Sportspark Privacy Notice

This notice applies to people who use the University’s Sportspark services and UEA Sport, including those offered by the Sportspark website. 

If you are a UEA student or employee, you should also refer to the University’s student and staff privacy notices. 

Please note that the Student Union is a separate data controller and you should refer to the Student Union’s privacy notice if you use their services.

The information we collect and use can be grouped into the following six categories.

1. Contact details and other identifying information

• Full name, including title

• Staff or student card number (where relevant)

• Date of Birth

• Telephone numbers

• Email address

• Place of residence, including postcode

• UEA User ID (if student or staff)

• UEA student number

• Whether you consent to being contacted for research purposes (yes or no)

• Swipe card number

• Special category data

  • Ethnicity 

  • Disability and medical information

  • Physical activity levels (e.g. based on how often you use facilities)

  • Physical activity preferences (e.g. based on any activities you book)

Please note, if you are a student or staff member who wishes to use Sportspark facilities we will obtain your name and staff/student card number directly from records held by the University.

2. Direct debit information (if on a monthly membership)

• Name and address of account holder

• Name and address of your bank or building society

• Your bank or building society account number and sort code

3. Data captured on CCTV cameras

• Your image and actions

The Sportspark has CCTV cameras inside and outside the building which capture your image as you approach and enter the building and use the facilities. There are notices to tell you about this and where to ask for more information.

Cameras outside the main building monitor the carparks, outside sports areas and external storage buildings.

Cameras inside the building are placed in all general use areas, such as the entrance hall and café, and in all sports areas, including the pool. 

Cameras are NOT located in changing rooms.

The pool hall has above and below water cameras which are monitored by the life-guards during all swim sessions. Lifeguards use a monitor which is attached to each of the lifeguard chairs. The main control unit is kept in a locked room and is not directly viewable or accessible by Sportspark or UEA staff.

All other camera images are managed by the University’s security team and are not directly viewable or accessible by Sportspark or UEA staff.

4. Location and usage information

• Your entry to and exit from Sportspark when you use the entry gates

• Bookings data linked to your swipe card (e.g. classes or facilities)

Please note, sometimes we might have to temporarily deactivate your swipe card so that reception staff are prompted to give you personalised membership information or you essential safety information which needs your immediate attention.

5. Health and wellbeing when participating in certain programmes, for example UEA+Moves, including but not limited to: 

• Medical history

• Your exercise habits

• Attitudes to fitness

• General wellbeing 

• Any medical conditions for which you are receiving current treatment or medication

• Next of kin and emergency contact info

• Other information needed to provide the activity

• Whether you consent to being contacted for research purposes (yes or no) 

• Special category data 

  • Ethnicity  

  • Disability and medical information 

  • Physical activity levels 

  • Physical activity preferences 

Please note, if you are a student or staff member who wishes to use Sportspark facilities we will obtain your name and staff/student card number directly from records held by the University. 

6. Student data received from other UEA departments

In addition to the above, we also receive student data from other parts of the University.

Student Services exercise referral scheme

We may receive your data as part of the exercise referral scheme run by Student Services. The referral is based on an assessment of the information you provide and may include sharing some details of your completed wellbeing form in order to offer you support as part of the scheme. 
The details shared are:

• Contact details and other identifying information

  • full name

  • UEA email

  • contact number 

• ethnicity 

• disability and medical information

• physical activity levels

• physical activity preferences

• PHQ9, GAD and SAS scores

• Whether you consent to being contacted for research purposes (yes or no)

Careers Central Volunteer Academy

We may receive UEA student data as part of our Volunteer Academy scheme run in conjunction with Careers Central. In order to identify volunteers who have signed up to UEA award, Careers Central will share:

• Your UEA email address

• UEA student Number

• UEA Student ID as a unique identifier 

Business Intelligence Unit

We will receive UEA student data as part of our work to understand the value and impact of student participation in the Sportspark’s sport and physical activity programmes. The University’s Business Intelligence Unit will share:

• UEA Student ID as a unique identifier

• Withdrawal and retention data for Sportspark users

• Grade attainment/degree classification for Sportspark users

7. Aggregated statistical data

We may receive aggregated data about UEA and INTO students from the University's Business intelligence Unit (BIU). Aggregated data will not identify you by name, and will include the following:

• Gender 

• Faculty

• School (BIO/EDU etc) 

• Age 

• Year group (course stage)

• Course type (UG, Ms, PhD)

• Ethnicity 

• Disability

• Domicile 

• Fee profile (EU, Visitor, Home Exchange etc)

• Withdrawal and retention

• Grade attainment/degree classification

• INTO student usage 

• Widening participation groups not in the above list (bursary, commuter, polar group)

Using our facilities and managing your membership

We need to use your contact details and other identifying information to provide you with the Sportspark services and facilities you have requested, for example booking of sessions. This can include your banking information for single payments or direct debit payments. 

