Wales National Pool Swansea has developed this Privacy notice to protect you, our customers, by ensuring that you are fully informed in relation to how we collect, manage and share the personal information we collect.
Identity and contact details of the Data Controller
Wales National Pool Swansea is the Data Controller and is committed to protecting the rights of individuals in line with the Data Protection Act 1998 (DPA) and the new General Data Protection Regulation (GDPR) and the EU Privacy and Electronic Communications Regulations 2003. (We are registered with the Information Commissioners Office (ICO) reference number Z9495912.
Contact details of the Data Protection Officer
Wales National Pool Swansea has a Data Protection Officer who can be contacted through WNPSdataprotectionof@swansea.ac.uk
What information do we collect about you?
We collect any of the following information from our customers and potential customers. This is either face to face within the facility, by email, over the phone or via our website.
- Home address
- Date of birth
- Home telephone number
- Mobile telephone number
- Private email address
- Name of employer
The above information will be contained within a membership record with a unique ID number. For members this means we can recognise you by your photograph and will allow us to ensure that your card is not misused if lost or stolen.
- In addition we may request Special category details relating to health conditions, this is to ensure your safety and welfare when using our facility and participating in the activities we provide.
- We may also be required from time to time to request or collect details relating to protected characteristics in accordance with the Equalities Act
What will we use your personal information for and what are our legal bases for doing so?
We use the personal information we hold about you for a number of different purposes, which we list below. Under data protection law we need to have a valid legal basis for using your personal information, we also set out below the legal bases which we will be relying upon.
Your information may be used in the following ways:
- To administer and provide the services that you have requested (including e.g. communications relating to the contractual arrangement e.g. Aqua School enrolments, membership notifications etc).
In this case the legal basis that we will be relying upon to process your personal information will be because it is necessary for the performance of the contract between us – In this case our lawful basis for collecting your data is contractual
In order to keep you updated then there will be communications that we need to send you. These include notices about direct debit payments, aqua school enrolments and progressions, waitlist communications etc. Without this communication then we would not be able to provide our services to you and they are in accordance with our legitimate basis for processing your data
- To check your identity
- To confirm eligibility where applicable (e.g., student status etc.)
- To undertake statistical analysis and research to assist us with the development of our facilities and services
- safeguarding and promoting the welfare of our customers
- ensuring our customers’ safety and security
In these cases the legal basis that we will be relying upon to process your personal information will be because it is in our legitimate interests. Our specific legitimate interest is:-
The furtherance of Aquatic sports in accordance with our mission statement
“To be a World Class Centre for aquatic sports, which develops customers from grass roots to high performance level, promotes participation, health and wellbeing, and provides a sustainable performance enabling environment for all”.
- To advise you of short notice programme changes or cancellations to services provided by us
- To provide marketing communications where permission has been received
- Providing operational information
- Promoting our services
In these cases, the legal basis that we will be relying upon to process your personal information will be because you have consented for us to do so.
- Promoting equality of opportunity
- Preventing and detecting crime
- To ensure we are compliant with legal requirements
In these cases, the legal basis that we will be relying upon to process your personal information will be because it is necessary for us to do so to comply with our legal obligations
Your data will not be used to make automatic decisions.
As our products and services are available for people of all ages then for children under 13 then a parent or guardians consent is required before personal information can be provided to us. Without this consent then we will not collect any personal information.
Who receives your information?
Wales National Pool Swansea may share information with third party organisations that provide specific services on our behalf which may assist us to facilitate the services and facility we offer you or enhance our products and your experience. There are contracts in place with each third party which includes strict terms and conditions to protect your privacy.
Our current processing partners include XN Leisure, Swansea University, Cascade 4D, Automated Payment Transfer (APT), Aqua Passport.
For membership schemes run in conjunction with Swansea University Sports Centre (Gym & Swim and Sports Village Plus) then your information will be shared by both parties and each party will be the data controller.
For Aqua School customers participating in the Learn to Swim Wales Programme then relevant anonymised data will be provided to Swim Wales/Aqua Passport where you have consented to this.
Any transfers to third countries and the safeguards in place
WNPS will not transfer your data outside of the EU.
How long will your information be held?
Unless there is a legal basis for us retaining your data for longer, we shall retain your details as follows:-
Bank details for Direct debit customers
- On cancellation of a direct debit the bank details will be removed from the membership record within one calendar month
- Paper records for live direct debits will be retained for no longer than 60 months
- Paper records for expired Direct debit customers will be retained for no longer than 12 months
- The data will be held by us for as long as you remain a member
- Where consent has been provided as a lawful basis for our collecting your data then unless consent is withdrawn it will be held for as long as you are a member with us or when a membership is cancelled and in accordance with industry standard practice for no more than 36 months
- Where legitimate business interest is our lawful basis for collecting your information then the data will be held for as long as the membership is active or when a membership is cancelled and in accordance with industry standard practice for no more than 24 months
What are your rights?
Data protection legislation provides individuals with a number of different rights in relation to their data. These are listed below and apply in certain circumstances:
- Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
- Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
- Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
- Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
- Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
- Request data portability of your personal information. In certain circumstances, you may have the right to require that we provide you with an electronic copy of your personal information either for your own use or so that you can share it with another organisation. Where this right applies, you can ask us, where feasible, to transmit your personal data directly to the other party.
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact:
WNPS Data Protection Officer
Wales National Pool Swansea Sketty Lane Swansea SA2 8QG
We will always ask for verification of your identity in order to process any request to exercise your rights under GDPR.
Security of your information
Wales National Pool Swansea takes the safeguarding of your data very seriously. The guidelines we use to look after your data are listed below:
- Maintenance of secure systems to protect your personal information
- Your communications preferences will be respected and we will contact you in accordance with your preference (we are currently unable to contact you by text message)
- Your information and communication preferences will be updated promptly when you request we do so
- We will not hold your personal information for longer that is necessary for our legitimate business purposes
- We will respond fully to any request from you to see the information that we hold on you.
- We will never sell your personal information to a third party.
- We have procedures in place for handling, processing and storing your information.
How to make a complaint
If you are unhappy with the way in which your personal data has been processed you may in the first instance contact the Wales National Pool Swansea Data Protection Officer using the contact details above.
If you remain dissatisfied then you have the right to apply directly to the Information Commissioner for a decision. The Information Commissioner can be contacted at:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. www.ico.org.uk