The Privacy Notice below explains how we use information about you and how we protect your privacy.
We have a Data Protection Officer who makes sure R Lukins Fitness respects your rights and follows the law. If you have any concerns or questions about how we look after your personal information, please contact the Data Protection Officer, at firstname.lastname@example.org
What information we collect, and why.
The basis on which we collect and process your data is usually through consent. Sometimes there is a contractual reason such as being able to process a monthly direct debit payment. Occasionally there may be a legal reason for collecting data, such as for employees when we have to collect the information for the HMRC, or, should you have an accident, we may need to provide details of this to the relevant health and safety authorities. We may also process your data based on our legitimate business interests for example in order to operate and improve our business.
Information you type into our websites or provide to one of our colleagues such as when you become a member, create your profile, update your member profile, provide activity data from other devices, make a booking, sign up as a volunteer, or visit the R Lukins Fitness. This information may include your personal contact data, fitness-related data which has been obtained in order to create personalised fitness workouts for you or health related data. We use this to provide you with the services you request, tell you about services you are eligible for, to keep in contact with you, manage your account and keep you safe when using the facilities. If you contact us by email, via the website, in person or by telephone we may keep a record of your contact information and enquiry and may subsequently use your contact details to respond to your enquiry.
Personal Information we may collect about you may include (but is not limited to)
The information we collect is required for the purpose of creating your Member Account and for you to access the gym. Such information allows you to be identified as a member of R Lukins Fitness Ltd and includes:
Data of birth
Computer IP address
Dependent Details (only where applicable)
Your contact with us, such as a note or recording of a call you make to our contact centre, an email or other records of any contact you have with us
Your membership information – such as dates of payment owed and received, the services you use and any other information related to your account
Some information is sensitive and needs extra care. It’s often information you would not want widely known and is very personal to you. This is likely to include anything that can reveal information relating to your:
Physical or mental health
We collect any personal health data you provide to us when registering and signing up for our health services. We collect this information to ensure we are offering you the right services and so your progress can be tracked by yourself and us, in addition to ensure the exercises you are doing isn’t detrimental to your health or wellbeing. We may ask you for information about your health in order to recommend appropriate exercise regimes or offer our other services.
This can also include data that is used to recognise you such as biometric data, CCTV and member profile photos. We may view or use this data and share with appropriate authorities should they request it due to crime or misconduct.
We will only do this if we have your consent or if there are legal requirements for us to do so. We may receive information about you from other data controllers, such as the police who might tell us about a crime they are investigating where this impacts on your contract with us. If you give us this information about yourself when communicating with us, you do so because you consider it forms part of a legitimate interest for us to hold this information on our records.
If we ask for any sensitive personal data about you, we will always tell you why we need it and ask for your consent to hold it.
When do we collect the information?
We collect your personal information when you:
· Sign up for a gym or casual membership and complete the PARQ and Membership Agreement forms
· Register interest for upcoming event
· Book or attend an exercise class or lesson
· Ask us for more information about a product or service, or contact us with a question or complaint
· Contact one of our staff through telephone, email, or social media
· Send an email to the @rlukinsfitness.co.uk email account
· Enter your PIN number, swipe your fob, or use the biometric fingerprint reader to enter the gym
· You have an accident in the gym or there was an incident where you were a witness or personally affected
· When you book classes, courses and inductions
· CCTV – when you are using the facility or surrounding areas*
*When using the gym CCTV is being recorded 24 hours a day. CCTV is permanently erased after 31 days
We will store your bank account number and sort code data where you have a Standing Order or Direct Debit mandate in place. When the Standing Order/Direct Debit finishes we will remove this data from our operational systems within 90 working days. The Standing Order form for the membership payments will be manually handed into one of the customer’s bank branches, or send by post.
Before posting any images online or any names mentioned on social media, the individual will be asked to give verbal consent.
Why do we need your personal information?
We may need to use some information about you to:
· deliver services and support to you
· to carry out our obligations arising from any contracts entered into between you and us
· manage those services we provide to you;
· service improvement
· prevention/detection of crime/fraud
· help investigate any complaints you have about our services
· check the quality of our services
How the law allows us to use your personal information
There are a number of legal reasons why we need to collect and use your personal information.
Generally we collect and use personal information for the purposes of where:
· you are entering or have entered into a contract with us/started a gym membership/are a casual user of the gym
· you, or your legal representative, have given consent
· it is necessary to protect someone in an emergency
· it is required by law
· you have made your information publicly available
· it is necessary for legal cases
· it is necessary for archiving, research, or statistical purposes
Consent and Your Preferences
We may contact you or send communications to tell you about a service enhancement such as improvements to your local site or to keep you informed of your current membership status. We won’t need your consent to communicate with you this way because we have assessed that it forms part of our agreement with you and it is of mutual interest for us to keep you informed and is relevant to your contract with us.
We would like to occasionally send you information on other products and services we offer, and which we think will be of interest to you. We will ask for your consent to communicate this type of information to you, you can remove your consent and ask us to stop at any time.
