Privacy notice for NTU Sport

Nottingham Trent University is committed to protecting the privacy and security of your personal information, this privacy notice provides important information about how Nottingham Trent University (through NTU Sport) (“NTU Sport”, “NTU,” “we,” or “us”) identifies and manages its data protection responsibilities in accordance with its legal and regulatory obligations.

NTU encourages you to review the privacy statements of any websites you choose to navigate to from our website (or navigate from to our website) or digital services that we provide links to so that you can understand how those websites collect, use and share your information as well. Any third party sites that you can access through the website are not covered by this privacy notice and we accept no responsibility or liability for these sites.

  • Who we are

    NTU is a “data controller” which means we are responsible for deciding how we hold and use personal information about you.


    This privacy notice applies to all NTU Sport members (“you” or “your”) or services that link to it (collectively, our “NTU Sport services”).


    Please read this privacy notice carefully and contact our Legal Services Manager and Data Protection Officer if you have any questions about our privacy practices or your personal information choices.


    Attn: Tracy Landon, Legal Services Manager and Data Protection Officer
    Nottingham Trent University
    Address: 50 Shakespeare Street, Nottingham, NG1 4FQ
    Email: DPO@ntu.ac.uk


    We may need to update this privacy notice from time to time. If changes made to this privacy notice are considered to be material, we will notify you of the changes.

  • Personal information

    NTU is committed to the responsible handling and protection of personal information.

    Personal Data, or personal information, means any information about an individual from which that person (a “Data Subject”) can be identified. It does not include data where the identity has been removed (anonymous data).

    The information will be Personal Data if a person can be identified either directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person. For example personal data may include names, addresses, email addresses and telephone numbers; it may also include images in photographs or films and recorded telephone conversations.

  • Why we process your data

    We collect, use, disclose, transfer, and store personal information to provide NTU Sport services to you and for our operational and business purposes as described in this privacy notice. We want to be clear about our privacy practices so that you are fully informed and can make choices about the use of your information, and we encourage you to contact our Data Protection Officer at any time with questions or concerns.

  • The types of personal information we collect

    We collect personal information from you, for example, if you purchase a membership, book facilities or use any of our NTU Sport Services.

    The categories of personal information that we may collect, store and use about you include (but are not limited to):

    • name, address, telephone number
    • date of birth and gender
    • visual images / photographs (including CCTV)
    • computing and email information including student number and email address
    • payment information – financial details
    • we may need to process sensitive personal information which is referred to as special category personal data which includes racial or ethnic origin, physical or mental health conditions, sexual orientation and biometric or genetic data.

    We may process special category personal information in the following circumstances:

    • In limited circumstances, with your explicit written consent.
    • Where we need to carry out our legal obligations or comply with relevant legislation.
    • Where it is needed in the public interest, such as for equal opportunities monitoring and reporting.
    • Where it is needed to assess your capacity to undertake sport and fitness on health grounds, to enable us to
      offer you the support, subject to appropriate confidentiality safeguards.
    • Where it is needed to investigate student behaviour (under our Student Code of Behaviour).
    • To help you arrange sponsorship.

  • How we collect your data

    Not all of the personal information NTU Sport holds about you will always come directly from you. We collect
    personal information from NTU to help us maintain data accuracy and provide and enhance the NTU Sport
    services.


    We will collect payment information, such as financial or bank card information, and other information necessary for
    us to process NTU Sport transactions.

