InspireAll Leisure treats your personal information with the utmost care, takes appropriate steps to protect it and will never sell it. We are committed to ensuring that personal information is handled in accordance with the principles set out the General Data Protection Regulation 2018 (GDPR) and the Data Protection Act 2018 (DPA).
If you have any questions please speak to a member of staff or contact our Data Protection Officer:
InspireAll Leisure and Family Support Services
Borehamwood WD6 1JY.
We update this Policy from time to time so please return and review this Policy regularly.
Who is InspireAll Leisure?
InspireAll Leisure & Family Support Services, is a UK registered charity no. 1093653 and a company limited by guarantee no. 04343347. Our registered office is The Venue, Elstree Way, Borehamwood, Herts WD6 1JY.
Who do we collect personal information from?
We collect and process information from a range of individuals, including:
- those that have become a member of one of our centres or theatres,
- those that have expressed a strong interest in joining one of our centres or theatres,
- those that have used or have expressed a strong interest in using our services and activities,
- and those that have visited our sites or website.
When we collect personal information from you and what our legal basis is for doing so:
In order to operate our business we need to collect personal information. We are committed to protecting your personal information and will only collect the information if we need to for a specific purpose and providing we have a legal basis, as explained below:
When you join one of our centres or theatres or book an activity for yourself or a member of your family we collect and store personal information in order to provide you with services.
When you pay for a membership, other service or purchase by credit card we collect your credit card details in order to process that transaction.
When you join one of our centres we collect personal information in order that we can provide a personalised service tailored to your health and fitness goals and provide information that may be of interest to you.
We also collect personal information to ensure your health and safety when using our facilities and to get in contact with your emergency contact if needed.
If you have expressed a strong interest in joining one of our centres or using our services and activities, we will collect and use your personal information in order to contact you about it.
When we take photos or film events of large groups of people in order to promote our service we will collect your personal information and share it with our designers and selected promoters (when it would not be practical to obtain written consent from individuals).
When we capture your image on CCTV for prevention and detection of crime, safeguarding staff and visitors and ensuring compliance with health and safety procedures.
We are sometimes required to collect information about your ethnicity and other sensitive data in order to provide aggregated reports to your local authority or commissioning group. This information is used only for statistical purposes and is always kept secure.
When you opt-in to our Physical Activity Referral Service we collect information about any health or disability conditions you may have in order that we can devise an appropriate activity programme for you.
When we take photos or film of people who are clearly identified in order to promote our service we will collect your personal information and share it with our designers and selected promoters.
We also collect information when you voluntarily complete customer surveys, provide feedback and participate in competitions.
In order to provide our services to you we process ‘special category information’. This is more sensitive personal information such as health.
We collect health information to ensure we are offering you the right services and so that your progress can be tracked by yourself and us. We may ask you for information about your health in order to recommend appropriate exercise regimes or offer other services. We rely on your explicit consent to do this. We take extra care to ensure any special category information you share with us is kept secure and is only used for the purpose for which it was given.
We have a duty in the public interest to support the NHS test and trace service. You can request to opt-out of your personal data being shared in this way and we will balance your personal data rights with the public interest.
Special category information
Where the information we process is special category information, for example your health information, the additional basis for processing that we rely on under the GDPR is:
- Article 9(2) (a) Explicit consent
Where the special category information is ethnicity, the additional basis for processing that we rely on under the GDPR is:
- Article 9(2) (j) Archiving, research and statistics (with a basis in law)
In addition we rely on processing conditions at Schedule 1 part 1 paragraph 8 of the DPA 2018. This relates to the processing of special category information that is necessary for the purposes of equal opportunities monitoring.
Which personal information do we collect and process?
When joining one of our centres or booking an activity:
Name, date of birth, contact details, bank details, ethnicity, gender, health and fitness goals, interests, any relevant medical information*, emergency contact, photograph**
If you book any of our child activities or services including our play scheme, crèche, parties or swim school:
Child’s name, date of birth, gender, address, medical information*, emergency contact details, description of children’s likes, strengths, areas to be developed, dietary requirements & food intolerances , disability/special educational needs, distinguishing marks, ethnicity, injury details, languages spoken, password for collection, safeguarding information. As well as the parent/carer’s name, contact details and bank details.
If you pay by credit card:
Bank card information at the time we take payment.
This data is not stored on our systems and is processed on Payment Card Industry Data Security Standard compliant banking systems.
If you visit our website or book a course or session online
Email address, online account password, IP address. Please see below for information about cookies and information about other websites.
When you use any of our facilities
Usage information, health and fitness related data. If you have a corporate membership paid by your employer we may share your usage information with them. We will never share health and fitness related data with them without your consent unless required to do so by law.
