Culture, tourism and sports privacy notice

This privacy notice is to let you know how we promise to look after your personal information. This notice explains how we do this and tells you about your privacy rights and how the law protects you.

This privacy notice covers the following areas of culture, tourism and sports

  • Hydro Swimming Pool, Harrogate
  • Starbeck Pool, Harrogate
  • Knaresborough Pool
  • Ripon Spa Baths
  • Ripon Leisure Centre
  • Nidderdale Pool and Leisure Centre
  • administrative office Jennyfield Styan Centre, Harrogate
  • tourism
  • museums service
  • Jennyfield Styan Community Centre
  • Fairfax Community Centre
  • Knaresborough Community Centre
  • health and active lifestyles
  • Turkish Baths
  • Little Explorers (previously Coppice Valley Nursery)

What information do we collect?

The type of information we collect will depend on why you have got in touch with us. The information will include some or all of the following:

  • name (adults/children)
  • address
  • contact details
  • date of birth
  • email addresses
  • emergency contact numbers
  • financial information
  • medical information
  • characteristics (such as age, ethnicity and language)
  • doctors name and telephone number
  • membership/activity details

Who uses this information?

Which areas internally to Harrogate Borough Council use this data?

  • ICT when doing a system upgrade
  • other appropriate sections in Harrogate Borough Council when required, for example where involved in resolution of complaints, legal issues, insurance claims, health and safety matters, financial transactions

External to Harrogate Borough Council

  • software providers
  • BACS systems
  • Ofsted and Tapestry (Ofsted Development package)
  • North Yorkshire County Council
  • Ombudsman
  • National Health Service and relevant agencies
  • Visit Harrogate
  • customers where appropriate

Why do we use this information?

  • direct debit billing
  • contacting customers
  • updating of membership details
  • booking of classes and activities
  • emergency situations (medical history/incident)
  • send email/text messages
  • creating individual exercise programmes
  • monitoring progression
  • course management
  • data protection requests where appropriate
  • freedom of information requests where appropriate

What authority does Harrogate Borough Council have to collect and use this information?

The culture, tourism and sports service process personal data under the following categories of lawfulness in the General Data Protection Regulation:

(a) The data subject has given consent to the processing of his or her personal data for one of more specific purposes
(b) Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
(c) Processing is necessary for compliance with a legal obligation to which the controller is subject
(d) Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity

The tasks that we carry out in exercise of official authority are mainly required under the following laws (although other legislation applies)

  • Health and Safety Legislation
  • General Data Protection Regulations
  • Financial Regulations
  • Ofsted requirements
  • National Health Service governance

Who are we likely to share this information with?

We may sometimes share the information that we have collected about you where it is necessary, lawful and fair to do so. We may share information with the following groups for these purposes:

Information is shared within the culture, tourism and sports section; refer to previous list of service contacts.

Software providers would have limited access to data when upgrading systems but have to comply with Harrogate Borough Council protocols and security.

Information is only shared on a need to know basis and is not generally circulated.

Sharing information during the Covid-19 pandemic crisis

Personal data or special category data may be shared with relevant organisations and agencies during the Covid-19 pandemic crisis. The lawful basis for sharing this information is that (1) it is necessary for the performance of a task in the public interest and (2) to protect the vital interests of an individual.

How do we keep this information secure?

Information which is held electronically is either held in files that are held on the council's servers or dedicated databases. These systems are password protected and only accessible to people who need access to them

Information which is held on paper is either stored in offices which are subject to access controls or in the dedicated archive provision for the council.

Where information is removed from the office for operational purposes the amount of this is minimised and staff are trained to ensure that this is kept secure at all times.

When computers make any decisions about you?

The culture, tourism and sports services do not make or use any automated decisions

When your data gets sent to other countries?

We do not send any information we collect about you outside the United Kingdom

How long do we keep this information?

  • the length of time that we keep information for varies because there are different business and statutory needs for different processes that we follow
  • financial information is held for seven years
  • financial information in respect of memberships is held for the duration of membership then for a further seven years post cancellation of membership
  • swimming class registers are held for the duration time in lessons plus one year
  • risk assessments are held for five years
  • accident reports are held for three years and for a child three years beyond the age of 18
  • museum's collections, information held in perpetuity
  • information is deleted once out of the required holding dates

What are your rights?

You have the right to request Harrogate Borough Council to stop processing your personal data in relation to any council service. Please read our main privacy notice for further details.