Privacy Notice

What information do we collect?

 The Authority is the data controller of the personal data you provide to us. Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

 

Personal details:

 To join our mailing list you will be asked to create a subscription profile based on your interests. We will ask you for your name, telephone number, postal address and e-mail address along with areas of interest.

 

When you sign-up to take part in the activities provided at our venues, we will require personal details to process the order.

 

If you contact us by email or via Our Websites we may keep a record of your contact information and enquiry so that we may respond to your enquiry.

 

When you apply for one of our open job roles via our web portal you will be asked to submit relevant personal details and information for the position you are applying for so that we may consider you for the position. This information might include information provided to us in your curriculum vitae and covering letter, information provided on our application form and any information you provide to us during a subsequent interview.

 

If you apply to take part in volunteering activities with the Authority you will be asked to provide identity and contact data so that we may process your application and offer you volunteering opportunities with the Authority.

 

If you submit a wildlife sighting, you will be asked to provide your name and email address so that we can verify the sighting and complete the “Seen by” field on the Wildlife Sightings webpage.

 

If you book to attend an event or apply for services offered by the Authority, we will ask you to provide your name and contact details so we may process your booking and deliver the event or services to you.

 

If you enter a competition, promotion or survey, you may have to provide your identity and contact data in order for us to fairly run the competition, promotion or survey and to contact you if you win a prize.

 

If you attend an event run by another organisation held at one of our venues and have provided consent as part of the ticket booking process, that organisation may share your name and email address with us for marketing and promotional purposes so that we can provide information that we think it is of interest to you.

 

Information that identifies you:

When you sign-up as a member on our Websites you will be provided with a membership id number which you can use when you book any activities with us.

 

Transaction details:

The Authority collects data for any transactions you carry out with the Authority whether through Our Websites, at our venues or over the telephone, so that your booking can be honoured and you can be provided with the services you have purchased.

 

Please note that we never store your payment details on our websites.

 

Special Category (Sensitive) Data:

When you sign-up for one of our activities we may ask you for information about your health, any medical conditions or your biometric data so that our colleagues are informed for the purpose of the activity and able to provide a safe environment for your selected activity.

 

We are sometimes required to collect information about your ethnicity in order to provide aggregated reports to your local authority. This information is used only for statistical purposes, does not link directly to any individual and is always kept secure.

 

In connection with volunteering activities, you will be asked to provide details of any medical conditions you consider relevant and are comfortable disclosing to us. Any such information provided will be used only to assess appropriate volunteering roles, undertake risk assessments, inform supervisors and to ensure that due consideration is given to health and safety issues.

 

In connection with an application you may make to work with us, we may collect, store and use the following "special categories" of more sensitive personal information: information about your race or ethnicity, religious beliefs, sexual orientation and political opinions.

 

Vehicle registrations:

The Authority’s rangers collect the registration numbers of abandoned vehicles so that we can conduct DVLA searches for information on the owners and determine whether a vehicle has been abandoned intentionally, which is an infringement of the Lee Valley Regional Park byelaws.

 

Information about website visits including IP address:

Our Websites’ web servers automatically gather information that your web browser sends whenever you visit our websites, such as your IP (Internet Protocol) address and information relating to which pages have used (such as cookies). We do this so we can learn more about how our customers use the websites in order to find ways to improve the websites and our services for your benefit. Cookies are further described in the Authority’s Cookies Policy.

 

Data relating to children:

Except as described above, we do not knowingly or specifically collect information about children under the age of 16. If you believe that we have mistakenly or unintentionally collected such information, please notify us crm@leevalleypark.org.uk so that we may delete the information from our servers.

 

How we use the information collected

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you.

• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

• Where we need to comply with a legal or regulatory obligation.

 

We may use your information in the following ways (relying on the legal bases shown below):

 

To provide you with any services that you are interested in or have agreed to:

• Venue activities (Performance of a Contract, Legal Obligation, Interests of Data Subject, Consent, Legitimate Interests to develop products)

• Complaints and feedback (Interests of Data Subject, Legitimate Interests of being efficient about how we respond to requests and complaints and seek to resolve them)

• Memberships updates (Performance of a Contract, Legal Obligation)

• Estate Rentals (Performance of a Contract)

• Freedom of Information, Complaints and Feedback (Public Interest/Exercise of Official Authority, Interests of Data Subject, Legitimate Interests of being efficient about how we respond to requests and complaints and seek to resolve them)

• Fishery Licences and Memberships updates (Performance of a Contract, Legal Obligation)

• Job Applications (Performance of a Contract, Legal Obligation, Legitimate Interests to decide whether to appoint individual to role as it would be beneficial to our business to appoint someone)

• Planning Consultations (Public Interest/Exercise of Official Authority, Consent, Legal Obligation)

• Schools Activity Management (Performance of a Contract, Consent, Legitimate Interests to develop products and grow community engagement)

• Stakeholder Engagement (Public Interest/Exercise of Official Authority, Legitimate Interests to improve and develop)

• Wildlife Sightings Information (Consent, Public Interest/Exercise of Official Authority, Legitimate Interests of wildlife management)

