test and trace privacy notice
Blackpool Entertainment Company Ltd (Winter Gardens) Test and Trace Privacy Notice:
The purpose of this processing is to support the NHS Test and Trace in England. The Winter Gardens are required to collect the details, and maintain records, of staff, customers and visitors on their premises.
The Winter Gardens are the data controller, as defined by the General Data Protection Regulation (GDPR) and the Data Protection Act (DPA) 2018, for the data obtained at the point the information is collected from an individual.
The Winter Gardens will be responsible for compliance with data protection legislation for the period of time it holds the information.
What Personal Data We Collect
For the purpose of the Test and Trace scheme, the Winter Gardens will collect:
- The names of all customers or visitors, or if it is a group of people, the name of one member of the group.
- A contact phone number for each customer or visitor, or for the lead member of a group of people.
- Date of visit and arrival and departure time
This data will either be taken from:
- The information provided on your online booking form or
- You will be asked to provide this data at the time you visit.
Your data that is collected for NHS Test and Trace will be retained locally by the Winter Gardens for 21 days after your visit, at which point it will be deleted or destroyed, unless the Winter Gardens usually collects the data for other legitimate business purposes in accordance with the GDPR.
Where your data is passed to NHS Test and Trace in the case of a suspected outbreak, your information will be kept for up to 8 years, as part of the standard contact-tracing retention period set out by PHE.
Information collected as part of this contact-tracing initiative will be stored securely and lawfully by the Winter Gardens and by NHS Test and Trace (if passed to them), in line with the requirements of the GDPR and Data Protection Act 2018.
The Winter Gardens legal basis for processing your personal data is:
- GDPR Article 6(1)(e): the processing is necessary for the performance of its official tasks carried out in the public interest in providing and managing a health service.
- GDPR Article 9(2)(h): the processing is necessary for the management of health or social care systems and services.
- GDPR Article 9(2)(i): the processing is necessary for reasons of public interest in the area of public health.
- DPA 2018 – Schedule 1, Part 1, s.3: Public Health.
- DPA 2018 – Schedule 1, Part 1, (2)(2)(f): Health or social care purposes.
Individual Rights as a Data Subject
By law, you have a number of rights as a data subject and this collection of your information does not take away or reduce these rights.
You have a right to:
- Get copies of your information: you have the right to ask for a copy of any information about you that is used.
- Get your information corrected: you have the right to ask for any information held about you that you think is inaccurate, to be corrected.
- Limit how your information is used: you have the right to ask for any of the information held about you to be restricted, for example, if you think inaccurate information is being used.
- Object to your information being used: you can ask for any information held about you to not be used. However, this is not an absolute right, and we may need to continue using your information, and we will tell you if this is the case.
- Get information deleted: this is not an absolute right, and we may need to continue to use your information, and we will tell you if this is the case.
If you’re unhappy or wish to complain about how your personal data is used as part of this programme, you should contact the Winter Gardens in the first instance to resolve your issue.
If this is unsuccessful, you can also raise a complaint with the Information Commissioner’s Office.
Data Protection Officer
The Winter Gardens’ Data Protection Officer is Mr Jonathan Pickup and can be contacted at [email protected] or in writing to:
Data Protection Officer
Information Governance Team
PO Box 4