Reviewed: May 2018
This Privacy Notice informs you about how Lee Valley Regional Park Authority (the “Authority”) looks after your personal data when you visit our websites (www.leevalleypark.org.uk or www.visitleevalley.org.uk) or otherwise engage in any way with the Authority and tells you about your privacy rights and how the law protects you.
It is important that you read this Privacy Notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This Privacy Notice supplements the other notices and is not intended to override them.
Lee Valley Leisure Trust Limited (trading as Vibrant Partnerships) (the “Trust”) currently operates many of the Authority’s leisure venues and manages the Authority’s websites on our behalf. The sales of products and services related to many of the Authority’s venues are concluded through www.ebookings.leevalleypark.org.uk. The Trust is the data controller of the personal data collected through www.ebookings.leevalleypark.org.uk.
What information do we collect?
The Authority is the data controller of the personal data you provide to us. Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
The Trust is the data controller of the personal data you provide when you order a product or service related to any of the following venues through www.visitleevalley.org.uk or www.ebookings.leevalleypark.org.uk:
Lee Valley Athletics Centre
Lee Valley Camping and Caravan Park, Edmonton
Lee Valley Campsite, Sewardstone
Lee Valley Caravan Park, Dobbs Weir
Lee Valley Golf Course
Lee Valley Hockey and Tennis Centre
Lee Valley Ice Centre
Lee Valley Marina, Springfield
Lee Valley Marina, Stanstead Abbotts
Lee Valley Park Farms
Lee Valley Riding Centre
Lee Valley VeloPark
Lee Valley White Water Centre
To join our mailing list you will be asked to create subscription profile based on your interests. We will ask you for your name, date of birth, telephone number, postal address and e-mail address along with areas of interest.
If you contact us by email or via the websites we may keep a record of your contact information and enquiry so that we may respond to your enquiry.
When you apply for one of our open job roles via our web portal you will be asked to submit relevant personal details and information for the position you are applying for so that we may consider you for the position. This information might include information provided to us in your curriculum vitae and covering letter, information provided on our application form and any information you provide to us during a subsequent interview.
If you apply to take part in volunteering activities with the Authority, or with the Trust as operator of many of the Authority’s venues, you will be asked to provide identity and contact data so that we may process your application and offer you volunteering opportunities with the Authority and/or the Trust.
If you submit a wildlife sighting, you will be asked to provide your name and email address so that we can verify the sighting and complete the “Seen by” field on the Wildlife Sightings webpage.
If you book to attend an event or apply for services offered by the Authority, we will ask you to provide your name and contact details so we may process your booking and deliver the event or services to you.
If you enter a competition, promotion or survey, you may have to provide your identity and contact data in order for us to fairly run the competition, promotion or survey and to contact you if you win a prize.
The Authority collects data for any transactions you carry out directly with the Authority over the telephone, so that your booking can be honoured and you can be provided with the services you have purchased.
Where you purchase a product or service on www.ebookings.leevalleypark.org.uk in relation to ‘Lee Valley Regional Park’, ‘Myddelton House Gardens’ or ‘Lee Valley Events’, the Trust will be the data processor and the Authority will be the data controller.
The Trust collects data for any transactions you carry out through our websites, so that your booking can be honoured and you can be provided with the services you have purchased. Please note that we never store your payment details on our websites.
Special Category (Sensitive) Data:
We are sometimes required to collect information about your ethnicity in order to provide aggregated reports to your local authority. This information is used only for statistical purposes, does not link directly to any individual and is always kept secure.
In connection with volunteering activities, you will be asked to provide details of any medical conditions you consider relevant and are comfortable disclosing to us. Any such information provided will be used only to assess appropriate volunteering roles, undertake risk assessments, inform supervisors and to ensure that due consideration is given to health and safety issues.
In connection with an application you may make to work with us, we may collect, store and use the following "special categories" of more sensitive personal information: information about your race or ethnicity, religious beliefs, sexual orientation and political opinions.
The Authority’s rangers collect the registration numbers of abandoned vehicles so that we can conduct DVLA searches for information on the owners and determine whether a vehicle has been abandoned intentionally, which is an infringement of the Lee Valley Regional Park byelaws.
Information about website visits including IP address:
The Authority’s websites’ web servers automatically gather information that your web browser sends whenever you visit our websites, such as your IP (Internet Protocol) address and information relating to which pages have used (such as cookies). We do this so we can learn more about how our customers use the websites in order to find ways to improve the websites and our services for your benefit. Cookies are further described in the Authority’s Cookies Policy.
Data relating to children:
We do not knowingly or specifically collect information about children under the age of 16.
If you believe that we have mistakenly or unintentionally collected such information, please notify us at email@example.com so that we may delete the information from our servers.
How we use the information collected:
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
Where we need to perform the contract we are about to enter into or have entered into with you.
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
Where we need to comply with a legal or regulatory obligation.
