Introduction
The University of Southampton’s Southampton Sport work-stream engages in the provision of activities and facilities to enhance your wellbeing through a comprehensive range of courses and classes including watersports, swimming, fitness, health and wellbeing and Student Union (SUSU) club activities. We value your privacy and or that of your child and we recognise the need to process your data and or your child’s data in a fair and lawful manner.
The University of Southampton is a data controller that facilitates your data through the leisure management system Gladstone. Gladstone MRM Ltd is also a data controller along with their authorised sub-controllers. Gladstone privacy policy. Both of these parties are responsible for deciding how we hold and use data about you and or your child.
The University of Southampton is the data controller for the information that we hold about you on our SharePoint. This means that we are responsible for deciding how we hold and use data stored about you or your child.
You are being given a copy of this privacy notice because you have provided us with your data and or your child’s data to enable you and or your child to take part in our activities and to use our facilities. It makes you aware of how and why your data and or your child’s data will be used and how long it will usually be retained for. It provides you with certain information that must be provided under the General Data Protection Regulation (GDPR). Our registration number with the Information Commissioner’s Office is Z6801020.
Data refers to the information that we hold about you and or your child from which either on its own or in combination with other information you and or your child can be identified and may include names, contact details, photographs, identification numbers and online identifiers. A list of the data we collect is set out below. Processing means doing anything with your data and or your child’s data, such as collecting, recording or holding the data as well as disclosing, destroying or using the data in any way.
This notice may be amended from time to time and you can obtain a current version at Southampton Sport.
Data protection principles
We will comply with data protection law and principles, which means that your data will be:
- used lawfully, fairly and in a transparent way
- collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes
- relevant to the purposes we have told you about and limited only to those purposes
- accurate and kept up to date
- kept only as long as necessary for the purposes we have told you about
- kept securely
What data does the University collect?
In connection with providing you and or your child with activities and facilities we will collect, store, and use the following categories of data about you and or your child:
- The data you have provided relating to yourself and or your child including name, title, address, personal email address, date of birth, age and gender
- Membership details of the Athletic Union
- Medical and disability information
- Photographs
- Information about whether you are University staff or student members
- Identification numbers associated with you attributable by the University including your student or staff number
- Online identifiers when you use our website
- Current interests and preferences
- Attendance at our facilities and activities undertaken
- Bank or credit or debit card details
- Records of all contact we have with you
- Details about the completion of your course, if applicable
- Your registered doctors
- Any other data you provide to us to support your use of our activities and facilities
What if you do not provide your data?
If you fail to provide data when requested, we may not be able to successfully set up your account on our membership system and provide you with access to our activities and facilities.
Why does the University process data?
We need to process your data and or your child’s data to enable us to fulfil our contract with you and to enable you to access the activities and facilities we offer under the terms of that contract.
It also enables us to:
- Resolve general enquiries
- Assess your eligibility for membership services
- Provide the membership services
- Monitor attendance and activities to manage use of the facilities and to contact you with information or offers tailored to your interests
- Process your payment for such membership services
- Process your membership card including taking photographs
- Manage any complaint or disciplinary action
- Inform you about similar products that either Active Nation or we offer if you have given your consent to that
- Invite you to the Alumni Sports Day
- Report on anonymised community participation engagement
How the University uses Special Category data
We may collect, store and use special categories of more sensitive data that you give us about your or your child’s pre-existing medical condition so that we can make any necessary adjustments to the activities we provide to you and or your child.
We also collect, store and use special category data about your health including any medical condition and or disability that you and or your child may have to enable us to comply with our health and safety obligations and to assist emergency services in the event of an accident.
Under our GP referral scheme we will often require specialised category data. We will only process sensitive data where you have given your explicit consent unless we are legally obliged to do so.
Right to withdraw consent
Where you have given your consent to us processing your special category data and or your child’s special category data you have the right to withdraw that consent for processing at any time.
If you are a staff member you can withdraw consent or to update your details through the ASKHR portal. If you are a student you can do this through Banner, otherwise, you can email southamptonsport@soton.ac.uk.
Once we have received notification that you have withdrawn consent, we will no longer process your data and or your child’s data and, subject to our record retention schedule, we will dispose of your data and or your child’s data securely.
If you do withdraw your consent this may mean that we can no longer provide you and or the child access to certain activities or continue with our services.
Processing for limited purposes
We will only process your data and or your child’s data for the specific purpose or purposes that we tell you about, or if specifically permitted by the Data Protection Act UK 2018. We will only process your data and or your child’s data to the extent necessary for that specific purpose or purposes.
Accuracy
We will keep the data we store about you and or your child accurate and up to date as relevant to the purpose or purposes for which we process it. Data that is inaccurate or out of date will be destroyed. Please notify us if your details or that of your child change or if data we hold about you or your child is inaccurate.
