Hampshire Outdoor Centres Privacy Notice

The General Data Protection Regulations and Data Protection Act 2018 require organisations, businesses, and the government to keep your personal information secure and to only use it in accordance with the data protection principles.

Introduction

We ensure that any personal information used by us or given to us is treated in accordance with data protection legislation.

Hampshire Outdoor Centres (HOC) is a service within Hampshire County Council (HCC). The service has four Outdoor Centres, Calshot Activities Centre (CAC), Hampshire & Mountain Centre (HMC), Runway’s End Outdoor Centre (RWE)and Tile Barn Outdoor Centre (TB). This privacy notice covers all four centres listed.

This detailed privacy notice explains how HOC use your personal information and the ways in which we protect your privacy. It should be read in conjunction with the HCC General Privacy Notice.

Details of the County Council’s approach to data protection can be found in the County Council’s Data Protection Policy.

Where we collect your personal information from

We may collect personal information about you* in the following ways.

*or the individual /group of individuals you are bringing with you to one of our Centres.

Data you provide

  • when you register to use our services
  • when you talk to us on the phone or at one of our centres
  • when you use our website
  • when you purchase a product from us In email or letters to us
  • when you take part in HOC competitions or promotions
  • when you give us feedback on our services

Data we collect when you use our services

  • Payment and transaction data
  • Profile and usage data including data using cookies (please see the HCC General Privacy Notice for details about cookies)

Data we collect about you

We may collect, use, store and transfer different kinds of personal data about you to manage our business. These together as follows:

  • Identity data – name, title, date of birth of children using our services
  • Contact data – location, postcode, email address or telephone numbers
  • Medical data – information about your health and dietary needs
  • Transaction data – details of services you have purchased from us, including date and time of booking and spend in relation to that booking.
  • Direct Debit data – your banking information to process your ongoing payment arrangements with us.
  • Profile data – purchases or orders made by you, your interests, preferences, feedback and survey responses, preferences about the use of the services (including whether you are interested in certain events that we offer).
  • Usage data – information about how you use our website, products, and services
  • Marketing and communications data – your preferences in receiving marketing from us and your communication preferences.
  • Photography and filming – your image to support marketing and sales.

We also collect and use aggregated data such as statistical or demographic data for analytical purposes. Aggregated data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

How we use your personal information and who we share it with

Your privacy is protected by law. We are only allowed to use personal information about you if we have a legal basis to do so, and we are required to tell you what that legal basis is. We have set out in the table below: the personal information which we collect from you, how we use it, and the legal ground on which we rely when we use the personal information.

In some circumstances we can use your personal information if it is in our legitimate interest to do so, if we have told you what that legitimate interest is. A legitimate interest is when we have a business or commercial reason to use your information which, when balanced against your rights, is justifiable. If we are relying on our legitimate interests, we have included our reasons in the table below.

Where we share your personal information with third parties, the details are included in the table below.

Where we rely on consent to process personal information about children – we will require the consent of the person(s) holding parental responsibility for that child during their visit.

What personal information we collect What we use your personal information for Our legal grounds for processing
Identity
Contact
Medical
To register you as a new or returning customer Performance of a Public Interest task
Where necessary for reasons of substantial public interest (ie for health and safety purposes)
Identity
Contact
Medical
Transaction
To process and deliver your booking Performance of a Public Interest task
Where necessary for reasons of substantial public interest (ie for health and safety purposes)
Identity
Contact
Transaction
To manage payments or collect and recover money owed to us Performance of a Public Interest task
Identity
Contact
Transaction
To manage our relationship with you – including notifying you about changes to our terms or privacy notices Performance of a Public Interest task
Identity
Contact
Transaction
To enable you to partake in a prize draw or competition or to complete a survey Performance of a Public Interest task
Identity
Contact
To review and respond to your complaint, enquiry, or compliment about our service Performance of a Public Interest task
Identity
Profile
Usage
To use data analytics to improve our products, services, marketing, or customer relationships and experiences Performance of a Public Interest task (to define customer types, to develop our business, to keep our website and business relevant or to inform our marketing strategy)
Identity
Contact
Transaction
Profile
Usage
Marketing and communication
To make suggestions and recommendations to you about the services that may be of interest to you Consent

