North Ayrshire Leisure Limited (“K:A Leisure”) takes your privacy very seriously.
In this privacy policy we are going to tell you about:
- What personal data we collect about you;
- How we collect your personal data;
- How we use your personal data;
- The basis on which we use your personal data;
- Who we share your information with;
- How long your personal data will be kept;
- Transferring your personal data outside of the United Kingdom;
- The steps we take to protect your personal data;
- The rights you have in relation to your personal data; and
- How to contact us about this policy.
Our use of your personal data is subject to your instructions, the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018, other relevant UK legislation and our professional duties to clients.
North Ayrshire Leisure Limited registered in Scotland under the Companies Acts, registered number SC202978 and having its registered office at 22 Quarry Road, Irvine, Scotland, KA12 0TH.
Our Data Protection Officer oversees compliance with data protection laws and this policy and provides guidance and advice to K:A Leisure as required.
Contact information for our Data Protection Officer is provided below under the heading “How to contact us about this policy”.
Children & Young Persons Privacy Notice
View our Children & Young Persons Privacy Notice here
What personal data we collect about you
We may collect information from you in the course of our business, including when you visit our premises or use our services, when you contact or request information from us, when you use our website, when you apply for a job with us or as a result of your relationship with one or more of our staff and clients.
The personal information we may collect about you includes:
- Contact information such as your name, title, address, telephone number, mobile phone number, job title, name of employer, employee number (NAC and KAL) and email address;
- Information about your use of our IT, communication and other systems including your password(s), and other monitoring information or information relating to materials and communications we send to you electronically;
- Information to enable us to check and verify your identity, e.g. your date of birth or passport details;
- Payment data, such as data necessary for processing payments and fraud prevention, including credit/debit card numbers, bank and building society details including security code numbers and other related billing information, as well as, where applicable, information relating to the source of funds;
- Information collected from publicly available resources and credit agencies;
- Details of your visits to our premises, including the capture of CCTV footage; and/or
- Membership of a professional or trade association or union.
In general, you will be able to choose whether or not to provide us with your personal data. If you do not provide the personal data that we need to collect then this may affect our ability to act on your behalf or to provide services to you, for example because this personal data is required to process your membership application. If you do not provide personal data we ask for, it may delay or prevent us from providing services to you.
How we collect your personal data
We collect most of this information from you:
- When you contact us to provide services;
- When you browse, provide information or use our website;
- When you make an enquiry for our services;
- Where you sign up to receive information from us;
- •Where you or your organisation provide services to us.
We may also collect information from third party sources including:
- Credit reference agencies or government agencies;
- Third party organisations that you have or have had dealings with.
We may also collect information via our website or via our information technology (IT) and other systems.
We use cookies on our website (for more information on cookies, please see our Cookies Policy).
How and why we use your personal data
Under data protection law, we can only use your personal data if we have a proper reason for doing so.
This will be for one of the following reasons:
- For the performance of our contract with you;
- To comply with our legal and regulatory obligations;
- For our legitimate interests or those of a third party;
- For the establishment, exercise or defence of legal claims or proceedings; or
- Where you have given consent.
A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests.
We may process special category personal data for the following reasons:
- Where you have given your explicit consent;
- For compliance with a legal obligation;
- For the purposes of establishing, exercising or defending legal claims;
- Where it is in your vital interests;
- Where you have made the personal data public; and/or
- For compliance with an employment law obligation.
There may be additional reasons which will be notified to you where they apply.
When we refer to special category data we mean information such as about race or ethnicity, religious beliefs, sexual orientation, marital status and health. Information about criminal convictions is also included within this type of data.
Managing our business
In relation to a number of uses of personal data we refer to above we are using such personal data on the basis that it is in our legitimate interests or those of a third party for us to do so. These interests cover a number of aspects of our business operations, namely:
- Ensuring that we are as efficient as we can be so we can deliver the best service for you at the best price;
- Preventing and detecting fraud and/or criminal activity that could be damaging for us and for you;
- For credit control purposes and to make sure our customers and members can pay for the services we provide;
- For the purposes of risk management so we can demonstrate we operate to the highest standards.
Marketing communications
We have a legitimate interest in processing your personal data for promotional purposes. This means we do not usually need your consent to send you promotional communications. However, where consent is needed, we will ask for this consent separately and clearly.
We will always treat your personal data with respect.
We use personal data to look at whether you read the emails and other materials that we send to you. We also use it to look at whether you click on the links included in such materials and whether and how you visit our website after you click on that link (immediately and on future visits). We do this by using software that places a cookie on your device which tracks this activity and records it against your email address. Please see our cookie policy for more information about our use of cookies. If you remove this cookie it will not affect your use of our website.
You have the right to opt out of receiving promotional communications at any time by:
• Contacting us at customerservice@kaleisure.com
• Using the ‘unsubscribe’ link in emails.
If you ask us to delete your information in accordance with your rights set out below, we will redact you from our database to avoid sending you unwanted materials in the future.
You can also update your marketing preferences and give us more detail of the type of information you would like to receive from us by contacting us on our preference centre.
We may ask you to confirm or update your marketing preferences if you instruct us to provide further services in the future, or if there are changes in the law, regulation, or the structure of our business.
Use of website
At a number of points on our website you are asked to provide information, for example. our contact page and our Careers page. At the point at which information is requested it is clear what the purpose of providing the information is and we will only use the personal data you provide to us for that purpose.
Our website makes use of Google Analytics to look at how our website is used. This is done by placing small text files, known as session cookies, on your device to collect information about how visitors use our website. We use the information to compile reports and to help us improve the site. The cookies collect information in an anonymous form, including the number of visitors to the site, where visitors have come to the site from and the pages they visited. This information is transmitted to and stored by Google on servers in the US.
