This is the privacy notice for RU Active Limited. This privacy notice sets out the basis on which any personal data we collect from you, or that you provide to us, directly or indirectly will be processed by us. Please read the following carefully to understand our views and practices regarding personal data and how we treat it.
RU Active Limited is a company registered in England and Wales under company number 09411097 whose registered office is at Unit 10 Orde Wingate Way, Stockton-on-Tees, TS19 0GA.
For the purpose of the General Data Protection Regulation 16/679 the data controller is RU Active Limited. We can be contacted at the registered office address or firstname.lastname@example.org
THE PERSONAL DATA WE COLLECT ABOUT YOU
We collect personal data for a number of purposes in order to undertake our business model. This includes the collection of personal data, which identifies you when you sign up to our mailing list, purchase something from us, or communicate with us. If you make a purchase or sign up for an event, we maintain a record of your history. If you share any access requirements or other special requirements with us we will note this in your record on our contact management system. We keep a record of the emails we send you, and we may track whether you receive or open them so we can make sure we are sending you the most relevant information. When we collect personal data from you we store it under a strict safeguarding and confidentiality regime.
THE REASON WE USE PERSONAL DATA
RU Active will collect data from you to process payments, our member experience and provide you with information or services you have requested, to meet contractual requirements and comply with our administrative duties, sectorial regulations and the general law. Personal data collected this way will only be used to provide you with information that you would reasonably expect or have agreed to. When we run activities in partnership with other organisations we will only share your personal data with them if your consent is required, and you have given us consent to do so. We do not share or sell your personal data with other organisations to use for their own purposes without your agreement.
Personal data, including in your capacity as a customer of RU Active, will be held on a customer relationship management system which holds contact details and a record of your interactions with us. Where possible we aim to keep a single record for each customer. Where you apply for employment at RU Active and are unsuccessful, we delete your records in line with our data retention policy.
We will only share your information if we are under a duty to disclose or share personal data to comply with any legal obligation, or in order to enforce or apply our terms and other agreements; or to protect the rights, property, or safety of RU Active, our Clients, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
THE LEGAL BASIS UPON WHICH WE ACT
We only process personal information where we have a lawful basis for doing so. These are:
Where we process personal data as a result of your consent, We ensure that consent is freely given, specific and informed, and established by a clear affirmative act. Where you wish to withdraw your consent, we have set out (below) how you may do this.
Where we have legal obligations, processing of personal data may be required by law. This may include contact with our regulators or public institutions.
Where we process personal data, as it is necessary for the purpose of our legitimate interests, we do so on the basis of a balanced evaluation of our interests and yours. We may therefore contact you about things which we feel are of interest to you or which, based on what we know about you, are in the interests of our charitable objectives to let you know. This will from time to time include marketing and raising awareness, but at any stage you can tell us that you do not want to receive such information and we will stop contacting you with it.
WITHDRAWAL OF CONSENT
Consent should be as easy to withdraw as it is to give and you may ask that we do not process your personal data at any time. You may contact us to withdraw your consent using the contact details at the end of this privacy statement. Equally, where we process personal data based on our legitimate interest, you have a right to request that we stop processing personal data for our legitimate interests and withdraw your consent.
HOW WE PROTECT YOUR PERSONAL INFORMATION
We take appropriate physical, electronic and managerial measures to ensure that we keep your information secure, accurate and up to date, and that we only keep it as long as is reasonable and necessary. Any external providers we use to process your data (for instance the operators of our contact management system) must meet our security policies and comply with all relevant legislation about how they store and process your personal data. We may also receive information about you from third parties but will only contact you if we have your express permission.
YOUR RIGHTS TO FURTHER INFORMATION
At your request we will confirm the information we hold about you and how it is processed. You can request the following information:
· Identity and the contact details of the person or organisation that has determined how and why to process your data.
· The purpose of the processing as well as the legal basis for processing.
· If the processing is based on the legitimate interests, information about those interests.
· The categories of personal data collected, stored and processed.
· Recipient(s) or categories of recipients that the data is/will be disclosed to.
· If we intend to transfer the personal data to a third country or international organisation, information about how We ensure this is done securely.
· How long the data will be stored.
· Details of your rights to correct, erase, restrict or object to such processing.
· Information about your right to withdraw consent at any time.
· The source of personal data if it wasn’t collected directly from you.
· Any details and information of automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.
What forms of ID will I need to provide in order to access this?
We accept the following forms of ID when information on your personal data is requested: passport, driving licence, birth certificate, and utility bill from the previous 3 months.
SENSITIVE PERSONAL DATA
Where RU Active processes sensitive personal data, we do so on the basis that the Client has established a lawful exception to the prohibition on processing sensitive personal data under Article 9 of the Regulation; and where RU Active is processing sensitive personal data of employees, it does so pursuant to its employment relationship with its personnel and so uses the exception set out in paragraph 2(b) of Article 9 of GDPR.
TRANSFERRING OUT OF THE EEA
Storing: We use cloud providers to store our personal data. Personal data may be transferred to and stored at a destination outside of the European Economic Area (EEA).
Processing: We may use third parties to help us deliver our services and they may be based outside the EEA. Where data is transferred outside the EEA, We adhere to compliance mechanisms that are identified by the European Commission, for example, the use of EU model contract clauses or conformity to US Privacy Shield.
Where we are the processor: in general, personal data is stored in the locations required by our Clients. Periodically, our Clients may agree specific terms as to where customer data, venue employee data and head office employee data is stored by us. At all times, we act in accordance with the Regulation.
DATA RETENTION PERIODS
RU Active has a data retention policy, which sets out how long it will store personal data, which is consistent with Article 5 of the Regulation. RU Active only keeps personal data for as long as is necessary. For example, RU Active is required to retain certain information in accordance with the general law, where information needed for income tax and audit purposes. How long certain kinds of personal data should be kept may also be governed by specific business-sector requirements and agreed practices. Personal data may be held in addition to these periods depending on RU Active’s business needs, which are balanced against the requirements of GDPR and the rights of the individual.
Where we are the controller
We will retain personal data for as long as necessary. As described above, in some cases, we will have a legal or statutory obligation to retain information for a set period, such as the limitation period.
Where we are the processor
SUMMARY OF DATA PROCESSORS
In order to provide our services to our Clients and their customers, RU Active defines the different categories of personal data and works with carefully selected third parties. Some of our selected third parties are required to process personal data on our behalf, in compliance with our role as both a controller and processor. Our suppliers include Sage, Barclays, VisualSoft and Openda.
The personal data we process is subject to rigorous measures and procedures to minimize the risk of unauthorized access or disclosure. We will get in touch with the supervisory authority (which in RU Active’s case is the Information Commissioner on the United Kingdom) and with affected data subjects where this is required under GDPR.
LINKS TO OTHER WEBSITES
Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information that you provide whilst visiting such sites and this privacy statement does not govern such sites. You should exercise caution and look at the privacy statement applicable to the website in question.
Strictly necessary cookies
These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website.
They allow us to recognize and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily
These are used to recognize you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region)
These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website more relevant to your interests.
YOUR RIGHT TO COMPLAIN
If you have a complaint about the way we process your personal data, you can register your concern by contacting the Information Commissioner and following the instructions set out at www.ico.org.uk
RU Active Limited