If we have consent to use your personal information to send you information on our products and services, you have the right to remove it at any time.
We only use what we need
Where we can, we’ll only collect and use personal information if we need it to deliver a service or meet a requirement.
If we don’t need personal information we’ll either keep you anonymous if we already have it for something else or we won’t ask you for it. For example in a survey we may not need your contact details so we’ll only collect your survey responses.
If we use your personal information for research and analysis, we’ll keep you anonymous or use a different name unless you’ve agreed that your personal information can be used for that research.
We won’t sell your personal information to anyone else.
You can ask for access to the information we hold on you
You have the right to ask for the information we have about you. When we receive a request from you in writing, we must give you access to what personal information we’ve recorded about you.
However, we can’t let you see any parts of a record which contain:
· Confidential information about other people; or
· May be held in preparation to defend legal claims
This applies to personal information that is in both paper and electronic records. If you ask us, we’ll also let others see your record (except if one of the points above applies).
A request for personal information can be made via email or in writing. This is known as a subject access request. In order to make a subject access request you will need to provide the following information:
· your name
· your address
· proof of identity and signature
· enough information to identify your records
· 2 forms of identification (e.g. passport & driving licence)
You can ask to change information you think is inaccurate
You should let us know if you disagree with something we may have recorded about you.
We may not always be able to change or remove that information but we’ll correct factual inaccuracies and may include your comments in the record to show that you disagree with it.
You can ask to delete information (right to erasure)
In some circumstances you can ask for your personal information to be deleted, for example:
· Where your personal information is no longer needed for the reason why it was collected in the first place
· Where you have removed your consent for us to use your information
· Where there is no legal reason for the use of your information
· Where deleting the information is a legal requirement
Please note that we can’t delete your information where:
· we’re required to have it by law
· it is necessary for legal claims
You can ask to limit what we use your personal data for
You have the right to ask us to restrict what we use your personal information for where:
· you have identified inaccurate personal information, and have told us of it
· where we have no legal reason to use that information but you want us to restrict what we use it for rather than erase the information altogether
We will assess whether you have a right to a restriction and where restriction of use has been granted, we’ll inform you before we carry on using your personal information.
Where possible we’ll seek to comply with your request, but we may need to hold or use information because we are required to by law or we have a legal basis to do so, such as a contract.
Keeping your information secure
We store personal information both electronically and in paper form.
We implement security policies, processes and technical security solutions to protect the personal information we hold from:
· Unauthorised access
· Improper use or disclosure
· Unauthorised modification
· Unlawful destruction or accidental loss
When you contact us, we may ask you to provide us with some information so that we can confirm your identity. If other people (e.g. family members, support workers, solicitors) act on your behalf we will take steps to ensure that you have agreed for them to do so. This may include asking them to provide us with supporting information to indicate your consent. We do this to protect you and to make sure that other people cannot find things out about you that they are not entitled to know.
Employees and third parties who have access to, or are associated with the processing of, your personal information are obliged to make reasonable efforts to safeguard it.
How we use your telephone number
Text messages and contact via telephone provide a direct way to contact and share information with you about the services we can deliver to you. It can also help you to receive important messages about your membership, important site updates e.g. temporary closures and other services that we provide you.
If you provide your telephone number we may keep in contact with you by text.
Operational SMS/text messaging and calls
If you supply us with your telephone contact details, we may use them to call or send you operational text messages.
Examples of operational text messages include:
· Confirming an appointment, that you have requested
· Emergency site updates from your local centre
· Asking you to contact a named person or department
Who do we share your information with?
We use a range of organisations to either store personal information or help deliver our services to you. Where we have these arrangements there is always an agreement in place to make sure that the organisation complies with data protection law.
We may enter into partnerships with other organisations such as local authorities and the police. In order to protect your information, we will enter into a legally binding data sharing agreement with partner organisations before any sharing takes place. It is not always possible for us to tell you that personal information is being shared, for example when we are working with the police or other agencies to help the investigation or detection of a crime as to do so may prejudice that investigation.
We are likely to share your personal information with the following:
We may share your personal information with the police for the purposes of preventing or detecting a crime or fraud.
· Safeguarding and Support Agencies
We may need to share your personal information with support agencies if we suspect that there may be safeguarding concerns about yourself or those who are your dependent(s). We will not tell you about this beforehand, we will take steps to only share that personal information which is necessary for the safeguarding purposes.
· Debt Recovery Agents
We may share your personal information with debt recovery agents for the purposes of recovering any outstanding charges owed to us.
· Legal Services and Partners
We may share your personal information with our legal services or solicitors if we are preparing or defending a legal claim.
· Business Asset Transactions
If we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.
Where there is a high risk to your personal information we will complete a privacy assessment before we share personal information to make sure we protect privacy and comply with the law.
Sometimes we have a legal duty to provide personal information to other organisations, this is often because we need to give that data to the police, courts, local authorities or government bodies.