Who we share your personal information with

To manage our business, we may need share your information with third parties. The table below sets out when this will happen.
Your interaction with us Third Party we share information with and why
If you book a course or activity or purchase a product, service or membership that is primarily managed via our website/online booking portal BookingLive
Supplier of bookings system

Cinolla
Supplier of memberships and bookings system
If you attend a course which results in an external qualification or certification External accrediting bodies
These are detailed in specific course information
If you purchase* a parking pass for, or hold boat storage or boat launching membership at Calshot Activities Centre (including concessions) New Park Solutions
Automatic Number Plate Recognition (ANPR) system supplier
If you are a member, visitor, or guest of the CAC Climbing Wall Gladstone MRM Ltd
HOC Climbing Wall membership system supplier
If you have an accident reportable under HSE regulations Health and Safety Executive
Statutory requirement
If you sustain an injury requiring medical treatment Medical professionals
To support effective medical procedures
If you pay membership fees via Direct Debit Your bank and HCC’s Bank
To enable your payments to be processed
If you participate in the Laser Climb activity ValoClimb
Laser climb activity system supplier;

*includes concessions

Failing to provide personal data

Where we need to collect personal data by law, or under the terms of the contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with services). In this case, we may have to cancel the services, but we will notify you if this is the case at the time.

How long we keep your personal information for

Your interaction with us What personal information we collect How long will we keep it for
When there is a financial transaction* Identity
Contact
Transaction
Vehicle registration
Bank details**
6 years plus current financial year
When you have taken out a membership* Identity
Contact
Medical
Vehicle registration
A maximum of 3 years plus current financial year from the expiry date of your membership
Where you are using our facilities in a 'self taught' capacity

Identity
Contact
Qualification

21 years plus current financial year
Where you have sustained an injury during your visit Identity
Contact
Medical
Adult - 3 years
Youth - 21 years
Where you have reported an incident during your visit Identity
Contact
Medical
3 years
When you have made a complaint about our service Identity
Contact
7 years
When you have visited or contacted our sites for any other reason Identity
Contact
Medical
A maximum of 1 year plus current financial year

*where there is a financial transaction relating to membership the longer retention period applies
**only where you have arranged payments by direct debit

Visiting our sites

CCTV is in operation at our sites for security purposes to protect staff and customers. Automatic Number Plate Recognition is in operation at Calshot Activities Centre to assist with management of car parking fees.

Marketing

We may use your personal information to tell you about relevant services and any upcoming offers. We can only use your personal information to send you marketing messages if we have your consent.
You can ask us to stop sending you marketing messages at any time – you just need to contact us or use the opt-out links on any marketing message sent to you. Where you opt out of receiving marketing messages, this will not apply to personal data provided to us as a result of purchasing our services or any other transaction between you and us.

Newsletter subscriptions

Your data will only be used to provide you with news and information on the subjects you have requested. We may use your data to better target our communications to you so that you receive more information about the things which interest you.

Your details will be not be shared with third party companies and data you supply will be retained on an ongoing basis, until such time as the newsletter ceases to exist or you choose to unsubscribe from that newsletter. You can unsubscribe at any time using the ‘Manage my subscriptions’ or ‘Unsubscribe’ links contained in our newsletters.

Filming and photography

We will never take photographs or videos for promotional use without your explicit consent. We may at our discretion take photographs which may be used for promotional purposes but only if those in view cannot be identified by their face, e.g. photos at a distance or where the face cannot be seen.

Should we wish to take any promotional photos or videos, we will give you the option to take part and will ask that you complete a separate photography consent form. This will be kept on file for five years and your consent can be withdrawn at any time The period of consent is five years from the date of signing. After this time the image/film and personal data will be deleted from our records. We will not include details or full names (which means first name and surname) of any person in an image or recording without seeking further consent.

Your consent can be withdrawn at any time in writing. Email: ccbs.governance@hants.gov.uk

When images are uploaded to social media sites, they will be subject to the terms and conditions of those sites.

Please note that websites and social media sites can be seen throughout the world and not just in jurisdictions where UK law applies. Neither you nor the County Council will have control over how those images are further used.

Third party links

Our website may include links to third party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice or policy of every website you visit.

Further information

You have some legal rights in respect of the personal information we collect from you. See our Data Protection page for further details.

You can contact the County Council’s Data Protection Officer by email data.protection@hants.gov.uk.

If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner’s Office.