How will your data be collected?
We obtain your data and or your child’s data directly from you. Southampton Sport will also obtain Athletic Union Club lists from the SUSU to facilitate bookings and monitor facility usage. These lists will be requested throughout the year.
If you are a member of the University community your information will be collected via interface with two systems. Student data will be collected from Banner the University Student Information System. Staff data will be collected from Cognos, the University Staff Information system.
GP referral information for specialised category data will be stored on SharePoint, with contact details being added to Gladstone MRM.
How will your data be secured?
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
As a data controller, we limit access to your data and or your child’s data to those employees of the University who have a business need-to-know. They will only process your data and or your child’s data on our instructions and they are subject to a duty of confidentiality.
As a data controller Gladstone MRM Ltd employees will have access to your data and more detail an be found on their Privacy Notice Statement.
Holding and retaining your data
We will retain your data and or your child’s data for different periods depending on the purposes we are using it for. After this period, we will securely destroy your data and or your child’s data in accordance with our retention policy.
For all offsite activities including water sports we hold medical forms in hard copy for the period of the activity for administration and health and safety purposes. After the activity has ceased, we will securely destroy your data and or your child’s data in accordance with our record retention schedule.
Who has access to your data?
Your data and or your child’s data will be shared internally within the University for the purposes of providing you with access to our activities and facilities.
Gladstone MRM Limited as the data controller.
We will only share your data with Active Nation with your consent for the purpose of enabling you to have access to those additional facilities operated by Active Nation, such as The Quays, Southampton Outdoor Sports Centre, Bitterne Leisure Centre and Chamberlayne Leisure Centre. The data that is shared is used to confirm your entry into those facilities and to confirm that you are a current member. If you are no longer a member your data will automatically be taken off the list sent to Active Nation.
For members of Athletic Union clubs and Intramural teams, we share and exchange data with the Students’ Union Sport Zone to facilitate the club’s use of Southampton Sport facilities. This information is shared in line with the data sharing agreement between the University of Southampton and the Southampton Students’ Union. We will also exchange data in the event of a first aid incident to ensure that both organisations can control and review risk management.
Where either yourself or your child are completing a course offered by Southampton Sport and certified by the Royal Yachting Association (RYA) we will add your data or your child’s data onto the RYA website to enable a certificate to be generated. These details are held by the RYA on their servers. We enter the details you have given us being your or your child’s name, DOB, gender, postal address, email address and phone number.
Where you are participating in a swimming lesson we need to add your data and or your child’s data onto the swim management software “Swim Soft”. This hosted site allows us to administer the Swim School services. We add your and or your child’s name, DOB, gender, postal address, email address, phone number, medical details. The reports written for participants or to parents on their (child’s) progression are also securely hosted on this site.
Exceptionally, we may disclose your data and or your child’s with a third party if required to do so: to protect or defend the University’s rights, interests, or property, or those of third parties; act in urgent circumstances to protect the personal safety of University constituents, or the public; or protect against legal liability.
All third-party data recipients are required to take appropriate security measures to protect your data and or your child’s data in line with our policies. We do not allow our third-party data recipients to use your data and or your child’s data for their own purposes. We only permit them to process that data for specified purposes and in accordance with our instructions. If you are participating in the Health Trainer programme as a referee from the local GP's practice we will receive data including special category data via a secure University e-mail that can only be accessed by the Health trainer and management. Any special category data will then be transferred to Sharepoint and contact details will be kept on Sharepoint and Gladstone, to facilitate bookings. The Health Trainer will share the health data back to the referring GP's practice.
Automated decision making and profiling
None of the data collected about you and or your child will be used as part of any automated decision making or to build a profile of you and or your child.
Your rights
You and or your child have a number of rights. You can:
- access and obtain a copy of your data on request
- require us to change incorrect or incomplete data
- require us to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing
- object to the processing of your data where we are relying on our legitimate interests as the legal ground for processing
- ask us to stop processing data for a period if data is inaccurate or there is a dispute about whether or not your interests override the organisation's legitimate grounds for processing data
If you would like to exercise these rights please use our online form or write to:
The Data Protection Officer
Legal Services
University of Southampton, Highfield
Southampton, SO171BJ
Email: data.protection@soton.ac.uk
Unwanted communications
If at any stage you are concerned about the content of any communications from Southampton Sport, for example, unwanted marketing information or you wish to change how we communicate with you please contact us at: southamptonsport@soton.ac.uk
Further information
We also have additional policies and guidelines concerning particular activities. If you would like further information please see our Publication Scheme.
If you are unhappy with the way that we have handled your data and or your child’s data you can contact us at: southamptonsport@soton.ac.uk or contact the Information Commissioner’s Office.