If you opt-in to our Physical Activity Referral Service
Disability and health details, GP details and other health professional details if relevant.
If you opt in to receiving marketing material or newsletters from us
Contact details. You can opt out of this at any time.
If you contact us
A record of your contact information and enquiry (so we can reply if necessary)
If you express a strong interest in joining one of our centres or using our services and activities
Name, contact details. (If your interest has been in a child’s activity we will also collect child’s name and date of birth)
When you visit any of our facilities
CCTV images (for the prevention, identification and reduction of crime). For more details of how we record, use and store images on CCTV please ask to see our CCTV Code of Practice. Name, telephone number and email address, date and time in and out.
When you provide customer feedback
Name, contact details, opinions
* We ask for any relevant personal health data when you register and signing up for our services. We collect this information to ensure we are offering you the right services and so that your progress can be tracked by yourself and us. We may ask you for information about your health in order to recommend appropriate exercise regimes or offer other services.
**Photographs are kept on our membership database to allow us to validate customers’ identity when entering our centres. They are not shared with anyone else and are only viewed by reception staff.
How will we use the information about you?
When you join one of our centres or book an activity:
Your information is used to ensure you get the most benefit from our services. It is used to set up, verify and manage your membership/activity, create tailor-made programmes, allow you to track your workout progress and to verify which activities you have undertaken. It is used to get information from credit reference agencies and fraud prevention agencies where necessary. It contributes to equal opportunities monitoring (your information will be anonymised so no one can identify you).
If you have a Direct Debit mandate or pay by credit card
To take payments for your membership or for goods/activities/services purchased.
If you opt-in to our Physical Activity Referral Service
We will use information about any health or disability conditions you may have in order that we can devise an appropriate activity programme for you.
When you and your family use our services:
Your information about which facilities you have used is used to:
- keep you updated by text, email and/or phone on relevant matters such as class cancellations, membership terms or bookings changes, booking confirmations, and important updates regarding the centre and changes to your membership.
- send marketing information via email, telephone, text and/or post about our other products and services we think may be of interest to you. You will have the option to opt-in to these when you initially provide information to us or when we collect information from you, and can opt out/update your preferences at any time by contacting any of our centres of by contacting email@example.com
- develop and improve our services for your benefit.
When children are booked onto our services:
Your child or children’s information is used to set up their membership/activities. Their parent/carer details are used to verify and manage this membership/activity on their behalf. Emergency contact details and medical information is collected so staff can respond to the best of their ability in case of emergency.
If you express a strong interest in joining one of our centres or using our services and activities:
We will contact you to give you more information about the service/activity/membership you have expressed an interest in.
When you provide customer feedback:
To improve our services. If you have provided your contact details and would have given your consent to be contacted we will be in touch to discuss anything you may have raised.
If we have a legal obligation to share your personal information:
We have to pass on your personal information to the relevant authorities if we think there is a serious risk to you or your family, or someone working with you. We have to pass on your personal information to statutory authorities if requested, such as HMRC.
If we have a task in the public interest to share your personal information:
If we are notified that someone who has since tested positive has been inside or on our premises whilst you were present, we are required to share your details with the NHS test and trace.
How long do we keep your information?
Your personal information will only be kept for as long as it is needed. Once your personal information is no longer needed it will be securely disposed of.
Who will my personal information be shared with?
InspireAll Leisure will never sell your personal information. However we may share your personal information with third parties in the following situations:
When InspireAll Leisure shares your information
Processing your membership application
We may send your personal information to credit reference agencies and fraud prevention agencies where necessary.
If your employer pays for your membership we may share your usage data with them.
Collecting Direct Debit payments
We use a third party to collect Direct Debit payments on our behalf.
Ensuring your safety, and the safety of others, and complying with the law
We may share your information if we have a legal duty to do so
Marketing our services
We may share your mobile phone number or email address with marketing companies if you have given us permission to do so. You can opt-out at any time by ‘unsubscribing’ which is included in all our texts and emails to you.
Providing reports for various funding bodies
As a condition of the funding we receive we may have to provide some personal information as evidence of how effective we are in providing services. We may also supply them with personal information in order that they can provide services needed. This information will be anonymised so you won’t be able to be identified from the information given. If you do not want your personal information to be included in this reporting please contact firstname.lastname@example.org
Providing contact information to NHS test and tract
If a contact tracing exercise is in progress we will share your details with the NHS contact tracing service if relevant, who will contact you separately for further information. If you are under 18 years old, we will contact you by phone wherever possible and ask consent from your parent or guardian to continue the call.
A list of these third party organisations (data processors) and the personal information we share with them can be found in Annex A.
