GDPR & Confidentiality
Purpose
The McDermott Fitness Academy, collectively referred to as "Company", "they", "their" or "them" in this privacy notice, respects your privacy and are committed to protecting your personal data. This privacy notice will inform you as to how they look after your personal data and tell you about your privacy rights and how the law protects you.
This privacy notice aims to give you information on how the company collects, stores, uses, transfers and or shares("processes" or "uses") your personal data when you enquire with them, register with them, apply for a job with them, contact them, purchase or make payments for any of their products or services, sign up to receive information from them, take part in one of theircompetitions, promotions or surveys, or visit their websites ("Sites") and mobile applications ("Apps") (regardless of where you visit them from). If you do not agree with the data practices described in this privacy notice, you should not their Sites or Apps or engage with them as described above.
The McDermott Fitness Academy’s Sites and Apps are not intended for children, and they do not knowingly collect data relating to children.
This privacy notice aims to give you information on how the company collects, stores, uses, transfers and or shares("processes" or "uses") your personal data when you enquire with them, register with them, apply for a job with them, contact them, purchase or make payments for any of their products or services, sign up to receive information from them, take part in one of their competitions, promotions or surveys, or visit their websites ("Sites") and mobile applications ("Apps") (regardless of where you visit them from). If you do not agree with the data practices described in this privacy notice, you should not their Sites or Apps or engage with them as described above.
In summary, this policy serves 3 key purposes:
1. To provide a framework for the McDermott Fitness Academy to achieve GDPR compliance.
2. To define how GDPR applies to the McDermott Fitness Academy and its employees.
3. To prevent data protection breaches.
Audience
This policy addresses all learners and paying customers, employees and contractors, partners of the McDermott Fitness Academy, and any other person to interact or engage in communication with the Company directly or via its Sites or Apps.
Definition of key terms
Data Controller
The UK GDPR defines a controller as:
“The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.”
Controllers make decisions about processing activities. They exercise overall control of the personal data being processed and are ultimately in charge of and responsible for the processing.
The McDermott Fitness Academy is the data controller and is responsible for your personal data.
Data Protection Officer
The McDermott Fitness Academy has appointed a data protection officer ("DPO") who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, you may contact the DPO using the details set out below.
You can write to the DPO at d.mcd@hotmail.co.uk.
Data Processor
The UK GDPR defines a processor as:
“‘Processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.”
Processors act on behalf of the relevant controller and under their authority. In doing so, they serve the controller’s interests rather than their own.
Although a processor may make its own day-to-day operational decisions, Article 29 says it should only process personal data in line with a controller’s instructions, unless it is required to do otherwise by law.
The data processors are any employee of the McDermott Fitness Academy.
Should you have concerns about the use of your data, you may enquire directly with the McDermott Fitness Academy. Alternatively, you can file a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues: https://ico.org.uk/
Data Subject
The term ‘Data Subject’ refers to any living individual whose Personal Data is collected, held or processed by an organisation.
Changes to the Privacy Notice and Your Duty to Inform of Changes
It is important that the personal data the Company holds about you is accurate and current. Please notify the McDermott Fitness Academy of any changes to your personal data during your relationship with them.
The most up-to-date version of the Company’s Privacy Notice will be available on the website but may be requested by you at any time.
Your Personal Data
Personal Data is information that relates to an identified or identifiable individual.
It does not include data where the identity has been removed (anonymous data).
To understand your Personal Data in more detail, see here: What is personal information: a guide | ICO
Lawful Basis
The lawful bases for processing are set out in Article 6 of the UK GDPR. The McDermott Fitness Academy will process Personal Data in accordance with at least one of the following bases:
1. Consent: You have given clear consent for the Company to process your personal data for a specific purpose.
2. Contract: The processing of your data is to purchase a product or service, or to enter a contract with the McDermott Fitness Academy.
3. Legal obligation: The processing of your data is necessary for the Company to comply with the law.
4. Vital interests: The processing of your data is necessary to protect someone’s life.
5. Public task: The processing of your data is necessary for the Company to perform a task in the public interest or for its official functions, and the task or function has a clear basis in law.
6. Legitimate interests: The processing of your data is necessary for the Company’s legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your Personal Data which overrides those legitimate interests.
You can find more detail on lawful basis, here: A guide to lawful basis | ICO
Third Parties
As per the GDPR, "third party" means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data. The legitimate interests of a third party may serve as legal basis and justify processing of Personal Data by the controller.
External Third Parties
• Service providers – Provision of IT services, sub-contracting of work, recruitment agencies and system administration services.
