This privacy notice is designed to explain what information the council needs in order to deliver leisure services provided at Queen’s Park Sports Centre and the Healthy Living Centre.

In order to provide these services, it is necessary for the council to collect, store and process personal data relating to centre users and members. Safeguards are in place to ensure that this data is kept secure and the privacy of individuals is protected.

This notice should be read alongside the council’s main privacy notice.

Who is responsible for your information?

Chesterfield Borough Council is the data controller for the personal information collected.

How we collect your information

Most of the information we hold about you will have been collected from you directly. However we may also collect information about you in the following ways:

• from a third party – for example we receive details of people referred to us by their GP from Derbyshire County Council public health team
• we hold information about children that participate in our activities and events, along with details of a parent or guardian
• details provided to us as the emergency contact by someone else who uses our facilities

Information we hold about members

Purposes of processing your personal data

If you are a leisure member, we need to process some personal information about you in order to:

• set up your membership (including taking payment, and assessing eligibility for certain membership types)
• manage your membership
• manage your course and class bookings
• contact you about your membership or your use of our facilities
• contact you with information about offers and upcoming events
• improve our services by producing usage statistics of our facilities
• provide you with the opportunity to review and manage your gym usage and performance

Categories of personal data and lawful basis

As a member of our leisure centres, we may hold all or some of the following data about you:

• contact details
• bank account details (if you pay by direct debit) and your payment history
• information about your age and gender
• your activity history at our sites
• photo of you
• details about the kind of membership you hold and the reasons for your eligibility (if applicable) 

When we process your personal information in order to setup and manage your membership or provide you with a requested service, our lawful basis is performance of a contract. 

For processing that involves reviewing and improving our service, contacting you about your membership, producing usage statistics and capturing gym usage, our lawful basis is legitimate interest.

We will only send you marketing information if we have your consent. 

Where we process special category data about you (for example if we hold health data about you), this is done with your explicit consent.

Information we hold about you if book a class, attend a course or event, or otherwise book the use of our facilities.

Purposes of processing your personal data

If you book onto a course or event, to attend a class, or to reserve a court or pitch, we need to process some information about you for the following purposes:

• to hold your or your child’s place in the class/event/course
• to contact you about your booking and related events or courses
• to organise and administer the event or activity
• to maintain waiting lists for certain activities and to contact you when a place becomes available
• to enable you to review your child’s performance on a course eg swimming lessons or gymnastics
• to protect your health and safety -  for example, if you participate in an antenatal or seniors exercise class, you will be asked to complete a health screening questionnaire; the information collected is used to make sure that it is safe for you to exercise, and to ensure you are aware of the risks
• to manage your participation in the health referral scheme 

If you are a member, some of this data will be linked to your membership record.

Categories of personal data and lawful basis

The following categories of personal data may be collected:

• contact details
• progress and performance history (in some situations)
• age and gender
• details about your health and medication
• GP and emergency contact details (health referrals) 

For administrative processes and to contact you about your booking, the lawful basis for this processing is described as “for the performance of a contract”.

Other processing is done because it is in our legitimate interest, or because you have consented to it. If you are added to a waiting list for a class, the lawful basis is always consent.

Where we process special category data – for example health information – we only do so with your explicit consent.

Information we hold about you if you have an accident

Purposes of processing your personal data

If you have an accident or see a health and safety incident or near-miss, we may want to add some of your personal information to an accident report. This allows us to review and improve the safety of our services, as well as fulfilling legal requirements to protect the health and safety of our staff and the public.

Categories of personal data and lawful basis

We may need to process some or all of the following categories of personal information:

• contact details
• age
• details of your accident and any injuries 

Under data protection legislation, this processing is allowed because we have a legal obligation to protect the health and safety of anyone using our facilities. For the sensitive personal data we collect (health information), our lawful basis is that this information is required under social protection or employment law.

CCTV

We have CCTV cameras covering internal and external areas of both Queen's Park Sports Centre and the Health Living Centre at Staveley. This footage is managed by the CCTV control room team at the Town Hall, and is used for the prevention and detection of crime and to protect public safety. Please see the council’s CCTV privacy notice for further details.

Who we share your personal data with

If you pay by direct debit, we will use a third party processor – Paygate  - to process your direct debit. For more information see the direct debit privacy notice. 

We use third party suppliers to aggregate and report on customer data, as well as to support us with marketing activities – currently done by DataHub. We also share anonymised activity data with DataHub as part of a national benchmarking scheme. This information is anonymised before it leaves our control. 

We use the Pulse Move service to collate information from each piece of gym equipment. This allows us to track how the gym is used, and allows you to track your activities. When you sign-up to use the gym (and attend an induction) some personal information about you (name and email) are shared with Pulse in order to create your account. Once you have an account, you can add your own content – for example track other exercises you’ve done, or how your weight changes. You can view the Pulse privacy notice. 

All of the above involve sharing data with processors who are acting on behalf of the council. The council remains the data controller of this data, which means that we retain control over how and when your information is used. There are contracts and controls in place to ensure that your information is protected.

If you have made an appointment with us under the GP referral scheme, we will share some information about you with the Derbyshire County Council public health team, as the funder of this service.

We are legally obliged to report serious RIDDOR reportable accidents to the Health and Safety Executive.

Consent

If you have provided consent as the lawful basis for our processing, you can withdraw this consent at any time. You can do this by contacting the reception staff at either centre (see contact details below).

Withdrawing consent for the use of your health data may be dangerous to yourself and/or impact the service we can provide you. If you do not provide proof of eligibility with your Change4Life membership, your application may be rejected. 

Withdrawing consent for direct marketing will have no impact on your use of our facilities or your membership.

Further information

Please get in touch if you would like more information about how the council processes your personal data:

• contact our leisure centres
• contact the council's data protection officer