Dumfries & Galloway College (the College) is providing you with this information to comply with data protection law to ensure that you are fully informed and that we are transparent in how we collect and use your personal data.
Your privacy and trust are very important to us and this Privacy Notice provides essential information about how the College handles your personal data and the rights you have in relation to how we use your data. The College is committed to complying with all applicable Data Protection legislation.
Who are we?
Dumfries & Galloway College is the ‘Controller’ and is responsible for looking after the personal data that you provide.
Dumfries & Galloway College
For any queries or concerns about how your personal data is being processed, you can contact the Data Protection Officer (DPO) at DPO@dumgal.ac.uk.
This privacy notice relates to the following process:
Booking an induction at the College gym and fitness facilities (brand name – The Workout)
Purpose for processing – why do we collect information about you?
We collect and use your information for the following purposes:
To form part of the contract between yourself and the College to enable us to provide you with access to The Workout facilities.
Our lawful bases (reason) for processing your information are:
- You have given consent for the use
- Use is necessary for the performance of a contract with yourself
The data being used includes special category (sensitive) data. Our legal reason for using this sensitive data are:
- You have given explicit consent to the processing.
- Use is necessary to protect a person’s vital interests.
- Use is necessary for the establishment, exercise or defence of legal claims or where courts are acting in their judicial capacity.
- Use is necessary for the purposes of preventative or occupational medicine and the provision of health or social care or treatment or management of health or social care systems and services.
What information do we collect about you?
We collect the following personal data as part of your application for an induction to The Workout:
- Name, date of birth and contact details
- Contact details for an emergency contact and GP contact details
We also ask for some ‘special category data’ – medical history and medication – to ensure you have no medical conditions that would preclude you from using The Workout facilities.
How do we collect it?
Your personal information is collected when you complete the form to book an induction to The Workout.
If you were to withhold the information we require for this process, the consequences would be:
That we would not be able to provide you with an induction to The Workout which would preclude your use of the College gym and fitness facilities.
Who do we share your information with?
The personal data you provide as part of the booking process for an induction to The Workout will not be shared with any third parties with the exception of the emergency services or appropriate medical professionals in the event of an accident or injury at The Workout where you are unable to provide this information yourself, under the protection of your vital interests.
Details of data transfers to any third countries or international organisations
Your information will not be shared outside of the UK.
How do we look after your information and how long do we keep it for?
We will take all reasonable steps to prevent the loss, misuse or alteration of information you give us. Your personal information will be stored securely and will only be accessed by authorised staff, agents, contractors and other organisations who have a business need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality and must comply with data protection law.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
For College students – Your information will be kept until the end of the current academic year in line with the College’s data retention schedule and then will be destroyed confidentially.
For College staff – Personal data provided will be kept until you are no longer employed by the College, or for three years from the date of your induction, whichever comes first.
For other members – personal data provided will be kept for three years from the date of your induction.
Automated decision making processes, including profiling
We do not use any automated decision making about you.
Under Data Protection laws you have certain rights in relation to how the College manages and uses your personal information:
- The right to be informed (this is the Privacy Notice)
- The right to access your personal data
- The right to rectification if the personal data we hold about you is incorrect
- The right to restrict processing of your personal data
In addition the following rights apply only in certain circumstances:
- The right to withdraw consent at any time (if consent is our lawful basis for processing your data)
- The right to object to our processing of your personal data
- The right to request erasure (deletion) of your personal data
- The right to data portability
- The right not to be subject to automated decision making including profiling.
For more information about your rights please see www.ico.org.uk.
If you have any issues about this notice or the way the College has handled your personal information, please contact our Data Protection Officer in the first instance:
Telephone: 01387 734 364 or write to:
Data Protection Officer
Dumfries & Galloway College
Complaints to UK Information Commissioner’s Office (ICO)
If you are dissatisfied with the response from the College you have the right to lodge a complaint with the Information Commissioner’s Office about our handling of your data:
You can do this online: ICO Online
By telephone: 0303 123 1113
Or write to:
Information Commissioner’s Office