Privacy Policy

This Privacy Policy relates to personal data processed and stored by Surrey Sports Park. Surrey Sports Park is a wholly owned subsidiary of the University, which runs the sports facilities for the University of Surrey, for students, staff and public members. We are registered as a data controller with the Information Commissioner’s Office and are committed to ensuring that the personal data we process is handled in accordance with data protection legislation. We have a named Data Protection Officer, Frances Teding Van Berkhout, who can be contacted via dataenquiries@surrey.ac.uk

This Privacy Policy is designed to protect you, our users by informing you how personal data is collected, how we look after that data and with whom we share it. Surrey Sports Park and the University of Surrey are committed to complying with the General Data Protection Regulation (GDPR).

What personal data do we collect and why?

What personal data we collect from you depends on what you are doing at Surrey Sports Park. For members we need to collect more personal data than for people who make the occasional visit.

Why do we process your personal data?

• Surrey Sports Park has a legitimate interest in processing your personal data. We use your personal data so that you can use the facilities at Surrey Sports Park and for us to keep records of the process.
• We will process your personal data if you have a contact with Surrey Sports Park. The most common form is when you have a membership at Surrey Sports Park to allow us to meet the terms of the contract that exists between us. This will include us to collecting direct debit payments if you pay via this method.
• We would like to send you marketing information, to which we will ask you for your consent. You can choose to opt-out or opt-in at any time.
• We are required by legal obligation to keep information about accidents which may occur at Surrey Sports Park and this will include personal data.

Personal data that we collect

• When you join Surrey Sports Park we will collect your name, date of birth, contact information and a limited amount of heath information
• If you are Student of the University of Surrey and you take out a University of Surrey Student
  membership then you will be asked to consent to your University contact information being
  provided to Surrey Sports Park
• If you are not a member and make a booking here then we will need to collect your name, postal address, email address, Date of Birth and either a mobile or landline number
• For all members and bookings, each individual person will be assigned a unique identifier which is used across our booking system to allow Surrey Sports Park to manage your use our facilities. In addition we may issue a member with a Membership card, which has a further unique identifier
• If you contact us by email, via the website, in person or by telephone we may keep a record of your contact information and enquiry and may subsequently use your contact details to respond to your enquiry

Data relating to children

• All memberships for anyone under the age of 18 require that we have parental consent. All personal data provided about anyone under the age of 18 must be provided by a parent or guardian

Details of your transactions

• We collect data for any transactions you carry out through our website and directly at Surrey Sports Park, so that we can administer the services you have with us. Please note that we never store your payment details on our website or in our database

Sensitive Health Data

• If you join Surrey Sports Park or register for an online booking account then we will ask for a limited amount of health data. We use this data to ensure that you have no significant health issues that may impact on you while taking part in activates at Surrey Sports Park or in the event of an issue, to assist in any necessary medical assistance

Banking data

• If you pay for your membership through a Direct Debit mandate we need to store your bank account number, sort code, bank name and account name data. When your membership finishes we will remove your banking data within one month of the last date that payment was taken
• We process payment card (credit card or debit card) information at the time we take payment. This data is not stored on our systems and is processed on Payment Card Industry Data Security Standard compliant systems

Information about website visits including IP address.

• The IP address is your computer’s individual identification number. We use your IP address to capture information about website visits so we can learn more about how our customers use the website in order to find ways to improve the website and our products and services for your benefit
• We may occasionally add Facebook pixels to certain pages of our website in order to collect information about your visit such as what pages you visited and what action was taken. This could entail us capturing information on which browsers have visited our site and then re-using that information for re-targeted advertising on other sites. This process helps us to track the value and accuracy of our marketing activities. No personal data is obtained from this process.

Customer feedback

• We will record customer comments and surveys about how we are performing

Your communications preferences

• We keep a record of any permissions and preferences you give us about what types of
  communication you are happy to receive from us

How do we look after your personal data?

• We maintain our systems in a secure environment, limiting access to your personal data to
  those who need it to provide our services to you
• We will contact you according to your preferences
• We will update your personal data or preferences promptly when you ask us to
• We will let you see what personal data we hold about you when you request it
• We will never sell your personal data to a third party
• We will ensure that all personal data is held within the EEA (European Economic Area)

Retention Policy

• We keep your personal data only for as long as we need to be able to contact you, for our legitimate business reasons or to meet any legal obligations. You have the right to ask for your data to be removed from the system, see the contacts section

Services provided by contracted third parties

Surrey Sports Park does not share your personal data with any third parties except;

• Our parent company, the University of Surrey
  • We use the University of Surrey to process Direct Debit payments. This uses
    external systems to allow Direct Debit payments to be validated and submitted –
    these are provided by Bottomline and BACS
  • We use the University of Surrey access control system to limit access to various parts
    of Surrey Sports Park (e.g. the swimming pool) to those members who are eligible to
    use the facility. Where access is granted via a membership card or a University of
    Surrey card, then we send your name, membership identifier, membership card
    number and memberships
  • We use the University of Surrey to invoice to individuals and to make payments to individuals who are suppliers to Surrey Sports Park
• The University of Surrey Students Union. For members of Surrey Sports Park who have a
  University of Surrey Student membership, we will provide a list of members to the Students
  Union to ensure that all students taking part in Team Surrey activities have a Surrey Sports
  Park membership
• Support of our Leisure Management System (LMS) is provided by Xn Leisure. There will be
  times when they have access to the system for upgrades, enhancements and problem
  resolution. Access to the LMS is controlled by Surrey Sports Park and changes are
  monitored
• We use MailChimp to send emails to our members and guests. You can withdraw consent
  for us to send you marketing emails at any point. Access to the data held in MailChimp is
  restricted to only those who need use it as part of their job
• We use 4Global to allow us to manage the members and guest data. Access to the data held in 4Global is restricted to only those who need to use it as part of their job

Marketing Partners

• Surrey Sports Park will never sell or give your personal data to any third party for marketing or other purposes. Subject to your consent we may send you information about our partners and other third parties

How do we use your personal data?

