Privacy notice for East Riding Leisure

What do we use the information for?

East Riding Leisure (ERL) collects, processes and holds your personal information in order to provide leisure services effectively on behalf of the East Riding of Yorkshire Council:

• To process memberships to allow access through our customer retention management (CRM) system
• To provide access to facilities
• To provide banks with direct debit information to enrol on our membership schemes
• To create registers for courses and classes including online bookings
• For health and safety reasons (such as  emergency telephone numbers ) 
• To provide updates about the direct services the user has enrolled on (for example, one of our health schemes)
• For marketing purposes (where consent has been given)
• To provide third parties with updates on any of our heath schemes (where consent has been given). 

We also use information to improve our services so that they are more appropriate to people’s requirements.  

What information do we hold and use?

We collect and process the following information:

• Personal information (including full name, full residential address, date of birth)
• Location data (including postcode and telephone number)
• Characteristics (such as ethnicity, sex)
• Bank details (including direct debit agreements for membership schemes)
• Information relating to health which may affect exercise or is essential to qualify in one of our heath schemes
• Employment information (such as  name of employer).

On what grounds do we use the information?

ERL collect and lawfully process your personal information under the following: 

• Health and Safety at Work Act 1974

We process personal data for the following reasons:

• GDPR Article 6(1)(a) – the data subject has given consent to the processing of his or her personal data for one or more specific purposes
• GDPR Article 6(1)(b) - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
• GDPR Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject
• GDPR Article 6(1)(f) - processing in necessary for our legitimate business interests, or those of a third party, and these interests are not overridden by your interests or fundamental rights and freedoms in relation to the protection of your personal information. 

We process special category information for the followings reasons:

• GDPR Article 9(2)(h) - processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems
• DPA 2018 Schedule 1 Part 1 (2) - health or social care purposes.

How do we collect this information?

We may collect information in the following ways: 

• Paper, electronic or online forms
• Photographs for identification purposes
• Email
• Telephone
• Face to face
• Third parties (including exercise referral schemes from medical practitioners).

Who do we share your information with?

We may disclose your information to others, but only where this is necessary either to comply with legal obligations or as permitted by Data Protection legislation. We may share it with other public service bodies including the NHS, social care, the police and other local authorities. 

The reasons why we may share your data with other public bodies are as follows: 

• To protect vulnerable adults who may be at risk of harm or abuse
• To improve our understanding of your needs to enable us to inform you of other relevant leisure/ health services
• To monitor and improve our performance and delivery of services
• For the prevention and or detection of crime
• Where necessary to protect individuals from the risk of harm or injury
• Where otherwise permitted under the General Data Protection legislation.

ERL may also share your information with medical practitioners, within various health schemes, but only where this is necessary.  The information sharing process is a two way process and agreed by the user prior to commencing the scheme.  Information such as body mass index, weight, and other health-related figures are shared. 

We will only disclose your sensitive or confidential information, such as medical details to a third party, if we are legally required to do so, or where we have good reason to believe that failing to share the information would put you or someone else at risk of harm.

We will not pass your personal information to external organisations for marketing or sales purposes, or for any commercial use, without your prior expressed consent.

How long do we store it and is it secure?

ERL has retention schedules in place to ensure that information is only held for as long as it is needed. We will not keep your information for longer than is required to by law.  Your information will be disposed of in a controlled and secure manner in accordance with the council’s Records Management and Data Quality Policy. The council’s IT security and confidentiality policies ensure that your information is protected, and accessed only by staff directly involved in your case.

For information on how long your information will be held visit the retention page. 

What rights do you have?

The rights that you have depend upon the grounds upon which we collected your information. All of the rights you could have outlined upon the data protection rights page. 

• The right of access - you are entitled to see the information the service holds about you 
• The right to rectification -  we will amend any information accordingly,  if any of the information the service holds about you  is incorrect 
• The right to restrict processing - you may wish to limit how we use your data
• The right to object – in addition to the right to limit the use of your data, you also have a right to object to the use of you data for certain actions
• The right to erasure/ right to be forgotten – in certain circumstances, you may be able to ask for some of the information we hold to be deleted. The service has determined that all requests to permanently delete a service user record will be dealt with on an individual basis.      

To exercise any of your above rights, please visit the data protection rights page for more information.

Where can I find out more?

If you want to know more about how the council uses information, your rights or have a concern about the way we are collecting or using your personal data, we request that you raise your concern with us in the first instance; contact details are available on the general privacy information page. Alternatively, you can contact the Information Commissioner's Office (ICO). The ICO is the UK’s independent authority set up to uphold information rights in the public interest and they handle public concerns regarding organisations information rights practices. 

Information Commissioner’s Office (external website) 

When was this privacy notice last updated?

We will continually review and update this privacy notice to reflect any changes in our services, feedback from customers, and to comply with any changes in the law. This privacy notice was last updated on 11 December 2020.