Campus Sport & Leisure Limited Data Protection and Privacy Notice
Who we are
Campus Sport & Leisure Limited trading as UCD Sport & Fitness, Sport Facilities & Student Centre registered company number 512243 is a wholly –owned subsidiary of University College Dublin. Full details on how to contact us are given at the end of this statement.
About this statement
Throughout this statement, “we”, “our”, and “us” refer to UCD Sport & Fitness, Sport Facilities & Student Centre; “You” and “your” refer to those whose data we process because they were or are a customer or member of UCD Sport & Fitness, Sport Facilities & Student Centre, or because they have enquired, applied for membership (this includes those who are linked members of a group/couple/family membership), enquired, book our facilities or enquired, enrolled in courses/sessions about UCD Sport & Fitness, Sport Facilities & Student Centre.
UCD Sport & Fitness, Sport Facilities & Student Centre collects, uses and is responsible for certain personal data. This is known as “processing”. When we do so, we are regulated under data protection legislation and we are responsible as the “data controller” of that personal data for the purposes of those laws.
Personal data, or personal information, means any information about an individual from which that person can be identified. Under data protection legislation, there is also ‘special category’ personal data, which is more sensitive personal data. This includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data.
The purpose of this statement is to explain how UCD Sport & Fitness, Sport Facilities & Student Centre processes your data (see definition of ‘you’/’your’ above), what rights you have in relation to that data, and to provide transparency about that processing, as well as how to contact us and supervisory authorities should you have a query or complaint
What data we process, and why
We may collect, use, store and transfer (this is known as ‘processing’ in data protection legislation) different kinds of personal data about you and others, as follows:
- Identity Data: This includes your name, membership ID (UCD Student, Graduate or Staff number or assign a number), photo of you, date of birth/age, gender, UCD College details, and previous name (where needed to validate UCD record),
- Contact Data includes address(es), email address(es) and telephone/mobile number
- Financial Data includes bank account, payment and debit or credit card details, depending on method of payment.
- Transaction Data includes details about payments to and from you.
- Booking Details for outdoor and indoor hire
- Instructor/Trainer Details for Personal Training, Assessment cards and Swimming lessons etc
- Usage information: Including workout sheets, records of services/facilities access, personal trainer notes and assessment forms, swimming forms), etc.
- Marketing and Communications Data including your preferences in receiving communications from us
- ‘Fitness to use’ facility confirmation for membership applications.
- Statistical or demographic data to generate reports to understand demand and trends, to inform management decisions (this data is not used to make decisions about individuals).
- Agreement to terms and conditions
- Signature(s) of members on membership joining.
CCTV data: We operate a number of CCTV cameras on the premises for safety and security purposes.
Special Category Data
Special Categories of Personal Data includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data.
For some individuals, we will capture if they have recorded ‘no’ against the ‘Fitness to use The Facility’ field on the membership form, and whether GP approval has been given. This would be discussed at the time the membership form is completed.
Information captured during your use our facilities and services may include some health data. This processing will be done in order to allow us to meet our contractual obligations to deliver these services to you, to protect the vital interests of you or another person, and where you have given your consent which you can withdraw at any time.
Communications from us
You will receive marketing communications from us if you have requested information from us or entered/applied for a membership agreement with us and selected to receive this information, or, if you have provided us with your details when you entered a competition or registered for a promotion and have not opted out of receiving that marketing.
We will send any such marketing messages because we believe the information will be of value to you and you have asked to receive it, but you can opt-out of those messages by contacting us (see contact information at the end of this statement).
Where you opt out of receiving these marketing messages, this will not apply to communications that include important information about your membership or booking which we will continue to send to you. We will need to contact you at certain times to enable us to inform you about important information relating to our services and facilities and we will do this on the basis of our legitimate interests or contractual obligations. While we will seek to respect any communication preferences you have stated to us, this may not always be possible or appropriate. Please contact us if you have any concerns about this. Contact details are given at the end of this statement.
Third-party marketing
We will obtain your express opt-in consent before we share your personal data with any other company in order to allow them to market to you.
Legal Basis for Processing
We will only use your personal information when we have a legal basis to do so. Most commonly, we’ll use your personal information on the following legal bases:
Note that we may process your personal data for more than one lawful basis depending on the specific purpose for which we are using your data.
- Where it is necessary for the performance of a contract we have entered into, or are about to enter into, with you.
