Privacy and cookies

University of Edinburgh Sport & Exercise Privacy Statement

Find out more about University of Edinburgh FASIC Sport & Exercise Medicine Patient Privacy Statement 

If  you are purchasing a gym membership or using our facilities you must read and understand our terms and conditions of use.

Section 1: Where does Sport & Exercise get your personal data from?

We obtain personal data for:

Section 2: Purposes for processing

The information you provide will be used by Sport & Exercise for the administration of your position as a member, registered user, customer or athlete, with us, including the use of our services and facilities.

Section 3: Information about you: how we use it and with whom we share it

The information you provide and that we receive will be used by University Sport & Exercise to:

• To verify your eligibility for membership or use of our facilities and for the necessary for performance of your contract with Sport & Exercise
• To inform members about services related to their membership and other related Sport & Exercise services within our legitimate interest. To do so, we are using Dotmailer as our mailing system. You can opt out of these mailing at any time by clicking the unsubscribe link in our emails or by emailing cse.memberships@ed.ac.uk
• To obtain feedback. University of Edinburgh Sport & Exercise is committed to offering a high quality sport and fitness experience to our members. It is therefore in our legitimate interest for us to provide members the opportunity to provide feedback on our services on a scheduled and ad hoc basis. This processing activity is important for the Sport & Exercise as it provides a way of obtaining feedback on programmes, courses, services and facilities. Survey reporting is carried out at aggregate level for quantitative and at an individual level for qualitative data (ie free text comments).  Output is anonymised so that your data cannot be identified
• For "Support for Physical Activity" participants to monitor progress within our legitmate interest of your use of this service
• For Management information, research, and learning analytics. We may analyse data on members usage, attendance and engagement, and service utilisation data in order to: understand the behaviour of our members, support programme quality assurance;  enhance the quality of our services and facilities; enhance our member systems and support services.. While we will where possible use anonymised data for these purposes, in some cases we will use personal data where there is a legitimate interest in doing so. Where we use personal data for these purposes, we will ensure that any published information is anonymised. The system used for this reporting is Cascade Analytics which is fed information from our XN membership system for which applications and data are hosted on University servers
• Where relevant to verify your eligibility for access to University of Edinburgh’s Performance Sport Programme
• To provide information to Performance Sport Athletes about services related to their performance package within our legitimate interest to improve performance
• We process special category data for our Performance Sport Athletes within our legitimate activities  of monitoring and improving performance and have appropriate safeguards in place for this data
• Emergency contact details of Performance Sport Athletes and course participants within our legitimate interest of safety and security
• For events. We will use your personal data to allow us to process your registration, communicate with you and obtain your feedback about the event. We are processing the information about you for these purposes because by registering for the conference, you give your consent for us to do so. We will also contact you about future events you might be interested in if you have given your consent to this. You may opt-out of this at any time. In order to facilitate online bookings for our events, we use Epay - a third party service which is not operated by the University of Edinburgh. Details of Epay’s privacy policy can be found at Epay Privacy Policy
• Sport & Exercise arranges Photography and video capture of our facilities and activities. We will inform members of when this is taking place and will not include those who do not want to be featured in publicity materials. For shots of individuals, we will always seek your consent which can be withdrawn at any time by emailing cse.memberships@ed.ac.uk
• University Sport & Exercise operates CCTV and similar equipment to monitor safety and security and may monitor communications as permitted by relevant legislation in our legitimate interest.
• Verify your eligibility in terms of competence and compliance for use of our climbing facilities, and it’s necessary for the performance of your contract with Sport & Exercise.

Website and Cookies

• The main Sport & Exercise site (www.ed.ac.uk/schools-departments/sport-exercise) is part of the main University site. Find out more about the University Website Privacy Policy
• We also operate an online booking service (www.sport.ed.ac.uk/online-booking) which uses additional strictly necessary cookies not listed within the main University policy. This service makes use of the University’s Card Payment Gateway  (www.payments.ed.ac.uk) which also uses additional strictly necessary cookies not listed within the main University policies.
• These cookies are used to ensure that the Sport & Exercise Online Booking Service, and the University's Card Payment Gateway, delivers you information and services securely and optimally. You must accept these essential cookies to be able to make use of our Online Booking Service.

If you have any questions, please contact sport.data@ed.ac.uk

Section 4: Further Information

Automated decision-making

• We do not use profiling or automated decision-making processes. Some processes are semi-automated (such as anti-fraud data matching) but a human decision maker will always be involved before any decision is reached in relation to you.

Data controller and contact details

• For data collected under this privacy notice, the University of Edinburgh (the “University”) is the Data Controller (as that term is defined in the EU General Data Protection Regulation (Regulation (EU) 2016/679), registered with the Information Commissioner’s Office, Registration Number Z6426984
• You can contact our Data Protection Officer at dpo@ed.ac.uk. Our data protection policy is on our website at http://www.ed.ac.uk/records-management/data-protection/data-protection-policy

Data sharing

• In addition to the primary purposes, we are also legally obliged to share certain data with other public bodies such as HMRC and will do so where the law requires this; we will also generally comply with requests for specific information from other regulatory and law enforcement bodies where this is necessary and proportionate.

• For Performance Programme athletes only

• Your data will be shared with British Universities and Colleges Sport (BUCS), Scottish Student Sport (SSS) and the Edinburgh University Sports Union (EUSU), and in some cases other Event Entry Systems in the form of online event entries in order to fulfill your performance package agreement to represent the University in University competitions. Full details can be requested on these systems by emailing sport.data@ed.ac.uk
• Where you have medical support as part of your Performance Package from Sport & Exercise, your contact details (Name, Email address, Contact Number and Matriculation Number) will be shared with FASIC in order to access their services. The University may share information with sports, health and coaching staff from sportScotland and other sports national governing bodies relevant to you, with your expressed consent
• We will also share your data with a number of external performance analysis companies and their servers within our legitimate interest to assist in performance improvement. Full details can be requested on these systems by emailing sport.data@ed.ac.uk

Transfers outside the EEA

• The University will only transfer data to countries outside the EEA when satisfied that both the party which handles the data and the country it is processing it in provide adequate safeguards for personal privacy. Details of such transfers and safeguards are on our website.

Your rights

• You have the right to request access to, copies of and rectification or (in some cases) erasure of personal data held by the University and can request that we restrict processing or object to processing as well as (in some cases) the right to data portability (i.e. the right to ask us to put your data into a format that it can be transferred easily to a different organisation). If you wish to make use of one of these rights, please email your local contact
• If we have asked for your consent in order to process your personal data you can withdraw this consent in whole or part at any time. To withdraw consent, please email your local contact, who will explain the consequences of doing so in any particular case and initiate proceedings for withdrawing consent.

Complaints

• If you are unhappy with the way we have processed your personal data you have the right to complain to the Information Commissioner’s Office at casework@ico.org.uk but we ask that you raise the issue with our Data Protection Officer first.