Controller

Atlantis Leisure, the operating name of Oban and Lorn Community Enterprise Company, is the controller of any personal information collected by us that is necessary for our processing purposes.

Atlantis Leisure as a charity delivers sporting and learning activities on behalf of the community and visitors to lead richer and more active lives. Atlantis Leisure is committed to protecting your privacy.

Why we collect information on you
Atlantis Leisure needs to collect and hold information about you to:

• Deliver its service to you;

• Confirm your identity to provide services to you;

• Contact you by post, email or telephone;

• Be aware of your needs to provide services you request;

• To provide you with a safe, enjoyable and effective programme, event or activity;

• For the purposes of managing, delivering, promoting, evaluating and improving our leisure and health programmes, events and activities;

• To be able to provide you with due care in a medical event or accident requiring first aid treatment or to contact someone in an event of an emergency;

• To advise you of other activities that may be of interest to you;

• To run our business in an efficient and proper way. This includes managing our financial position, business capability, planning, communications, corporate governance, and audit;

• To prevent or detect fraud and corruption;

• To make sure we meet our statutory obligations including those related to equality and health and safety.

Atlantis Leisure will always be open and transparent with you about how we use your personal data and who it is shared with. If we do not have enough information, or your permission to use certain information, we may not be able to provide your requested service or product.

How we collect your personal information
Personal information can be collected in the following ways:

• On paper or by electronic form

• Customer account or online forms

• Email

• Telephone

• Website

• CCTV

• Face to Face

The personal data we collect
You might be asked for the following information:

• Name

• Address

• Date of birth

• Email address

• Telephone number

• Credit card details

• Bank account details

• Ethnicity

• Gender

• Disability

This personal information will only be used to process transactions and data for the purpose of providing you with the services you have requested or to comply with our legal duty. We will be clear in our Privacy Notices what we will do with your data.

Legal Basis

In order to process your personal information we have to have a legal basis on which to do so. We will tell you what this is when we collect the information. The only lawful basis we can use will be one of the following:

1. On the basis of your consent

2. Necessary for the performance of a contract with you (or to take steps to enter into a contract with you)

3. Necessary for compliance with a legal obligation to which Atlantis Leisure is subject

4. Necessary to protect the vital interests of you or another person

5. Necessary for the performance of a task carried out in the public interest

6. Necessary for the legitimate interests of Atlantis Leisure or a third party.

We would expect that the lawful basis we will be relying upon will normally be 1 or 2 above.

Your rights in relation to your data

The law on data protection gives you specific rights in relation to your data that we hold. These are:

• The right to be informed. This means that we must tell you how we use your data, and this is the purpose of this privacy notice.

• The right of access. You have the right to access the data that we hold on you. To do so, you should make a Subject Access Request.

• The right for any inaccuracies to be corrected. If any data that we hold about you is incomplete or inaccurate, you can ask us to correct it.

• The right to have information deleted. If you would like us to stop processing your data, you have the right to ask us to delete it from our systems. If we have no legal basis to continue to hold your data we must remove from our systems.

• The right to restrict the processing of the data. For example, if you believe the data we hold is incorrect, we will stop processing the data (whilst still holding it) until we have ensured that the data is correct.

• The right to portability. You can obtain and reuse your personal data held by us by moving, copying or transferring your data from one IT environment to another in a secure way and without affecting its usability.

• The right to object to the processing of your personal data. You have the right to object to the processing of your data if it is used for direct marketing or collected for a task carried out in the public interest, the exercise of official authority, or under legitimate interest.

• The right to regulate any automated decision making and profiling of personal data. We must tell you if we use automated decision making and/or use your personal data for profiling and you have the right to object. There are strict guidelines we must follow if we use your personal data in this way.

How we use your information

We will conform to the Data Protection Act and General Data Protection Regulations and use your information to –

• Undertake administrative processes to provide the service you requested

• Process financial transactions including payments for services

• Provide a service to you

• Protect individuals from the risk of harm or injury, where necessary

• Allow statistical analysis of data (that you cannot be personally identified from) so we can target and plan the provision of services

• To send you information about our services and events if you have asked us to. If you have any questions about how we use your personal details, please contact

  nick.wesley@atlantisleisure.co.uk

  You can also submit a subject access request if you require a copy of any data that involves you.

How we keep your information safe
We keep your personal information safe by –

• Only retaining it for as long as we need to

• Checking that effective safeguards are in place

• Making sure all employees handling your information have had appropriate training

• Having processes in place to monitor, identify and deal with misuse by employees

• Processing all personal data in accordance with the principles of the Data Protection

Act and General Data Protection Regulations.

How we share your information

We are also legally obliged to share certain data with other public bodies, such as HMRC, and will do so where the law requires this. In general, we will comply with requests for specific information from other regulatory and law enforcement bodies where this is necessary and appropriate or share information with them if it is in our own legitimate interests to do so.

In order to provide services to you, we may need to appoint other organisations (as processors) to carry out some activities on our behalf. These may include, for example, payment processing organisations, delivery organisations, mailing houses and contractors or consultants providing services to us where we need to provide them with limited personal information, to allow them to provide these services on our behalf. We select these organisations carefully and put measures in place to make sure that they are not allowed to do anything with your personal information which Atlantis Leisure would not do themselves.

We will not sell your personal data to any third parties.

Keeping your personal data

We will keep your personal information for as long as you are a customer of Atlantis Leisure. After you stop being a customer, we will retain your data in accordance with our retention policy.

We may also keep it for research or statistical purposes. If we do, we will make sure that your privacy is protected by anonymising the data and only use it for that purpose. We only keep your information for as long as necessary, for some items this will be dictated by law.

Withdrawing consent

Where we use your personal information with your consent, you may withdraw that consent at any time and we will stop using your personal information for the purpose(s) for which consent was given.

Please contact us if you wish to carry out any of these rights.

Transfer of personal data

We do not routinely process any information about you outside the European Economic Area (EEA) except in rare cases, where we use all appropriate safeguards.

Contact Us
You can contact our data protection officer about any data protection matter by:

Post:
Nick Wesley, Atlantis Leisure, Dalriach Road, Oban, Argyll, PA34 5JE

E-mail: nick.wesley@atlantisleisure.co.uk Telephone: 01631 566800

Complaints

Our data protection officer aims to directly resolve all complaints about how we handle personal information (see Contact Us above).
However, you also have the right to lodge a complaint about a data protection matter with the Information Commissioner’s Office, who can be contacted by:

Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Phone: 0303 123 1113 (local rate) or 01625 545 745.

You can visit their website for more information at https://ico.org.uk/concerns