- Where it is necessary for the pursuit of our legitimate interests, such as to recover monies owed to us, to ensure you have the information you expect about your membership, to keep our records updated, and where your interests and fundamental rights do not override those interests.
- Where you have given your consent to the processing of the data. You can withdraw your consent at any time.
- To protect the vital interests of the data subject or of another person (for example, in the case of a medical emergency).
- Where it is necessary for the purposes of the prevention, investigation, detection or prosecution of criminal offences.
- Where it is necessary for compliance with a legal obligation.
- In some exceptional cases, we may process your personal data without your knowledge or consent, where there is a lawful basis for doing so.
We will not use your personal information to carry out any wholly automated decision-making that affects you.
What happens if you fail to provide information
In most instances, the information we request is needed in order to be able to proceed with, or continue your membership or your book and if you fail to provide that information, we may not be able to proceed with your membership contract, or we may not be able to allow you to take up responsibilities as member or your booking, but this would be explained to you at the time.
How we collect your personal data
We use different methods to collect data about you:
Normally, membership data is provided by filling in a membership form at our facilities, or over the telephone with the guidance of one of our team. For new members who wish to apply for UCD graduate, staff or student membership, we will refer to UCD to validate your details. Members who are linked to primary members, or children associated with an adult’s membership, will have information about them collected at the time of membership creation.
For booking our facilities or courses data is provided at sign up/booking our facilities, online, to receptionist or over the telephone with the guidance of one of our team.
From time to time, we will ask existing members to check your details are up-to-date, for example, around the time of contract renewals.
We may also capture some contact details and communication preferences about you if you make an enquiry about our services, in order to be able to respond to your enquiry in an appropriate way.
We may also invite you to take part in surveys or competitions which may involve a limited set of data for contact purposes, as needed. This would normally take place online.
When you attend or supervise classes or events, we will capture information in order to administer payment and operate these services.
Disclosures of your personal data
We may have to share your personal data with third parties as set out below for the purposes we have described above, as follows:
- With our processors (our service providers), who operate the following services: Car park administration systems; Accounts management systems; Membership administration systems; Services or Courses we provide; Facilities or Events booking services, Payment services.
- Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.
International transfers
We do not transfer your details outside of the EEA.
How long will we use your personal data for? We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
Your rights
Under certain circumstances, you have rights under data protection laws in relation to your personal data, including:
- Right of Access: You have the right to know what type of personal data UCD holds about you and to obtain a copy of this data.
- Right of Erasure: Under certain circumstances, GDPR allows you to have personal data erased. We will assess whether it is possible to implement such a request but please be aware that UCD will need to retain certain information about you in order to carry out our lawful functions.
- Right to Object: Under certain circumstances you can object to the processing of your personal data.
- Right to Portability: Under certain circumstances, you have the right to request that we provide elements of your data in a commonly used, machine-readable format.
Right to Rectification: You have the right to have any inaccurate personal data which we hold about you updated or corrected.
Right to Restriction: You have the right to block the processing of your personal data in certain circumstances. We will assess whether it is possible to implement such a request.
- Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
If you wish to exercise any of the rights set out above, or to opt-out of further marketing or promotional communications, or to change your details or ask us to communicate with you in a different way, please get in touch at any time using the contact details given at the end of this statement.
No fee is usually required to exercise your rights
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
What we may need from you if you decide to exercise your rights
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
Our time limit to respond
We try to respond to all legitimate requests within one month of written request. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Contact Information
Our full details are:
Data Protection Requests or Questions
To make a request about your data, such as a Subject Access Request, or to have your data corrected, or any other data protection related request, please contact us by emailing (opens in a new window)fitness@ucd.ie, or you can write to the following address:
GDPR Compliance Officer
Campus Sport & Leisure Limited
Belfield
Dublin 4
Queries or Complaints regarding the processing of your personal data
To make a GDPR query or complaint please put it in writing and send it to
GDPR Compliance Officer
Campus Sport & Leisure Limited
Belfield
Dublin 4
You also have the right to lodge a complaint at any time with the Data Protection Commission, Ireland’s supervisory authority for data protection, but we do ask that you come to us first and give us the opportunity to address your concerns wherever we can.
Details of how to lodge a complaint can be found on the (opens in a new window)Data Protection Commission’s website
Changes to this Statement
We regularly review our privacy information to ensure that it remains accurate and current.
If there are any changes, we will update these pages to tell you. From time to time, we may also tell you in other ways about the processing of your data where appropriate.