We may use your information in the following ways (relying on the legal bases shown below):
To provide you with any services that you are interested in or have agreed to:
Estate Rentals (Performance of a Contract)
Freedom of Information, Complaints and Feedback (Public Interest/Exercise of Official Authority, Interests of Data Subject, Legitimate Interests of being efficient about how we respond to requests and complaints and seek to resolve them)
Fishery Licences and Memberships updates (Performance of a Contract, Legal Obligation)
Job Applications (Performance of a Contract, Legal Obligation, Legitimate Interests to decide whether to appoint individual to role as it would be beneficial to our business to appoint someone)
Planning Consultations (Public Interest/Exercise of Official Authority, Consent, Legal Obligation)
Schools Activity Management (Performance of a Contract, Consent, Legitimate Interests to develop products and grow community engagement)
Stakeholder Engagement (Public Interest/Exercise of Official Authority, Legitimate Interests to improve and develop)
Wildlife Sightings Information (Consent, Public Interest/Exercise of Official Authority, Legitimate Interests of wildlife management)
Volunteers (Consent, Legitimate Interests of providing volunteering opportunities, engaging with the community and developing our services)
Car Parking Permits (Performance of a Contract)
Events in our Open Spaces (Performance of a Contract)
Lee Valley Almost Wild Campsite, Broxbourne (Performance of a Contract)
Community Access Fund Participants (Legitimate Interests to increase external funding for more participant programmes and to justify public spending
In relation to job applications, the personal information we collect about you will be used to assess your skills, qualifications and suitability for the role; carry out background and reference checks, where applicable; communicate with you about the recruitment process; keep records related to our hiring processes; and comply with legal or regulatory requirements. We also need to process your personal information to decide whether to enter into a contract with you. We will use information about your disability status to consider whether we need to provide appropriate adjustments during the recruitment process, for example whether adjustments need to be made during a test or interview. We will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.
To update our records with any new information you give us.
To enforce our byelaws (Exercise of Official Authority, Protect the vital interests of individuals).
For research and analysis so that we can develop and improve our services and public function for your benefit.
To make suggestions and recommendations to you about goods or services that may be of interest to you (necessary for our Legitimate Interests to develop our products/services and grow our business).
To obey laws and regulations that apply to us.
Marketing and Promotional purposes:
We will only contact you for marketing and promotional purposes if you have either consented to receive this information or if we think it is of interest to you based on previous services you have received from us, or if you provided us with your details when you entered a competition or registered for a promotion, and, in each case, you did not opt-out of receiving that marketing.
We will not share your information with any third party companies for marketing purposes unless you have explicitly consented for us to do so.
You can unsubscribe at any time via telephone, our websites or by clicking the unsubscribe link at the bottom of all email communications.
You can also change your preferences by logging on to your My Lee Valley Page.
All personal data is processed fairly by Authority staff or service providers and sub-processors of the Authority where necessary depending on function. We require all third parties to respect the security of your personal data and to treat it in accordance with the law.
Some examples of the categories of third parties with whom we share your data either directly, or via the Trust, are:
IT companies – we work with businesses which support our websites and other business systems.
Email service providers - in order to send you marketing content and transactional emails, we share your details with our email service providers.
Payment processing – we work with trusted third party payment processing providers in order to securely take and manage payments.
Service providers – we work with a number of trusted businesses in order to provide you with the high quality services you expect from us such as health and safety specialists and park security providers.
Information sharing and disclosure
We may share your personal data with the parties described above for the purposes set out in ‘How we use the information collected’.
We may also share your data with third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. If a change happens to our business, then the new operators or owners may use your personal data in the same way as set out in this Privacy Notice. Other than as described above, your personal data will never be supplied to anyone outside of the Authority without your explicit consent, except where we are obliged by law to disclose it.
We do not transfer your personal data outside the European Economic Area. Where our service providers are based in the US, they may be permitted access to our servers. Those service providers are part of the Privacy Shield which requires them to provide similar protection to personal data shared between Europe and the US. For further details please see European Commission: EU-U.S. Privacy Shield Framework.
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We have also put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
Separately, you also need to take precautions to protect your personal data when you use the internet.
We cannot guarantee the security of any private information provided to us in an email or in online form while it is being transmitted to us, as the internet is a potentially non-secure method of information transfer. Any such transmission is at your own risk. If in the course of using the Authority’s websites you choose to upload or post private information on public areas of the site, such information is not considered personal information and will not be subject to this Privacy Notice.
How long do we retain your personal information?
We retain your personal information for as long as is necessary to fulfil the purposes we collected it for (see ‘What information do we collect?’) including for the purposes of satisfying any legal, accounting or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
Details of retention periods for different aspects of your personal data are available from us on request by contacting us. In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.
In relation to our email mailing lists, each email sent by the Authority uses our email marketing solution and provides a clear unsubscribe link which will immediately remove you from any or all of our mailings as you specify.
Updates to this Privacy Statement
This version was last updated on 24 May 2018 and historic versions can be obtained by contacting us.
What are your rights as the data subject?
You have the right to request a copy of the personal information the Authority holds about you by submitting a Subject Access Request using the contact details below. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
If at any point you believe the information we process about you is incorrect, you can request to have it corrected or deleted by contacting us using the contact details below.
If you wish to raise a complaint on how we have handled your personal data, you can contact our Data Protection Officer who will investigate the matter.
Our Data Protection Officer is responsible for overseeing questions in relation to this Privacy Notice.
To contact our Data Protection Officer, you may do so in any of the following ways:
Data Protection Officer
Lee Valley Regional Park Authority
Telephone: 01992 709819
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO) on 0303 123 1113 or by following the link.