• Volunteers (Consent, Legitimate Interests of providing volunteering opportunities, engaging with the community and developing our services)

• Car Parking Permits (Performance of a Contract)

• Events in our Open Spaces (Performance of a Contract)

• Lee Valley Almost Wild Campsite, Broxbourne (Performance of a Contract)

• Community Access Fund Participants (Legitimate Interests to increase external funding for more participant programmes and to justify public spending)

 

In relation to job applications, the personal information we collect about you will be used to assess your skills, qualifications and suitability for the role; carry out background and reference checks, where applicable; communicate with you about the recruitment process; keep records related to our hiring processes; and comply with legal or regulatory requirements. We also need to process your personal information to decide whether to enter into a contract with you. We will use information about your disability status to consider whether we need to provide appropriate adjustments during the recruitment process, for example whether adjustments need to be made during a test or interview. We will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.

 

To update our records with any new information you give us.

 

To enforce our byelaws (Exercise of Official Authority, Protect the vital interests of individuals).

 

For research and analysis so that we can develop and improve our services and public function for your benefit.

 

To make suggestions and recommendations to you about goods or services that may be of interest to you (necessary for our Legitimate Interests to develop our products/services and grow our business).

 

To obey laws and regulations that apply to us.

 

Marketing and promotional purposes:

We will only contact you for marketing and promotional purposes if you have either consented to receive this information (either by consenting directly to us or by giving your consent to another organisation which is organising an event at one of our venues) or if we think it is of interest to you based on previous services you have received from us, or if you provided us with your details when you entered a competition or registered for a promotion, and, in each case, you did not opt-out of receiving that marketing.

 

Where you have given your consent to an event organiser providing us with your personal data for marketing and promotional purposes, in order for us to develop our products/services and grow our business, we may share that information with an operator of our venues. Other than as described above, we will not share your information with any third party companies for marketing purposes unless you have explicitly consented for us to do so.

 

You can unsubscribe at any time via telephone, our websites or by clicking the unsubscribe link at the bottom of all email communications.

 

You can also change your preferences by logging on to your My Lee Valley Page.

 

Third Parties

All personal data is processed fairly by Authority staff or service providers and sub-processors of the Authority where necessary depending on function. We require all third parties to respect the security of your personal data and to treat it in accordance with the law.

 

Some examples of the categories of third parties with whom we share your data:

• IT companies – we work with businesses which support our websites and other business systems.

• Online platforms – through which you can book services such as accommodation at some of our leisure venues.

• Email service providers - in order to send you marketing content and transactional emails, we share your details with our email service providers.

• Payment processing – we work with trusted third party payment processing providers in order to securely take and manage payments.

• Service providers – we work with a number of trusted businesses in order to provide you with the high quality services you expect from us such as health and safety specialists and park security providers.

• Venue operators – we work with organisations which operate certain of our venues on our behalf, such as Greenwich Leisure Limited.

 

Information sharing and disclosure

We may share your personal data with the parties described above for the purposes set out in ‘How we use the information collected’.

 

We may also share your data with third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. If a change happens to our business, then the new operators or owners may use your personal data in the same way as set out in this Privacy Notice. Other than as described above, your personal data will never be supplied to anyone outside of the Authority without your explicit consent, except where we are obliged by law to disclose it.

 

International transfers

We do not transfer your personal data outside the European Economic Area. Where our service providers are based in the US, they may be permitted access to our servers. Those service providers are part of the Privacy Shield which requires them to provide similar protection to personal data shared between Europe and the US. For further details, please see European Commission: EU-U.S. Privacy Shield Framework.

 

Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We have also put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

 

Separately, you also need to take precautions to protect your personal data when you use the internet.

 

We cannot guarantee the security of any private information provided to us in an email or in online form while it is being transmitted to us, as the internet is a potentially non-secure method of information transfer. Any such transmission is at your own risk. If in the course of using the Authority’s websites you choose to upload or post private information on public areas of the site, such information is not considered personal information and will not be subject to this Privacy Notice.

 

How long do we retain your personal information?

We retain your personal information for as long as is necessary to fulfil the purposes we collected it for (see ‘What information do we collect?’) including for the purposes of satisfying any legal, accounting or reporting requirements.

 

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

 

Details of retention periods for different aspects of your personal data are available from us on request by contacting us. In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

 

In relation to our email mailing lists, each email sent by the Authority uses our email marketing solution and provides a clear unsubscribe link which will immediately remove you from any or all of our mailings as you specify.

​

Updates to this Privacy Notice

This version was last updated on 3 May 2024.

 

What are your rights as the data subject?

You have the right to request a copy of the personal information the Authority holds about you by submitting a Subject Access Request using the contact details below. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

 

If at any point you believe the information we process about you is incorrect, you can request to have it corrected or deleted by contacting us using the contact details below.

 

If you wish to raise a complaint on how we have handled your personal data, you can contact our Data Protection Officer who will investigate the matter.

 

Our Data Protection Officer is responsible for overseeing questions in relation to this Privacy Notice. To contact our Data Protection Officer, you may do so in any of the following ways:

• Post 

• Telephone

• Email 

 

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

 

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO) on 0303 123 1113 or by following the link.