Your swipe card will be used to collect data your location and activity. The swipe card records your entry to and exit from the premises and is linked to any bookings you make, for example, booking a squash court or a specific class.
We will use your contact details to send you communications to enable you to use our facilities and ensure we manage your membership expectations, these will include emails or letters about:

• Your membership and payments

• Membership renewal emails

• Monthly email newsletters to update you on Sportspark news and events (e.g. planned closures or new classes)

• Essential safety information

We will need to process your personal data in this way as part of your contract with Sportspark. The data protection law that allows us to do that is article 6(1)(b) of the UK GDPR, which relates to processing necessary to perform a contract or to take steps at your request before entering a contract.

Marketing purposes

If we have your consent, we will also use your contact details and usage information for marketing purposes, for example to inform you of offers and events that may be of benefit or improve your experience. Where we require your consent to use information we will ask separately, at the time you first engage with the service, and you will always have a right to withdraw that consent. 

When we want to send you marketing information we will only do so with your consent. The data protection law that allows us to do that is article 6(1)(a) of the UK GDPR, which relates to any processing where you have given your consent.

Health and safety

We will use data obtained from either your swipe card or from CCTV cameras to ensure your health and safety while on the premises and to comply with health and safety law.

Swipe card and CCTV data will be used in the following ways:

• To monitor individual access to, and use of, specific facilities and premises, where we believe this to be necessary for your health and safety and that of others

• To make any arrangements or adjustments for the purposes of ensuring your health and safety during classes

• To monitor the above and below water video monitoring system in real-time

• To identify a medical emergency and provide immediate help

• To investigate a safety incident or to provide relevant and appropriate information to any investigation into a safety incident

If we need to share your data to comply with health and safety law, the relevant data protection law that allows us to do that is article 6(1)(c) of the UK GDPR, which relates to processing necessary for compliance with a legal obligation.

If we need to share your data to protect you, or anyone else, during a medical emergency, the data protection law that allows us to do that is article 6(1)(d) of the UK GDPR, which relates to processing necessary to protect the vital interests of the data subject or another natural person.

When we need to process your health and any other special category data, the data protection law that allows us to do that is Article 9(2)(g) of the UK GDPR, which relates to processing necessary for reasons in the substantial public interest and The Data Protection Act 2018 Schedule 1, part 2, paragraph 6 which relates to processing necessary for reasons of substantial public interest. 

We may use any disability and medical information provided for the purposes of making adjustments for the purposes of ensuring your health and safety during classes or activities.

Law enforcement and prevention and detection of crime

We will use data obtained from either your swipe card or from CCTV cameras for the prevention and detection of crime.

Swipe card and CCTV data will be used in the following ways:

• To monitor individual access to, and use of, specific facilities and premises, where we believe this to be necessary for the prevention and detection of crime

• To identify unlawful activity or inappropriate behaviour and provide relevant and appropriate information to any investigation into claims of unlawful activity or inappropriate behaviour 

Please note that this will apply to incidents inside the Sportpark building and outside in the Sportspark grounds. There are notices displayed about our CCTV use, as well as other notices across the wider campus about the University’s CCTV use.

Our processing of your special category data will be based on Article 9(2)(g), which relates to processing necessary for reasons of substantial public interest, and on Schedule 1, paragraph 10 of the Data Protection Act 2018, which relates to preventing or detecting unlawful acts.   

Supporting UEA students

We use information shared with us by other University departments in order to provide specific services to support UEA students. The services we currently support are the Student Services exercise referral scheme  and the Volunteer Academy run by Careers Central. 

When we want to process your data in this way we will only do so with your consent. The data protection law that allows us to do that is article 6(1)(a) of the UK GDPR, which relates to any processing where you have given your consent.

When we need to process your health and any other special category data, the data protection law that allows us to do that is Article 9(2)(a) of the UK GDPR. The relates to processing with your consent for an explicit purpose, in this case your own health and safety. You can withdraw your consent at any time.

Other purposes

To ensure the Sportspark operates efficiently and that we are providing the best possible service to our users, we will use your usage information as well as contact details and other identifying information as follows.

• To send you email updates about Sportspark news (e.g. pool closures) where you need to know about this 

• Aggregate and analyse Sportspark usage records, and combine with other UEA staff and student records, to build a picture of how people access the Sportspark and use other UEA Sport activities to assist with programme design and appropriate marketing of our programmes and activities

• Aggregate and analyse Sportspark usage records, and combine with other UEA staff and student records in order to ensure we are meeting all our legal responsibilities under the public sector equality duty as described in the Equality Act 2010.

