Hampshire Outdoor Centres Privacy Notice
Introduction
We ensure that any personal information used by us or given to us is treated in accordance with data protection legislation.
Hampshire Outdoor Centres (HOC) is a service within Hampshire County Council (HCC). The service has four Outdoor Centres, Calshot Activities Centre (CAC), Argoed Lwyd Outdoor Education Centre (ALOEC), Runway’s End Outdoor Centre (RWE) and Tile Barn Outdoor Centre (TB). This privacy notice covers all four centres listed.
This detailed privacy notice explains how HOC use your personal information and the ways in which we protect your privacy. It should be read in conjunction with the HCC General Privacy Notice.
Details of the County Council’s approach to data protection can be found in the County Council’s Data Protection Policy.
Where we collect your personal information from
We may collect personal information about you* in the following ways.
*or the individual /group of individuals you are bringing with you to one of our Centres.
Data you provide
- when you register to use our services
- when you talk to us on the phone or at one of our centres
- when you use our website
- when you purchase a product from us In email or letters to us
- when you take part in HOC competitions or promotions
- when you give us feedback on our services
Data we collect when you use our services
- Payment and transaction data
- Profile and usage data including data using cookies (please see the HCC General Privacy Notice for details about cookies)
Data we collect about you
We may collect, use, store and transfer different kinds of personal data about you to manage our business. These together as follows:
- Identity data – name, title, date of birth of children using our services
- Contact data – location, postcode, email address or telephone numbers
- Medical data – information about your health and dietary needs
- Transaction data – details of services you have purchased from us, including date and time of booking and spend in relation to that booking.
- Direct Debit data – your banking information to process your ongoing payment arrangements with us.
- Profile data – purchases or orders made by you, your interests, preferences, feedback and survey responses, preferences about the use of the services (including whether you are interested in certain events that we offer).
- Usage data – information about how you use our website, products, and services
- Marketing and communications data – your preferences in receiving marketing from us and your communication preferences.
- Photography and filming – your image to support marketing and sales.
We also collect and use aggregated data such as statistical or demographic data for analytical purposes. Aggregated data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.
How we use your personal information and who we share it with
Your privacy is protected by law. We are only allowed to use personal information about you if we have a legal basis to do so, and we are required to tell you what that legal basis is. We have set out in the table below: the personal information which we collect from you, how we use it, and the legal ground on which we rely when we use the personal information.
In some circumstances we can use your personal information if it is in our legitimate interest to do so, if we have told you what that legitimate interest is. A legitimate interest is when we have a business or commercial reason to use your information which, when balanced against your rights, is justifiable. If we are relying on our legitimate interests, we have included our reasons in the table below.
Where we share your personal information with third parties, the details are included in the table below.
Where we rely on consent to process personal information about children – we will require the consent of the person(s) holding parental responsibility for that child during their visit.
| What personal information we collect | What we use your personal information for | Our legal grounds for processing |
|---|---|---|
| Identity Contact Medical |
To register you as a new or returning customer | Performance of a Public Interest task Where necessary for reasons of substantial public interest (ie for health and safety purposes) |
| Identity Contact Medical Transaction |
To process and deliver your booking | Performance of a Public Interest task Where necessary for reasons of substantial public interest (ie for health and safety purposes) |
| Identity Contact Transaction |
To manage payments or collect and recover money owed to us | Performance of a Public Interest task |
| Identity Contact Transaction |
To manage our relationship with you – including notifying you about changes to our terms or privacy notices | Performance of a Public Interest task |
| Identity Contact Transaction |
To enable you to partake in a prize draw or competition or to complete a survey | Performance of a Public Interest task |
| Identity Contact |
To review and respond to your complaint, enquiry, or compliment about our service | Performance of a Public Interest task |
| Identity Profile Usage |
To use data analytics to improve our products, services, marketing, or customer relationships and experiences | Performance of a Public Interest task (to define customer types, to develop our business, to keep our website and business relevant or to inform our marketing strategy) |
| Identity Contact Transaction Profile Usage Marketing and communication |