  • How we use data about you

    We use your personal information for the following purposes:

    • To provide you with information on products or services that you may request from us, or which we feel may
      be of interest to you, and where you have given consent for us to contact you for such purposes.
    • To enable all financial transactions to and from us including administration of sponsorships which may include
      sharing personal data with third party sponsorship providers.
    • To carry out our contractual obligations between you and us.
    • Where it is necessary to comply with a legal obligation.
    • To provide management statistics through reporting using NTU Sport Member data which may be used by us to enhance the student sporting experience.
    • For security, safety and disciplinary purposes (through the use of CCTV and information to support our student
      code of behaviour).
    • To ensure that content from our website or Services is presented in the most effective manner for you and for
      your computer or device by gathering aggregate information about our users, using it to analyse the
      effectiveness and efficiency of communications.
    • To ensure we meet our statutory obligations, including those related to diversity and equal opportunity.
    • Photographs of sport and fitness facilities or general activity in common areas of NTU Sport as part of general
      marketing materials, for example in our annual report, sports guides or materials. Personal data alongside
      photographs will only be used with explicit consent.
    • To ensure compliance with the Prevent Duty under the Counter Terrorism & Security Act 2015.
    • When you access / use facilities provided by NTU Sport.
    • To notify you about changes to our services.

  • Who we share your data with

    NTU shares or discloses personal information when necessary to provide services or conduct our business
    operations. When we share personal information, we do so in accordance with data privacy and security
    requirements. We may occasionally share non-personal, anonymised or pseudonymised, and statistical data with
    third parties.


    We may share your personal information with third parties where required by law, where it is necessary to administer
    the working relationship with you or where we have another legal requirement or legitimate interest in doing so.
    Third parties will only process your personal data on our instructions and where they have agreed to treat that
    information confidentially and to keep it secure.


    NTU Sport may share your personal information with our trusted partners and selected third parties to help us
    perform functions such as statistical analysis, sending you e-mails, processing of direct debit memberships, external
    coaching providers and provision of sport scholarships. All such third parties are prohibited from using your personal
    information except to provide these services to NTU Sport, and they are required to maintain the confidentiality of
    your information. NTU ensures such third parties handle your information in accordance with the GDPR.


    Below are the parties with whom we may share personal information and why.

    • Within NTU: Associated entities or services around the world are provided data by a variety of NTU teams and
      functions, and personal information will be made available to them if necessary for the provision of Services,
      account administration, marketing, student support and technical support, for instance.
    • Our third-party service providers: We partner with and are supported by service providers both in the UK around the world. Personal information will be made available to these parties only when necessary to fulfil the services they provide to us, such as NTU Sport Membership, direct marketing services; advertising and data analytics. Our third party service providers are not permitted to share or use personal information we make available to them for any other purpose than to provide services to us.
    • Payment service providers.
    • We may be required to use and retain personal information for legal and compliance reasons, such as the
      prevention, detection, or investigation of a crime, loss prevention, fraud or safeguarding.
    • Where you join sports clubs we may share with external coaching providers, external scholarship / funding
      providers.
    • We may also use personal information to meet our internal and external audit or governmental requirements,
      information security purposes, and as we otherwise believe to be necessary or appropriate.
      (a) Under applicable law, which may include laws outside your country of residence.
      (b) To respond to requests from courts, law enforcement agencies, regulatory agencies, and other public and
      government authorities, which may include such authorities outside your country of residence.
      (c) To enforce our terms and conditions.
      (d) To protect our rights, privacy, safety, or property, or those of other persons.

  • How long we keep your data for

    We will not store your personal information for longer than is necessary. NTU will ensure that our trusted partners
    and selected third parties with whom we share your personal information in accordance with this privacy notice will
    delete your personal information when they no longer require it.


    In determining data retention periods, NTU takes into consideration local laws, contractual obligations, and the
    expectations and requirements of our data subjects. When we no longer need personal information, we securely
    delete or destroy it.

  • How we secure your data

    We have appropriate security measures in place to prevent your personal data from being accidentally lost, used
    or accessed in an unauthorised way, altered or disclosed. In addition we limit access to your personal information
    to those employees, agents, contractors and other third parties who have a business requirement to know.