Further details of our use of cookies can be found in our Cookie Policy
Who we share your personal data with
We share personal data and financial information with North Ayrshire Council on a confidential basis where required for the purposes of providing services (e.g. facility management services).
We also routinely share personal data with:
- Companies providing services for money laundering checks, credit risk reduction and other fraud and crime prevention purposes and companies providing similar services, including financial institutions, credit reference agencies and regulatory bodies with whom such personal data is shared;
- Third parties for the purposes of collecting your information to process direct debits, and other customer relation management;
- Our insurers and brokers, external auditors, banks and other third parties which provide services to us to allow us to fulfil our regulatory obligations and for risk management purposes;
- Courts, law enforcement authorities, regulators or lawyers or other parties where it is reasonably necessary for the establishment, exercise or defence of a legal or equitable claim, or for the purposes of a confidential alternative dispute resolution process or to comply with our legal and regulatory obligations;
- Third parties for the purposes of collecting your feedback our service provision, to help us measure our performance and to improve and promote our services;
- External service suppliers, representatives and agents that we use to make our business more efficient, e.g. technology service suppliers, marketing agencies, document collation, translators or analysis suppliers;
We will only allow our service providers to handle your personal data if we are satisfied they take appropriate measures to protect your personal data. We also impose contractual obligations on service providers to ensure they can only use your personal data to provide services to us and to you and to ensure compliance with data protection laws.
We may also, should the need arise, need to share some personal data with other parties, such as during a re-structuring. Usually, information will be anonymised but this may not always be possible.
The recipient of the information will be bound by confidentiality obligations.
We may also use aggregated personal data and statistics for the purpose of monitoring website usage in order to help us develop our website and our services.
Other than as set out above, we will only disclose your personal data when you direct us or give us permission, when we are required by applicable law or regulations or judicial or official request to do so, or as required to investigate actual or suspected fraudulent or criminal activities.
Personal data about other people which you provide to us
If you provide personal data to us about someone else (such as a member of your family or someone with whom you have parental or guardian responsibilities) you should ensure that you are entitled to disclose that personal data to us and that, we may collect, use and disclose that personal data as described in this privacy policy without taking any further steps.
How long your personal data will be kept
We will hold your data for no long than is necessary for the purposes set out in this privacy policy. We take account of the following criteria when deciding how long to retain your data:
- Legal and regulatory requirements and guidance;
- Limitation periods that apply in respect of taking legal action;
- Our ability to defend ourselves against legal claims and complaints;
- Good practice; and
- The operational requirements of our business.
When it is no longer necessary to retain your personal data, we will delete or anonymise it. If you would like more information about how long we hold particular types of personal information then please contact the Data Protection Office.
Updating personal data about you
It is important to keep your data up to date. If your circumstances change, please let one of Front of House teams know so they can update your details. You can also advise of any changes by contacting the Data Protection Officer. You should also use this email address if you want to cancel any request you have made to us or you become aware of any inaccuracy in the data we hold about you.
Transferring your personal data out of the United Kingdom
To deliver services to our clients, it is sometimes necessary for us to share your personal data outside the United Kingdom (UK), e.g.:
- Where our service providers are located outside the UK;
- If you are based outside the UK.
These transfers are subject to special rules under UK data protection law.
We will, however, implement appropriate safeguards to ensure the transfer complies with UK data protection law and all personal data will be secure. If you would like further information on these safeguards please contact our Data Protection Officer (see How to contact us about this policy below).
The steps we take to protect your personal data
We will take appropriate technical and organisational measures to keep your personal data confidential and secure. We have appropriate security measures in place which take account, in particular, of the risks arising from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.
The rights you have in relation to your personal data
Under certain circumstances, you have rights under data protection laws in relation to your personal information free of charge. You have the right to
- Request access to your personal information (known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
- Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
- Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal information to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
- Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal information for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
- Request restriction of processing of your personal information. This enables you to ask us to suspend the processing of your personal information in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
- Request the transfer of your personal information to you or to a third party. We will provide to you, or a third party you have chosen, your personal information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
- Not be subject to a decision based on solely automated processing if that produces a legal effect concerning you or similarly significantly affects you. Note that this right does not apply if the decision is (i) necessary for entering into, or performance of, a contract between us and you; (ii) authorised by law; or (ii) based on your explicit consent
- Withdraw consent at any time where we are relying on consent to process your personal information. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent.
If you wish to exercise any of the rights set out above, please contact the Data Protection Office.
Your objection (or withdrawal of consent) may mean we cannot perform the services you have requested of us or you may not be able to use the services we offer. We will advise you where this is the case. In certain circumstances even if you withdraw your consent we may still be able to process your personal information if required or permitted by law or for the purpose of exercising or defending our legal rights or meeting our legal and regulatory obligations.
You also have the right to complain to the supervisory authority. the Information Commissioner’s Office. Details on how to do this can be found here. We would, however, appreciate the chance to deal with your concerns before you approach the Information Commissioner so we would ask that you contact us in the first instance.
Our contact details can be found in the section below How to contact us about this policy.
How to contact us about this policy
Please contact us if you have any questions about this privacy policy or the information we hold about you.
Our contact details are shown below:
Data Protection Officer, North Ayrshire Leisure Limited, 22 Quarry Road, Irvine, Scotland, KA12 0TH email
This privacy notice was last updated on 3 December 2021 by: KA Leisure. Registered Office: 22 Quarry Road, Irvine KA12 0TH; Tel: 01294 315120; Fax: 01294 315140; email: info@kaleisure.com North Ayrshire Leisure Limited is a Company Limited by Guarantee No. 202978 and a recognised Scottish Charity No. SCO29780.