To make suggestions and recommendations to you about the services that may be of interest to you | Consent |
Who we share your personal information with
To manage our business, we may need share your information with third parties. The table below sets out when this will happen.| Your interaction with us | Third Party we share information with and why |
|---|---|
| If you book a course or activity or purchase a product, service or membership that is primarily managed via our website/online booking portal | BookingLive Supplier of bookings system Cinolla Supplier of memberships and bookings system |
| If you attend a course which results in an external qualification or certification | External accrediting bodies These are detailed in specific course information |
| If you purchase* a parking pass for, or hold boat storage or boat launching membership at Calshot Activities Centre (including concessions) | New Park Solutions Automatic Number Plate Recognition (ANPR) system supplier |
| If you are a member, visitor, or guest of the CAC Climbing Wall | Gladstone MRM Ltd HOC Climbing Wall membership system supplier |
| If you have an accident reportable under HSE regulations | Health and Safety Executive Statutory requirement |
| If you sustain an injury requiring medical treatment | Medical professionals To support effective medical procedures |
| If you pay membership fees via Direct Debit | Your bank and HCC’s Bank To enable your payments to be processed |
| If you participate in the Laser Climb activity | ValoClimb Laser climb activity system supplier; |
*includes concessions
Failing to provide personal data
Where we need to collect personal data by law, or under the terms of the contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with services). In this case, we may have to cancel the services, but we will notify you if this is the case at the time.
How long we keep your personal information for
| Your interaction with us | What personal information we collect | How long will we keep it for |
|---|---|---|
| When there is a financial transaction* | Identity Contact Transaction Vehicle registration Bank details** |
6 years plus current financial year |
| When you have taken out a membership* | Identity Contact Medical Vehicle registration |
A maximum of 3 years plus current financial year from the expiry date of your membership |
| Where you are using our facilities in a 'self taught' capacity |
Identity |
21 years plus current financial year |
| Where you have sustained an injury during your visit | Identity Contact Medical |
Adult - 3 years Youth - 21 years |
| Where you have reported an incident during your visit | Identity Contact Medical |
3 years |
| When you have made a complaint about our service | Identity Contact |
7 years |
| When you have visited or contacted our sites for any other reason | Identity Contact Medical |
A maximum of 1 year plus current financial year |
*where there is a financial transaction relating to membership the longer retention period applies
**only where you have arranged payments by direct debit
Visiting our sites
Marketing
Newsletter subscriptions
Your data will only be used to provide you with news and information on the subjects you have requested. We may use your data to better target our communications to you so that you receive more information about the things which interest you.
Your details will be not be shared with third party companies and data you supply will be retained on an ongoing basis, until such time as the newsletter ceases to exist or you choose to unsubscribe from that newsletter. You can unsubscribe at any time using the ‘Manage my subscriptions’ or ‘Unsubscribe’ links contained in our newsletters.
Filming and photography
We will never take photographs or videos for promotional use without your explicit consent. We may at our discretion take photographs which may be used for promotional purposes but only if those in view cannot be identified by their face, e.g. photos at a distance or where the face cannot be seen.
Should we wish to take any promotional photos or videos, we will give you the option to take part and will ask that you complete a separate photography consent form. This will be kept on file for five years and your consent can be withdrawn at any time The period of consent is five years from the date of signing. After this time the image/film and personal data will be deleted from our records. We will not include details or full names (which means first name and surname) of any person in an image or recording without seeking further consent.
Your consent can be withdrawn at any time in writing. Email: [email protected]
When images are uploaded to social media sites, they will be subject to the terms and conditions of those sites.
Please note that websites and social media sites can be seen throughout the world and not just in jurisdictions where UK law applies. Neither you nor the County Council will have control over how those images are further used.
Third party links
Further information
The above information is the specific privacy notice for this service. For more information about your rights in relation to your personal data, see the County Council’s general privacy notice.
You have some legal rights in respect of the personal information we collect from you. See our Data Protection page for further details.
You can contact the County Council’s Data Protection Officer by email [email protected].
If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner’s Office.