• To aggregate and analyse Sportspark usage records and combine with other student records e.g. student withdrawal, retention and grade attainment to determine the value and impact of student participation in the Sportspark’s programmes

• Share limited data with external bodies listed in ‘Who has access to your data?’ for the purposes of national bench marking on physical activity (Sport England) and, for students only, determining participation in sports within a university environment in order to receive funding (BUCS and other National Governing Bodies)

• For UEA students and staff only, name and staff number will be transferred automatically to Sportspark systems to verify you as a UEA student or employee when accessing Sportspark facilities

• Management of uea+sport events and trips – when you book to take part in an event or a trip we may ask you for details of your current health including, but not limited to, any current medical conditions for which you are receiving treatment or medication, and emergency contact details 

  • All trips and events that take place off-Campus require a trip list to be given to our Security lodge. This includes any group sporting activity or competition. The trip list will include your name, any relevant medical history or current status, your contact details and your emergency contact details. This would only be used in an emergency. The list will be returned or destroyed at the conclusion of the trip when everyone has returned to UEA.

When we need to use your data for the activities listed above, the data protection that allows us to do that is article 6(1)(f), as processing is necessary for the purposes of the legitimate interests pursued by the University or by a third party.

We will aim to complete a Legitimate Interests Assessment for this activity as soon as time allows. If you would like to see this document, contact dataprotection@uea.ac.uk.

Our processing of information about your health will be based on Article 9(2)(a), which relates to your explicit consent to the processing for an explicit purpose, in this case the protection of your own health and safety.

Most of the information we use is collected from you, either directly (for example when you fill in a form) or as a result of your actions, (for example when you book a session we create a record of your activities).

If you are a student or staff member who wishes to use Sportspark facilities we will obtain your name and staff/student card number directly from records held by the University.

We may obtain further student personal data from other University departments as described in the 'What information do we use?' and 'How we use your information' sections.

Obtaining data from third parties
Many of our events are administered in the first instance by UEASU (UEA Student Union)  with whom we act as joint controllers when promoting our sporting events and administering club memberships. Any data given by you to UEASU as part of an expression of interest or while signing up to an event or activity will be passed to us by UEASU.

We may receive statistical information about participation in events or classes from other organisations or individuals, such as Active Norfolk, Norfolk Sports Academy and British Universities & Colleges Sport (BUCS) but this information cannot be linked back to any individual. 

If we do obtain your personal information from another organisation, we will inform you of this fact within a reasonable period of having obtained the data (within one month, at the time we first get in touch with you, or when we need to share the data with another party – whichever is soonest).

Sportspark staff access to your personal data will be restricted to those individuals whose roles require use of such data for any of the purposes listed above. Some of your data may be shared with other teams or departments of the University as described below:

Student Services exercise referral scheme 

If you take part in the exercise referral scheme run by Student Services information about your participation would be shared back to Student Services with your consent. 

Careers Central Volunteer Academy 

If you are a member of our Volunteer Academy scheme your data is shared with Careers Central in order to identify volunteers, track engagement and follow progress for those volunteers who have signed up to the UEA Skills Award, assessing their success and ongoing impact. 

Individual schools 

The volunteer role of Academic Sport Activator for the Ziggurat Challenge is arranged by School, and the names of each school’s volunteers are sent to the relevant Head of School. 

The University also shares information with other data controllers. When we share data in this way, the other organisation will exercise control over how the information will be used. We do not sell your data, or share it with organisations other than those described below, unless required by law.

The organisations with whom we share data also have an obligation to tell you how they will use your information. For example, BUCS and other national governing bodies/external funders will have third parties who process data on their behalf. We advise you to look at the privacy notices or policies of the organisations listed above. If you require any assistance with this, please contact us.

We use third party organisations, known as data processors, to provide certain services on our behalf. In order to deliver these services, these organisations may have access to Sportspark user data.  We are required to have contracts in place with each of these data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will hold it securely and retain it for the period we instruct.

We use the following external services to help us provide our services:

We will keep your personal data only as long as is necessary for the purpose(s) for which it was collected. The retention periods for each purpose are set out in the University’s Records Retention Schedules. The Sportspark’s Records Retention Schedule is listed under the initials PES.
Data will be securely destroyed when no longer required.

We have published further information about your data protection rights, who to contact if you have a complaint or a concern, and other information about data protection at the University of East Anglia that you might find helpful.

We regularly review the Sportspark privacy notice. This privacy notice was last updated in September 2023.