What this document is for 

This privacy notice provides details on how we, South Norfolk Council (“the council”), uses your personal information for the purposes of providing services to users of South Norfolk Leisure provision. This includes users of our leisure centres, pools, soft play areas, Kids Camp.  

By ‘use’ we mean the various ways it may be processed, including storing and sharing the information. The Council is what is known as the ‘Data Controller’ for your data.  
 
Further details 

We also provide the following details in our general privacy notice on the South Norfolk Council website:  

• Your rights under the UK General Data Protection Regulation (the UK GDPR) and how to exercise them; 

• How to make a complaint and contact our Data Protection Officer; and 

• How to contact the regulator, the Information Commissioner’s Office  

What we use your information for and how the law protects you 

Using our facilities and services (“services” include swim school sessions, kids camp and soft play); and managing your membership 

We need to use your contact details and other identifying information to provide you with the services and facilities you have requested, for example booking of sessions. This can include your banking information for single payments or direct debit payments. We may also use contact details and other identifying information relating to individuals linked to services provided to you to deliver these services, for example provision to children, collection of children. This also includes processing data for benchmarking purposes, as detailed elsewhere on this Notice.  

Your swipe card will be used to collect data your location and activity. The swipe card records your entry to and exit from the premises and is linked to any bookings you make, for example, booking a squash court or a specific class. 

We will use your contact details to send you communications to enable you to use our facilities and services, and ensure we manage your expectations, these will include emails, SMS texts or letters about: 

• Your membership and payments 

• Membership renewal emails 

• Sessions you are interested in or have booked 

• Regular email newsletters to update you on news and events at the leisure centres (e.g. planned closures or new classes) 

• Essential safety information 

• Deal with complaint and issues raised 

We will need to process your personal data in this way as part of your contract with us. The data protection law that allows us to do that is article 6(1)(b) of the UK GDPR, which relates to processing necessary to perform a contract or to take steps at your request before entering a contract.  

In terms of Kids Camp, casual bookings and hiring of facilities, we process your data under article 6(1)(f) of the UK GDPR, which relates to processing that is necessary for the purposes or the legitimate interests pursued by the Council.  

Marketing purposes 

If we have your consent, we will also use your contact details for example to inform you of offers and events that may be of benefit or improve your experience. Where we require your consent to use information we will ask separately, at the time you first engage with the service, and you will always have a right to withdraw that consent.  

When we want to send you marketing information we will only do so with your consent. The data protection law that allows us to do that is article 6(1)(a) of the UK GDPR, which relates to any processing where you have given your consent. 

Health and safety 

We will use data obtained from either your swipe card or from CCTV cameras to ensure your health and safety while on the premises and to comply with health and safety law. 

Data (including swipe card and CCTV data) will be used in the following ways: 

• To monitor individual access to, and use of, specific facilities and premises, where we believe this to be necessary for your health and safety and that of others 

• To make any arrangements or adjustments for the purposes of ensuring your health and safety during classes and sessions 

• To monitor the above and below water video monitoring system in real-time 

• To identify a medical emergency and provide immediate help 

• To investigate a safety incident or to provide relevant and appropriate information to any investigation into a safety incident 

If we need to share your data to comply with health and safety law, the relevant data protection law that allows us to do that is article 6(1)(c) of the UK GDPR, which relates to processing necessary for compliance with a legal obligation. 

If we need to share your data to protect you, or anyone else, during a medical emergency, the data protection law that allows us to do that is article 6(1)(d) of the UK GDPR, which relates to processing necessary to protect the vital interests of the data subject or another natural person. 

When we need to process your health and any other special category data, the data protection law that allows us to do that is Article 9(2)(g) of the UK GDPR, which relates to processing necessary for reasons in the substantial public interest and The Data Protection Act 2018 Schedule 1, part 2, paragraph 6 which relates to processing necessary for reasons of substantial public interest.  

We may use any disability and medical information provided for the purposes of making adjustments for the purposes of ensuring your health and safety during classes or activities. 

Law enforcement and prevention and detection of crime 

We will use data obtained from either your swipe card or from CCTV cameras for the prevention and detection of crime. 