• Professional advisors - lawyers, bankers, accountants, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.
• HM Revenue & Customs, regulators and other authorities such as accreditation organisations who require reporting of processing activities in certain circumstances.
• Finance companies, financial institutions, credit reporting agencies, finance merchants (e.g. financial services providers), brokers, fraud prevention agencies and market researchers who facilitate or provide financial services and information or marketing services in certain circumstances.
Scope
The McDermott Fitness Academy may process different kinds of personal data about you, as follows:
• Identity Data - first name, middle name, last name or maiden name, username or similar identifier, marital status, title, date of birth and gender.
• Contact Data - billing address, delivery address, email address and telephone number(s).
• Financial Data - bank account and payment card details. The McDermott Fitness Academy does not store credit card details.
• Transaction Data - details about payments to and from the McDermott Fitness Academy and details of products and services you have purchased from them.
• Technical Data - internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access the McDermott Fitness Academy’s Sites and Apps.
• Profile Data - your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
• Usage Data - information about how you use the McDermott Fitness Academy’s Sites, Apps, products and services.
• Marketing and Communications Data - your marketing preferences relating to communications from the McDermott Fitness Academy and its third parties.
Aggregated Data
The McDermott Fitness Academy may process Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your Personal Data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, your Usage Data may be used to calculate the percentage of users accessing a specific Site or App feature. However, if the Aggregated Data is connected to your Personal Data so that it can identify you, the combined data will be treated as personal data in accordance with this privacy notice.
Special Categories of Personal Data
Special Categories of Personal Data are more sensitive and require stronger legal data protection. These are the Special Categories:
• race
• ethnic background
• political opinions
• religious beliefs
• trade union membership
• genetics
• biometrics (where used for identification)
• health
• sex life or orientation
The McDermott Fitness Academy may only process Special Categories of Personal Data about you to meet the regulatory requirement for awarding organisations. Namely, these Special Categories are your ethnicity and health. Ethnicity data is processed to ensure groups of learners are not unfairly advantaged or disadvantaged and health data is processed to ensure any reasonable adjustments are made to facilitate learners.
Recruitment
The McDermott Fitness Academy does not ask for any Special Categories of Personal Data to be disclosed to them as part of anyjob application. If your application is successful and a position is offered to you, you will be asked to conduct a Disclosure and Barring (“DBS”) check, at which time the McDermott Fitness Academy should explain why that information is required and how they intend to use it. The legal bases for processing Special Categories of Personal Data are as follows:
(a) Necessary for performance of a contract with you.
(b) Necessary to comply with a legal obligation.
(c) Necessary for the Company’s legitimate interests (to comply with awarding organisation requirements); and
(d) Necessary for vital interests (to protect someone’s life).
Third-Party Links
Our Sites may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our Sites, we encourage you to read the privacy notice of every website you visit.
The McDermott Fitness Academy delivers face-to-face courses at third-party establishments whereby the venues require at least the names of all course participants. Should you wish to know how they use your data, you may request this information directly with the third party.
If You Fail to Provide Personal Data
Where the McDermott Fitness Academy needs to collect personal data by law, or under the terms of a contract with you, and you fail to provide that data when requested, the Company may not be able to deliver on the product or service, nor may they enter contract with you. In such instance, the product or service you have with the McDermott Fitness Academy may be cancelled, but you will be notified at the time.
How Your Personal Data is Collected
The McDermott Fitness Academy uses the following methods to collect data from and about you:
• Direct interactions.
You may provide your Identity, Contact and Financial Data by filling in forms or correspondence by post, phone, email or otherwise. This includes personal data you provide when you:
o apply for the Company’s products or services.
o create an account on the Company’s Sites or Apps.
o subscribe to the Company’s services or publications.
o request marketing to be sent to you.
o enter a competition, promotion or survey; or
o provide feedback to the Company.
• Automated technologies or interactions.
When you interact with the McDermott Fitness Academy’sSites or Apps, the Company may automatically collect Technical Data about your equipment, browsing actions and patterns. This personal data is collected by using cookies, server logs and other similar technologies.
• Third parties or publicly available sources.
The Company may receive personal data about you from various third parties and public sources as set out below:
o Contact, Financial and Transaction Data from providers of technical, payment and delivery services.
o Identity and Contact Data from data brokers or aggregators.
o Identity and Contact Data from publicly availably sources.
