Privacy notice

This privacy notice is to let you know how we promise to look after your personal information. It explains how we do this and tells you about your privacy rights and how the law protects you.

Brimhams Active is a community health and wellbeing company wholly owned by North Yorkshire Council.

This privacy notice covers the following areas of Brimhams Active Limited operated on behalf of North Yorkshire Council:

  • Harrogate Leisure and Wellness Centre
  • Starbeck Pool, Harrogate
  • Knaresborough Leisure and Wellness Centre
  • Ripon Spa Baths
  • Jack Laugher Leisure and Wellness Centre
  • Nidderdale Leisure and Wellness Centre
  • administrative office Jennyfield Styan Wellbeing Hub, Harrogate
  • tourism
  • museums service
  • Jennyfield Styan Wellbeing Hub
  • Fairfax Wellbeing Hub
  • Knaresborough Wellbeing Hub
  • health and active lifestyles
  • Turkish Baths Harrogate
  • Little Explorers Day Nursery (previously Coppice Valley Nursery)

What information do we collect?

The type of information we collect will depend on why you have got in touch with us. The information will include some or all of the following:

  • name (adults/children)
  • address
  • contact details
  • date of birth
  • email addresses
  • emergency contact numbers
  • financial information
  • medical information
  • characteristics (such as age, ethnicity and language)
  • doctors name and telephone number
  • membership/activity details

Who uses this information?

Which areas internally to Brimhams Active Limited and North Yorkshire Council use this data?

  • ICT when doing a system upgrade
  • other appropriate sections in North Yorkshire Council when required, for example where involved in the resolution of complaints, legal issues, insurance claims, health and safety matters and financial transactions

External to Brimhams Active Limited and North Yorkshire Council

  • software providers
  • BACS systems
  • Ofsted and Tapestry (Ofsted development package)
  • Ombudsman
  • National Health Service and relevant agencies
  • Visit Harrogate
  • customers where appropriate

Why do we use this information?

  • direct debit billing
  • contacting customers
  • updating of membership details
  • booking of classes and activities
  • emergency situations (medical history/incident)
  • send email/text messages
  • creating individual exercise programmes
  • monitoring progression
  • course management
  • data protection requests where appropriate
  • freedom of information requests where appropriate

What authority does Brimhams Active Limited have to collect and use this information?

Brimhams Active Limited processes personal data under the following categories of lawfulness in the General Data Protection Regulation:

  1. the data subject has given consent to the processing of his or her personal data for one of more specific purposes
  2. Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
  3. Processing is necessary for compliance with a legal obligation to which the controller is subject
  4. processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity

The tasks that we carry out in exercise of official authority are mainly required under the following laws (although other legislation applies):

  • Health and Safety Legislation
  • General Data Protection Regulations
  • Financial Regulations
  • Ofsted requirements
  • National Health Service governance

Who are we likely to share this information with?

We may sometimes share the information that we have collected about you where it is necessary, lawful and fair to do so. We may share information with the following groups for these purposes:

  • information is shared within the culture, tourism and sports section; refer to previous list of service contacts
  • software providers would have limited access to data when upgrading systems but have to comply with North Yorkshire Council protocols and security
  • information is only shared on a need to know basis and is not generally circulated

Sharing information during the Covid-19 pandemic crisis

Personal data or special category data may be shared with relevant organisations and agencies during the Covid-19 pandemic crisis. The lawful basis for sharing this information is that (1) it is necessary for the performance of a task in the public interest and (2) to protect the vital interests of an individual

How do we keep this information secure?

Information which is held electronically is either held in files that are held on North Yorkshire Council's servers or dedicated databases. These systems are password protected and only accessible to people who need to access them.

Information which is held on paper is either stored in offices which are subject to access controls or in the dedicated archive provision for the council.

Where information is removed from the office for operational purposes the amount of this is minimised and staff are trained to ensure that this is kept secure at all times.

When computers make any decisions about you?

Brimhams Active Limited do not make or use any automated decisions.

When your data gets sent to other countries?

We do not send any information we collect about you outside the United Kingdom

How long do we keep this information?

  • the length of time that we keep information for varies because there are different business and statutory needs for different processes that we follow
  • financial information is held for seven years
  • financial information in respect of memberships is held for the duration of membership then for a further seven years post cancellation of membership
  • swimming class registers are held for the duration time in lessons plus one year
  • risk assessments are held for five years
  • accident reports are held for three years and for a child three years beyond the age of 18
  • museum's collections, information held in perpetuity
  • information is deleted once out of the required holding dates

What are your rights?

You have the right to request Brimhams Active Limited and North Yorkshire Council to stop processing your personal data in relation to any council service.