Turkish Baths Privacy Notice

Who are we? North Yorkshire Council is a ‘Data Controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR). This Privacy Notice is designed to help you understand how and why we process your personal data within our Leisure Service – Turkish Baths. This notice should be read in conjunction with our Corporate Privacy Notice. https://www.northyorks.gov.uk/privacy-notices

What personal information do we collect? In order to deliver our service, we need to collect the following personal data: • Name • Address • Contact details, such as email address and telephone number • Bank details including bank address, sort code and account number – if you buy something from us using a card, your card information is held by our third party payment processor. We may also collect certain categories of special category data: • Health information – This may need to be collected to ensure your safety when using our services

Why do we collect your personal information and what is our lawful basis for processing? We process your information for the following purposes: • To process your bookings • To take payments / process invoices • To improve our products and services • To record accidents • To ensure your health or additional support needs are considered and to ensure you understand any risks associated with your booking • To provide tailored customer service by ensuring your preferences are considered, and that you are kept informed of operational updates or changes to our services You may also consent to your information being used for the below purposes. Your information will only be used in this way if you consent to it and you can withdraw your consent at any time. These purposes are: • to provide you with specific marketing information such as information about new services, products or offers. • to include your image/video in marketing materials. North Yorkshire Council relies on the following lawful basis to process your personal data: For the use of your image/ videos in marketing material and for where you have opted in to receive marketing communications, the Council relies on: • UK GDPR Article 6(1)(a) - the data subject has given consent to the processing of his or her personal data for one or more specific purposes For all other processing activity, the council will rely upon the following lawful basis: • UK GDPR Article 6(1)(b) – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract • UK GDPR Article 6(1)(c) – processing is necessary for compliance with a legal obligation to which the controller is subject • UK GDPR Article 6(1)(f) – processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party

How long do we keep your information for? Data Held Retention Period Financial data 7 years Accident data 3 years Contact details 1 year after non-use of facilities

Other relevant transparency Information Other data that we may hold about you is only kept for as long as is necessary, and all data is retained in line with our record retention and disposal schedule (RRDS).

For more information about how we use your data, including your privacy rights and the complaints process, please see our Corporate Privacy Notice. https://www.northyorks.gov.uk/privacy-notices