How Your Personal Data is used
The McDermott Fitness Academy will only use your personal data when the law permits it. More specifically, the Company will use your personal data in the following circumstances:
1. When the Company must provide a product, service or contract agreement
2. When it is necessary for the Company’s legitimate interests (or those of a third party) and your interests or fundamental rights do not override them.
3. Where the Company must comply with a legal or regulatory obligation.
The McDermott Fitness Academy does not rely on consent as a legal basis for processing your personal data other than in relation to sending third party direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by unsubscribing.
Purposes for Using Your Personal Data
The McDermott Fitness Company must use your personal data in purposeful manner, for which the legal bases are specified in this section. For transparency, the Company has identified what their legitimate interests are, where appropriate.
Should you require any further information about how the McDermott Fitness Academy uses your data, please contact the Company directly.
Marketing
The McDermott Fitness Academy endeavours to provide you with choices for how your Personal Data is used, particularly in relation to marketing and advertising. By purchasing one of the Company’s products or services, you accept and agree to this Privacy Notice and express your consent for the Company to send you marketing communications.
Promotional Offers
The McDermott Fitness Company may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what products or services may be of interest to you, and present these to you by way of marketing.
You will receive marketing communications if you have requested to receive information from the Company or have purchased goods or services from them. You may also receive such communication if you provided your details when entering a competition or registering for a promotion and, in each case, you have not opted out of receiving that marketing.
Third-Party Marketing
The McDermott Fitness Academy must obtain your express opt-in consent for third-party marketing prior to sharing your Personal Data with any external company. Without your consent, the company must not share your Personal Data.
Opting Out of Marketing
You can request to opt out from receiving marketing communications from the McDermott Fitness Academy or any third parties, by simply contacting the Company directly.
Cookies Policy
The McDermott Fitness Academy collects information directly from you through ”cookies”. Most websites use cookies to function, work more efficiently, or provide information to the website owners. Cookies tell the Company how their customers and potential customers use their website which helps them improve the design, layout, content and function of the site.
Cookies are small text files that are placed on your computer’s hard drive by websites that you visit. They save and retrieve pieces of information about your visit to the website. For example, how you entered the site, navigated through it and what information was of interest to you. When you return to the website, it gives tailored options based on the information it has stored about you. Some of the Company’s website cookies collects anonymous information about how visitors use the website.
Where there is a login process to buy products or services, cookies are used to store personal registration information, so you do not have to provide it again on your next visit. If you wish, you can disable cookies by changing the settings in the preferences or options menu in your browser.
You can set your browser to reject or block cookies or to tell you when a website tries to put a cookie on your computer. You can also delete cookies that are already stored on your computer’s hard drive. However, blocking cookies entirely may mean parts of the website do not work for you as some of the cookies are essential for the Site’s operation.
You can find more information on cookies here: All About Cookies | Online Privacy and Digital Security
Change of Purpose
The McDermott Fitness Academy must use your Personal Data only for the purposes by which it was collected, unless they reasonably consider it is needed for another reason, compatible with the original purpose.
Should the Company need to use your Personal Data for another purpose that is unrelated to the original purpose of acquiring it, you will be notified and provided with the legal basis for it.
Please note that the Company may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
Disclosures of Your Personal Data
The McDermott Fitness Academy may need to share your Personal Data with the parties set out below for the purposes set out above.
1. External Third Parties as set out in the Definition of key terms.
2. Third parties to whom the Company may choose to sell, transfer, or merge parts of the business or assets. Alternatively, the Company may seek to acquire other businesses or merge with them. If such a change happens to the business, the new owners may use your Personal Data in the same way, as set out in this privacy notice.
The McDermott Fitness Academy requires all third parties to respect the security of your Personal Data and to treat it in accordance with the law. The Company does not allow third-party service providers to use your Personal Data for their own purposes and only permits them to process your Personal Data for specified purposes and in accordance with the Company’s instructions.
International Transfers
Should the McDermott Fitness Academy need to transfer your personal data out of the EEA, they must ensure a similar degree of protection by ensuring at least one of the following safeguards is implemented:
1. Where certain service providers are used, the Company may use specific contracts approved by the European Commission which give Personal Data the same protection it has in Europe. You can read more here: Standard Contractual Clauses (SCC) - European Commission (europa.eu)
2. Where providers based in the US are used, the Company may transfer data to them if they are part of the Privacy Shield, which requires them to provide similar protection to personal data shared between Europe and the US. You can read more here: EU-US data transfers - European Commission (europa.eu)
Data Security
The McDermott Fitness Academy ensures your Personal Data is secure to prevent it from being accidentally lost, used or accessed in an unauthorised way. The Company limits access to your Personal Data to its employees, contractors and other third parties who have a business need to know. They will only process your personal data on the Company’s instruction, and they are subject to a duty of confidentiality.