We may also share your personal information when we feel there’s a good reason that’s more important than protecting your privacy. This doesn’t happen often, but we may share your information:
· in order to detect and prevent a crime and fraud; or
· if there are serious risks to the public, our staff or to other professionals;
· safeguarding of vulnerable individuals
If we’re worried about your physical safety or feel we need to take action to protect you from being harmed in other ways, we’ll discuss this with you and, if possible, get your permission to tell others about your situation before doing so.
For all of these reasons the risk must be serious before we can override your right to privacy.
We may still share your information if we believe the risk to others is serious enough to do so.
There may also be rare occasions when the risk to others is so great that we need to share information straight away.
If this is the case, we’ll make sure that we record what information we share and our reasons for doing so. We’ll let you know what we’ve done and why if we think it is safe to do so and will not cause harm, distress or further risks to you, our staff, other professionals and/or the public.
How do we protect your information?
We’ll do what we can to make sure we hold records about you (on paper and electronically) in a secure way, and we’ll only make them available to those who have a right to see them. Examples of our security include:
· Encryption, meaning that information is hidden so that it cannot be read without special knowledge (such as a password). This is done with a secret code or what’s called a ‘cypher’. The hidden information is said to then be ‘encrypted’
· Controlling access to systems and networks allows us to stop people who are not allowed to view your personal information from getting access to it. Any paper information will be stored in a locked file.
· Training staff allows us to make them aware of how to handle information and how and when to report when something goes wrong
· Regular testing of our technology and ways of working including keeping up to date on the latest security updates (commonly called patches)
· We respect your wishes about how we contact you, whether by post, telephone, email or text message
· We will update your information or preferences promptly when you ask us to
· We will respond fully to requests from you to see the information that we hold on you.
· We will not hold your personal information for longer than is necessary for our legitimate business purposes.
· We will never sell your personal information to a third party.
How long do we keep your personal information?
There’s often a legal or a contractual reason for keeping your personal information for a set period of time. We will keep your information for the duration of providing a service or product to you under the terms of a contract, such as your membership contract. When your contract has ended we will keep your personal data for a set time for auditing and reporting purposes and for legitimate interest purposes, after that time we will destroy your information.
How do we use your information?
We use your information to help us provide and improve our services for you. We may use your information in the following ways.
· to provide you with any services that you have purchased or receive free as part of a health or other scheme
· to check your identity
· to check your eligibility where appropriate
· to update our records with any new information you give us
· to notify you if we will be unable to provide a service you have booked before
· to provide marketing communications (if you have given us your permission)
· for research and analysis so we can develop and improve our services for your benefit
· to tailor our communications to you to ensure relevance (if you do not want us to do this please contact us using the details below)
· To comply with legal requirements.
· To safeguard users of our services
. To respond to any questions or concerns you might have about our services
Where we process your personal data based on your consent you have the right to withdraw consent at any time, for example your consent to receive direct marketing. If you no longer want to receive marketing messages from us, please visit the ‘contact us’ page on the website. You can choose to opt out of all marketing or select your marketing preferences. Alternatively, if you are no longer a member, and wish to remove your consent to receive marketing content please contact by email to email@example.com
Keeping you updated
There are certain communications we need to send to you so we can provide our services. We call these service communications and include for example notices about your standing order/direct debit payments, change of password, registration confirmations, appointment reminders and waiting list announcements. We would not be able to provide you with services if we did not send these.
How to tell us of a data breach
R Lukins Fitness Ltd takes responsibility to protect the personal information we hold about those with whom we work seriously. We are accountable for our processing and take necessary technical and operational steps to maintain information security protections.
If you suspect your personal information or that of others may have been at risk of a data protection breach, please contact us as soon as possible.
YOUR PRIVACY RIGHTS
You have the following rights in relation to your data privacy: the right of access; the right of rectification; the right of erasure (the “right to be forgotten”); the right to restriction of processing; the right to be notified; the right to data portability; the right of objection; and the right to not be subject to automated profiling.
Access. You have the right to ask for a copy of the information we hold about you and to have any inaccuracies in your information corrected. Please contact us through email firstname.lastname@example.org, or the contact us section of the website
Rectification. If you believe we’re holding inaccurate information about you, or your personal details change, please see a member of staff to update your profile.
Erasure. You have the right to the erasure of the data we hold on you, when it is no longer needed for the purposes of your Membership, or when you withdraw your consent for our processing (and we have no other lawful basis to hold your data).
Restriction. You have the right to ask us to place restrictions on processing your data in certain circumstances.
Notification. You have the right to be notified of any rectification, erasure or restrictions in relation to your personal data.
Portability. You have a right to receive the data we hold on you electronically in a format that allows it to be easily transferred to another data controller.
Object. You have the right to object to data processing of your personal data for direct marketing or profiling purposes.
Profiling. You have the right not to be subject to any decision based on automatic processing of your personal data.