• We use your personal data to help us provide and improve our services for you. We may use your personal data in the following ways
  • to provide you with any services that you have purchased
  • to check your identity
  • to validate your eligibility for memberships and activities
  • to check that our copy of your personal data is correct
  • to let you know about any changes to an existing booking
  • to provide marketing communications, subject to your consent
  • for research and analysis so we can develop and improve our services for your benefit
  • to meet any legal obligations

Keeping you informed

• There are some communications that we will need to send to you as part of our service to you. Without these we would not be able to provide you with our services – examples of these include changes to passwords, conformation of bookings, changes to opening hours, notification of major events that may impact you visiting Surrey Sports Park and notices about any direct debit payments
• For all other communications with Surrey Sports Park you can choose if you want to receive them. All of our emails allow you to unsubscribe from any email sent by Surrey Sports Park to that email address. You can also opt out by contacting us directly either via email, phone and at Surrey Sports Park. Details are provided in the contacts section

Your rights to manage your personal data

• Accuracy of data
  • If you think that the data we hold about you is incorrect, then we will update it when requested. You can do this either directly at Surrey Sports Park or contact our Data Controller, see the contacts section. We will need to confirm that any request to change your personal data has come from you. Please note that for anyone over the age of 18 we can only accept changes of personal data from the individual member. Personal data changes for any members under the age of 18 can only be made
    by the parent / guardian we have linked to the membership as they are the point of contact we have on record
  • For students at the University of Surrey who have a University of Surrey Student membership, any changes that you make to your personal data with the University of Surrey, that has been shared
    with Surrey Sports Park, will be sent to Surrey Sports Park. This will also include any new Student cards that you get from the University. Students cannot make changes at Surrey Sports Park to their personal data
  • Staff who use their University of Surrey staff card to access the facilities at Surrey Sports Park should contact Surrey Sports Park if their personal data has changed

Seeing your data – subject access request

• Under the General Data Protection Regulations you can request to see what data we at Surrey Sports Park hold about you, this is called a Subject Access Request. You do this by contacting the Data Controller, see contacts section. We will need to confirm your identify before we are able to supply your personal data

Right to be forgotten

• If you wish that we no longer retain any personal data about you, then you can request that your data is removed from our systems. Subject to legal or financial constraints we will remove your data. Please write to the Data Controller, see contacts section, about this

If you have a complaint

• If you are not happy about the way we manage your personal data then please contact us as quickly as possible. You can write to the Data Controller – who will investigate your complaint and get back to you as soon as possible

Information Commissioner’s Office (ICO)

• The Information Commissioner’s Office (ICO) is the UK’s independent authority which regulates the use of personal data. You have the right to contact them should you wish. Details can be found on their website: https://ico.org.uk/

Links to other websites

• Our websites may contain links to and from third party website. If you follow a link to other sites please note that these will be governed by their own privacy policies. We cannot accept liability for data use on those websites

Changes to this privacy policy

• This policy may be updated from time to time. The latest version will always be available on our website. You can request the latest version by asking at Surrey Sports Park or request one from our Data Controller, see contacts section

Contacts

• The easiest way to contact us is directly at Surrey Sports Park when you visit us. We can normally resolve any issues at that time.
  Should you wish to send an email, then send it to dataenquiries@surreysportspark.co.uk
  Alternatively, should you wish to write, you can contact our Data Controller at the following address
  Data Controller
  Surrey Sports Park
  Richard Meyjes Road
  Guildford
  Surrey
  GU2 7AD
  We will aim to reply within five working days.

Like many other websites, we use small text files (called cookies) which are stored on your browser to perform a variety of functions. Below is some information covering the types of cookies our website uses and why.

Analytics Cookies

We use Google analytics to track how people find and use our website. We use this information to identify how well this site is working, which areas are performing well and what areas could potentially be improved. This information is gathered anonymously and stored by Google.

Conversion Tracking Cookies

We spend money on various online marketing channels (like Google Adwords). To monitor the performance of our marketing efforts we sometimes use conversion tracking cookies associated with specific actions (eg signing up to our newsletter) so we can measure how effective each marketing avenue has been.

Embedded Video Cookies

Sometimes we embed videos from other websites such as vimeo.com on our website. When we embed a video this allows the video provider to also set cookies on your browser. In most cases they will be using cookies to gather information which will allow them to improve their service. For more up to date information about specific cookies check with the video provider.

Social Media Cookies

We try to be as active as possible on various social media platforms and as such use a number of social media tools on this website. Each tool and plugin will be able to set cookies on your browser. For the most up to date information about specific social media cookies please check with the social media website in question.