A list of the various organisations InspireAll Leisure operates as a data controller or joint data controller with can be found in Annex B.
Personal information relating to children
Our services are used by people of all ages. InspireAll Leisure accepts website bookings and enquiries and collects personal information from individuals. Children aged under 16 years must have a parent or guardian’s consent before providing personal information to us. We will not collect any personal information without this consent.
How will my personal information be protected?
InspireAll Leisure takes information security very seriously. Only authorised staff will be able to access your personal information. InspireAll Leisure has appropriate security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorised way. All staff receive regular data protection training.
InspireAll reserves the right to transfer your information to countries outside the European Economic Area. If we do so we will ensure it has the same level of protection that it would have in the EU.
There are also procedures in place to deal with any suspected information security breaches. InspireAll Leisure will notify you and any applicable regulator of a suspected information security breach where we are legally required to do so.
Know your rights
You have rights over your personal information. Your rights under Data Protection regulations and what this means for you:
Accuracy of information
We will strive to ensure that the information we hold about you is accurate and relevant. If you believe the information we hold about you is out of date or incorrect, please contact us (see below).
Seeing your information – subject access request
The Data Protection Act 2018 and the General Data Protection Regulation 2018 give you the right to know what personal information we hold about you in certain circumstances (you can only have access to your own information and any child that you have parental responsibility for aged under 13 years old). This is called a Subject Access Request.
Removing your information
If you no longer use our services and products and wish us to delete your personal information we will do this if there are no legal or statutory regulations requiring us to keep this it.
If you want us to stop using your personal information but don’t want us to delete it we will restrict its use unless we have a legal duty to continue to use it, are using it to defend any legal claims or it is needed for safeguarding someone.
Objecting to your data being used
You have the right to stop to your personal information being used for direct marketing. You can also object to your personal information being used for statistical purposes, our legitimate interests and for a task being carried out in the public interest.
Transferring your data
In some circumstances, you can ask us to transfer your information to another organisation.
We use the information gathered from cookies to get an idea of what elements of the website are best performing and what could be improved.
For further information about cookies, please visit www.aboutcookies.org or www.allaboutcookies.org.
You can set your browser not to accept cookies and the above websites tell you how to remove cookies from your browser. However in a few cases, some of our website features may not function as a result.
Changes of business ownership and control
In the above instances, we will take steps with the aim of ensuring your privacy is protected.
We are committed to ensuring the protection of your personal information. The transmission of non-sensitive details (such as your email address) made via the internet is not guaranteed 100% secure, except where you see the green padlock in the address bar. Although we will do our best to protect your personal data, we cannot guarantee the security of any data transmitted to our site (unless you see the aforementioned padlock icon); any transmission will be at your own risk. Once we receive your information, we make our best effort to ensure its security on our systems. Where we have given (or where you have chosen) a password which enables you to access certain parts of our websites, you are responsible for keeping this password confidential.
Who can I contact about my rights over my personal information or any other questions I might have?
InspireAll Leisure and Family Support Services
We take any complaints about our collection and use of personal information very seriously.
If you think that our collection or use of personal information is unfair, misleading or inappropriate, or have any other concern about our information processing, please raise this with us in the first instance.
The Information Commissioner’s Office is the UK’s independent authority set up to uphold information rights. You have the right to contact them should you wish:
- Report a concern online at https://ico.org.uk/make-a-complaint/
- Call 0303 123 1113
- Or write to:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Information Commissioner’s Office
- General Data Protection Regulation 2018
- Data Protection Act 2018
This policy will be updated as necessary to reflect best practice and to ensure compliance with any changes or amendments to relevant legislation.
Annex A – Data Processors
Data processors are third parties who provide certain parts of our services for us. InspireAll Leisure has contracts in place with them and they cannot do anything with your personal information unless we have instructed them to do so.
The current types of current data processors InspireAll uses are listed below.
|Type of Organisation||Service delivered||Information shared|
|Customer management software providers||Core systems for member information.||Contact details including emergency contact information, customer usage information, medical information|
|Financial services||Direct Debit (DD) collection services and credit control||Identity documentation, contact details, financial information, transaction details|
|Marketing||Design Consultants, Communications software, Marketing automation services||Photographs and videos, contact details, IP addresses|
|Health referral portal||Patient Activity Referral Service database||Patient Activity Referral Service database|
Annex B – List of organisations that InspireAll Leisure works with as a Data Controller or Joint Data Controller
Data controllers are organisations that commission InspireAll Leisure to deliver services. They may also run services themselves.
Our current data controllers / joint data controllers are listed below.
Hertsmere Borough Council
3 Elstree Way, Borehamwood
Milton Keynes Borough Council
1 Saxon Gate East
Milton Keynes MK9 3EJ