The Company shall respond without delay to any suspected breach of Personal Data, notifying you and any applicable regulator where it is a legal obligation to do so.
Data Retention
Your Personal Data will only be retained for as long as necessary to fulfil the purposes of its collection, including for the purposes of satisfying any legal, accounting, or reporting requirements.
The appropriate retention period is also considerate of the amount, nature, and sensitivity of your Personal Data, in accordance with the applicable legal requirements, and any potential risks from unauthorised use or disclosure of your information.
By law, the Company must keep basic information about their customers (including Contact, Identity, Financial and Transaction Data) for six years after they cease being customers for tax purposes.
The Company may anonymise your data by removing its association to you, for research or statistical purposes. Such information may be used indefinitely without further notice to you.
Principles
The UK GDPR sets out seven key principles that the McDermott Fitness Academy endeavours to adhere to:
1. Lawfulness, fairness and transparency – Processing your data in a lawful and fair manner and being transparent in the ways the Company does that.
2. Purpose limitation – Having legitimate purpose to use your data.
3. Data minimisation – Only using data that is necessary for the purpose.
4. Accuracy – Data is accurate and up to date, and anything that is not is rectified without delay.
5. Storage limitation – Holding data for only as long as is necessary or agreed by you.
6. Integrity and confidentiality (security) – Appropriate security measures to protect the data against unauthorised or unlawful processing or accidental loss or destruction.
7. Accountability – The Data Controller, in this case the Company, should be responsible and be able to demonstrate compliance.
Your Rights
Under the Data Protection Act 2018, you have the right to find out what information the McDermott Fitness Academy stores about you. These include:
1. The right to be informed
You have a right to know what data the McDermott Fitness Academy collects, how it is used, how long it is stored and whether it is shared with any third parties.
2. The right of access
You have a right to submit a “data subject access request”, whereby the McDermott Fitness Academy must provide a copy of any personal data they hold about you. This enables you to check that the Company is lawfully processing your information. They must provide this as soon as possible, within at most 1 month.
In certain circumstances, for example particularly complex or multiple requests, the Company can take a further 2 months to provide data. In this case, they must tell you:
• within 1 month of your request
• why there’s a delay
When information can be withheld
There are some situations when the McDermott Fitness Academy may withhold information, for example if the information is about:
• the prevention, detection or investigation of a crime
• national security or the armed forces
• the assessment or collection of tax
• judicial or ministerial appointments
The Company reserves the right to not disclose why the information is being withheld.
How much it costs
Requests for information are usually free, however the Company may charge an administrative cost if you’re asking for a large amount of information, or your request will take a lot of time and effort to process.
3. The right to rectification
If the McDermott Fitness Academy holds inaccurate or incomplete information about you, you can request that it be updated. As with the right of access, The Company has 1 month to do this, and the same exceptions apply.
4. The right to erasure
You can request for the McDermott Fitness Academy to erase your when the data is no longer necessary, if the data was unlawfully processed, or if it no longer meets the lawful ground for which it was collected.
You may withdraw consent at any time where your consent is relied upon to process your personal data. However, this will not affect the lawfulness of any processing carried out prior to your withdrawal of consent. If you withdraw your consent, the Company may not be able to provide certain products or services to you, but they will advise if this is the case at the time.
5. The right to restrict processing
You can request that the McDermott Fitness Academy limits the way it uses your personal data.
You may choose to exercise this right when you no longer use the product or service for which your data was originally collected.
6. The right to data portability
You may obtain and reuse your personal data for your own purposes across different services. This right only applies to personal data that you have provided to the McDermott Fitness Academy by way of consent or a contract.
7. The right to object
You may object to the processing of your personal data that has been collected on the grounds of legitimate interests. The McDermott Fitness Academy must stop processing your information unless compelling legitimate grounds can be demonstrated that override your interests, rights and freedoms.
The Company may also refuse this right if the processing is for establishing or exercising defence of legal claims.
8. Rights related to automated decision-making including profiling
You may challenge the processing of your data that has been made with no human involvement, such as profiling, which uses your Personal Data to make calculated assumptions.
You can read the legislation here: Data Protection Act 2018 (legislation.gov.uk)
Policy 4: Version 1 Author: David McDermott Contact: d.mcd@hotmail.co.uk Publication date: 28 09 2024 Review date: 28 08 2025