processing reason | Legal condition or basis for processing |
|---|---|---|
| Data – customers’ physical or mental health details from referrers or relevant health/social care professionals for example, GPs – example of data: anthropometric data, relevant medical history and assessment notes. | To safely provide, and allow participation in, health related schemes or services, including but not limited to cardiac rehab, weight management, use of some fitness facilities. | Consent – the data subject has given consent to the processing of his or her personal data for one or more specific purposes. As this is special category data, explicit consent will be requested. If consent is refused or withdrawn, we will be unable to provide the health service. |
Transfer of data outside of the EU
HDST does not share or transfer any customer, visitor or supplier personal data outside of the EU. All cloud based storage is based in the UK or the EU.
How we store your data
| Data | How it is stored |
|---|---|
| Paper / hard copy personal data | In an appropriately secure manner and location with appropriately controlled access. |
| Electronic personal data | On an appropriately secure server with appropriately controlled access or in a cloud storage facility within the UK managed by an approved third party contractor. |
Data retention
| Data | Retention principle |
|---|---|
| All personal data | Data is processed and stored only as long as it is needed for the purpose for which it was collected, subject to the following overriding principles:
|
| HDST has set out an internal protocol in relation to retention periods which takes account of the obligation to keep data only for as long as it is needed as well as all statutory or other legal obligations regarding the retention of such records. |
Rights of the Data Subject
You have the following rights in respect of your data:
| 1 | The right to be informed about who is controlling your data, how, and for what purpose they intend to process the data, with whom they may share the data, and for how long they will keep the data. | All of these are summarised within this Privacy Notice and full details are available on the ICO website here: Right to be informed |
|---|---|---|
| 2 | The right of access – you have the right to receive confirmation that your data is being processed. You also have the right to access your personal data in order to verify the lawfulness of the processing. | You can contact us at privacy@harlowleisurezone.co.uk to obtain a form to request access to your data, where applicable. Further information on how and when we must respond and handle requests and when we may charge a fee are set out here: Right of access |
| 3 | The right to rectification – you can ask for inaccurate or incomplete personal data to be rectified. | Further information on how quickly we will meet your request, or the occasions on which we may decline to meet your request can be found here: Right to rectification. If we decline to meet your request, we will explain why, and remind you of your right to complain to the Information Commissioner’s Office or ultimately seek a judicial remedy. |
| 4 | The right to erasure or the right to be forgotten – you can ask for your personal data to be deleted or removed in specific circumstances. | We will deal with requests for erasure in accordance with the provisions set out here: Right to erasure. We will only store and process data that is specifically required for genuine and proper business reasons and for the protection of our business from financial risk and only for the appropriate length of time. |
| 5 | The right to restrict processing – you can ask us to ‘block’ or suppress the processing of your personal data circumstances. | We will restrict processing of your personal data as requested unless we cannot or choose not to for the permitted reasons which are set out here: Right to restrict processing. Otherwise, we will retain just enough information about you to ensure that the restriction is respected in future. |
| 6 | The right to data portability – this allows you to obtain and re-use certain elements of your personal data for your own purposes across different services; it allows you to move copy or transfer your data easily from one IT environment to another in a safe and secure way, without hindering its usability. | How quickly and in what format we will provide your data will be governed by the details here: Right to data portability. If we are going to decline your request, we will within one month of the request explain to you why not and will inform you of your right to complain to the Information Commissioner’s Office, and your right to a judicial remedy. |
| 7 | The right to object – you have the right to object to certain types of processing, or processing for specific reasons:
| We will consider your request to stop processing your data in accordance with the requirements and provisions set out here: Right to object If you notify us of the grounds of objection specific to your situation we will stop processing the personal data unless:
We will, without delay and free of charge, stop processing personal data for direct marketing purposes as soon as we receive an objection. If you notify us of the grounds of objection specific to your situation we will stop processing the personal data unless we are conducting research where the processing of personal data is necessary for the performance of a public interest task. |
| 8 | Rights in relation to automated decision making and profiling – you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects, or which similarly significantly affects you. | We use or may use in the future automated decision making in the form of Facial Recognition Software for controlling access to our facilities and services. We will comply with the requirements set out here: Rights related to automated decisions We may profile personal data and sometimes special category data for the purposes of marketing and promotion where individuals have opted into receiving this. You can ask for us to stop sending you marketing information by contacting privacy@harlowleisurezone.co.uk |
Withdrawing consent
For personal data where we are relying upon your consent as the legal basis for processing (please refer to Data, why it will be processed and our legal basis for processing above) you may withdraw your consent at any time by altering your preferences by notifying us at privacy@harlowleisurezone.co.uk.
Making a complaint
If you feel you have a complaint regarding the processing of your personal data, please contact privacy@harlowleisurezone.co.uk to obtain a form for you to complete.
If you still have a concern regarding your personal data
You may report your concern to the Information Commissioner’s Office – contact details may be found on the ICO website: https://ico.org.uk/make-a-complaint/