    • Policies and procedures – measures are in place to protect against accidental loss and unauthorised access, use, destruction, or disclosure of data.
    • Business continuity and disaster recovery strategies that are designed to safeguard the continuity of our service to our clients and to protect our people and assets.
    • Appropriate restrictions on access to personal information.
    • Monitoring and physical measures, to store and transfer data securely.
    • Data Privacy Impact Assessments (DPIA) in accordance with legal requirements and our business policies.
    • Periodic training on privacy, information security, and other related subjects for employees and contractors.
    • Vendor risk management.
    • Contracts and security reviews on third-party vendors and providers of services.

  • How we keep your data secure in other countries

    Your personal information may be transferred by us or our trusted partners outside of the European Economic Area
    (the “EEA”). The trusted partners that may do this are organisations who process data for analysis or marketing
    purposes, including a marketing automation hub where the email address of recipients will be logged and a record
    of email delivery, opening, click-through and bounce-backs will be kept. Our partner uses Microsoft’s Windows Azure
    data centres located in East US (Virginia), West Europe (Netherlands), and Australia East (New South Wales).


    NTU has networks, databases, servers, systems, and support located throughout the world. NTU collaborates with
    third parties such as cloud hosting services, suppliers, and technology support located around the world to serve the
    needs of the NTU, workforce, and students. Your personal information may be shared with record matching and
    customer targeting partners, including Google, Facebook, Snapchat and LinkedIn. Some of these partners process
    personal data in Canada and the United States of America.


    We take appropriate steps to ensure that personal information is processed, secured, and transferred according to
    applicable law. In some cases, we may need to disclose or transfer your personal information within NTU or to third
    parties in areas outside of your home country.


    NTU shall ensure that your personal information transferred to countries outside of the EEA is adequately
    protection by transferring the personal information on terms of the standard data protection clauses adopted by
    the European Commission.


    This means, your rights and protection remain with your data, i.e. we use approved contractual clauses, multiparty
    data transfer agreements, intragroup agreements, and other measures designed to ensure that the recipients of
    your personal information protect it. If you would like to know more about our data transfer practices, please contact
    our Legal Services Manager and Data Protection Officer
    .

  • Your rights

    We respect your right to access and control your information, and we will respond to requests for information and,
    where applicable, will correct, amend, or delete your personal information. Under certain circumstances, by law you have the right to:

    • request access to your personal information (commonly known as a "data subject access request"). This
      enables you to receive a copy of the personal information we hold about you and to check that we are lawfully
      processing it
    • request correction of personal information that we hold about you. This enables you to ask us to correct any
      incomplete or inaccurate information we hold about you
    • request erasure of your personal information in limited circumstances. This enables you to ask us to delete
      or remove personal information where there is no good reason for us continuing to process it. You also have
      the right to ask us to delete or remove your personal information where you have exercised your right to object
      to processing (see below)
    • object to processing of your personal information where we are processing your personal information on the
      basis of our legitimate interest (or that of a third party) and there is something about your particular situation
      which makes you want to object to processing on this ground. You also have the right to object where we are
      processing your personal information for direct marketing purposes
    • request the restriction or suspension of processing of your personal information. This enables you to ask
      us to suspend the processing of personal information about you, for example if you want us to establish its
      accuracy or the reason for processing it
    • object to any direct marketing (for example, email marketing or phone calls) by us, and to require us to
      stop such marketing
    • object to any automated decision-making about you which produces legal effects or otherwise significantly
      affects you
    • request the transfer of your personal information to another party.

Download our privacy notice for NTU Sport.

How to contact us

If you are concerned about an aspect of your interaction with NTU Sport, you can contact NTU Sport by email to bring your concerns to the attention of relevant NTU Sport staff.


Please contact our Data Protection Officer with any requests related to your personal information, or with any questions or queries you may
have about this statement.


If you are not satisfied with how NTU manages your personal data, you have the right to make a complaint to a data
protection regulator. Visit the Information Commissioner's Office (ICO) website to find out how to contact the ICO.

Still need help?

+44 (0)115 941 8418