Privacy Notice for Sport and Active Lifestyles

Sport and Active Lifestyles are a service based in Leeds Beckett University (LBU) and LBU is the data controller for the information you provide. Details of your rights under UK data protection legislation, including details of LBU’s Data Protection Officer, your rights as a data subject, and your right to complain to the Information Commissioner’s Office are available in LBU's privacy notice.

If you have any questions or concerns about participation within Sport and Active Lifestyles and how your personal data will be collected and managed, please contact sport@leedsbeckett.ac.uk

Personal data means any information about an individual from which that person can be identified.

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data includes your name, title, student or staff identity, date of birth, pseudonymised data and gender and copies of identity documentation
• Contact Data includes your address, email, and telephone number(s)
• Financial Data includes bank account and payment card details
• Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us
• Health Data includes data that we may need to collect about you, including any medical condition, disability, health and sickness records
• Profile Data includes purchases made by you, your interests, preferences and feedback and survey responses
• Usage Data includes information about how you use our services
• Marketing and Communications Data includes your preferences in receiving marketing from us and your communication preferences

Public Health Data includes data that we may need to collect about you.

We may also collect, store, and use the following “special categories” information:

• Information about criminal convictions and offences
• Information about your race or ethnicity, religion, or belief and your sexual identity
• Trade union membership
• Information about your health, including any medical condition, health, disability and sickness records, including details of any absences (other than holidays) from work including time on statutory parental leave and sick leave
• Information about any requirements needed for pensions

We also collect, use, and share aggregated data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing one of our services. 

Most of the personal information we process is provided to us directly by you for one of the following reasons:

• Where we need to perform the contract, we have entered with you
• Where we need to comply with a legal obligation
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests

We may also use your personal information in the following situations, which are likely to be rare:

• Where we need to protect your interests (or someone else’s interests)
• In limited circumstances, with your explicit written consent
• Where we need to carry out our legal obligations or exercise rights in connection with employment
• Where it is needed in the public interest, such as for equal opportunities monitoring
• Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public

We also receive personal information indirectly, from the following sources in the following scenarios:  Disclosure and Barring Service (DBS) checks.

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data for more than one lawful basis depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal basis, we are relying on to process your personal data where more than one basis has been set out in the table below.

Marketing and Promotions

1. We may use your identity, contact, usage and profile data to form a view on what we think you may want or need, or what may be of interest to you and based on this market services to you
2. You will receive marketing communications from us if you have requested information from us or purchased services from us and you have not opted in to receiving that marketing
3. We will not share your personal data with any third party for marketing purposes
4. You can ask us to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you
   

Information will be shared with third parties only when necessary, as part of the provision of our services to you and/or we have a legal or regulatory requirement to do so. We anticipate that we will share information with the following third parties:

• National Governing Bodies (NGBs) within sport for the purpose of registration with them e.g. athletic union members, course completions, participating in a programme or event or agreement of a scholarship or award
• NGBs for the purpose of registration and certification of qualifications
• British Universities and Colleges Sport for the purpose of administration of competitions
• External examiners for the purpose of assessment
• Third parties involved in the delivery of courses and programmes
• Emergency services and regulatory bodies for the purpose of accident reporting, first aid provision and complying with health and safety investigations and reporting
• Third parties which undertake on behalf of the university for the purpose of providing payment processing and debt collection services

Where we anticipate the transfer of personal data outside of the United Kingdom, we will ensure we do so where there are adequate legal protections in place.

Where there is not currently an adequacy agreement in place the university will implement, in line with the UK General Data Protection Regulation (GDPR), the appropriate data protection safeguards as determined by regulatory bodies as a ground for data transfers from the EU to third countries.

We will only keep your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. At the end of a retention period, your personal data will be deleted securely and safely or anonymised.

Your personal data will be retained in accordance with the retention periods set out in our Records Retention Schedule and is recorded in the university Information Asset Register.

The university recognises and respects individual rights under the General Data Protection Regulation (GDPR). For further information please see our overarching Privacy Notice which explains your privacy rights.

Please see our overarching Privacy Notice for information on how to complain.

We keep our privacy notices under regular review. This privacy notice was last updated in June 2023.