Swipe card and CCTV data will be used in the following ways: 

• To monitor individual access to, and use of, specific facilities and premises, where we believe this to be necessary for the prevention and detection of crime 

• To identify unlawful activity or inappropriate behaviour and provide relevant and appropriate information to any investigation into claims of unlawful activity or inappropriate behaviour  

Please note that this will apply to incidents inside the leisure centres and outside in the grounds. There are notices displayed about our CCTV use. 

Our processing of your special category data will be based on Article 9(2)(g), which relates to processing necessary for reasons of substantial public interest, and on Schedule 1, paragraph 10 of the Data Protection Act 2018, which relates to preventing or detecting unlawful acts.    

Other purposes 

To ensure the South Norfolk Leisure operates efficiently and that we are providing the best possible service to our users, we will use your usage information as well as contact details and other identifying information as follows. 

• To send you email updates about leisure centre news (e.g. pool closures) where you need to know about this  

• Aggregate and analyse usage records to build a picture of how people access our leisure centres to assist with programme design and appropriate marketing of our programmes and activities 

• To aggregate and analyse South Norfolk Leisure usage records to determine the value and impact of participation. 

• Share limited, anonymised data with Sports England  for the purposes of national bench marking on physical activity. 

When we need to use your data for the activities listed above, the data protection that allows us to do that is article 6(1)(f), as processing is necessary for the purposes of the legitimate interests pursued by the University or by a third party. 

Our processing of information about your health will be based on Article 9(2)(a), which relates to your explicit consent to the processing for an explicit purpose, in this case the protection of your own health and safety. 

What personal data we collect and use about you 

The Council will use the following information about you, which can be broken down in the following broad headings: 

1. Contact details and other identifying information

• Full name, including title 

• Date of Birth 

• Telephone numbers 

• Email address 

• Place of residence, including postcode 

• Whether you consent to being contacted for marketing 

• Swipe card number 

• Details of relevant benefits or qualifying criteria to access discounts 

• signature 

• Special category data 

• Ethnicity  

• Disability and medical information (including allergies & medical incident / accidents) 

• Physical activity levels and ability (e.g. based on how often you use facilities) 

• Physical activity preferences (e.g. based on any activities you book) 
  
  

2. Direct debit information (if on a monthly membership)

• Name and address of account holder 

• Name and address of your bank or building society 

• Your bank or building society account number and sort code 
  
  

3. Data captured on CCTV cameras 

• Your image and actions 

• The leisure centres have CCTV cameras inside and outside the building which capture your image as you approach and enter the centres and use the facilities. There are notices to tell you about this and where to ask for more information. 

• Cameras outside the main buildings monitor some outside sports areas at Ketts Park. 

• Cameras inside the buildings are placed in general use areas, such as the entrance hall and café, including the pool.  

• Cameras are NOT located in changing rooms. 

• The pool hall has above and below water cameras which are monitored by the life-guards during all swim sessions. Lifeguards use a monitor which is attached to each of the lifeguard chairs. The main control unit is kept in a locked room and is not directly viewable or accessible by leisure staff or customers 
  
  

4. Location and usage information

• Your entry into the leisure centres when you use the entry gates 

• Bookings data, including those linked to your swipe card (e.g. classes or facilities) 

• Please note, sometimes we might have to temporarily deactivate your swipe card so that reception staff are prompted to give you personalised membership information or you essential safety information which needs your immediate attention. 

Who provides this information 

We receive most of this information from you, but we may also obtain some of this data from the following individuals/agencies where relevant: 

• Parents/guardians 

• School 

• Activity referral schemes 
  

How we share your information  

We share your data with a number of organisations/processors in order to undertake the following: 

Information may also be shared externally with the Police and other agencies in order for the Council to carry out their statutory duties. Apart from where previously stated, we do not pass your details to third parties unless we are lawfully able to do so for the prevention and detection of crime and fraud, or for the collection of taxes. 

Any information which is shared will only be shared on a need to know basis, with appropriate individuals. Only the minimum information for the purpose will be shared. 

How long will we keep your personal information for 

The information you provide will be held securely by us for a period as follows: 

How we keep your information 

The information is stored electronically, on the Council’s network including records management systems.  

Changes to this notice 

We may amend this privacy notice at any time so please review it frequently. The date below will be amended each time this notice is updated. 

This notice was updated in April 2026.