Personal data we process to support Covid 19 Test and Trace - Wales
To support NHS Wales Test, Trace, Protect service, we have been mandated by law to collect and keep a limited record of staff, customers and visitors who come onto our premises for the purpose of contact tracing.
Why do we need to collect this data?
By maintaining records of staff, customers and visitors, and sharing these with NHS Wales Test, Trace, Protect service where requested, we can help to identify people who may have been exposed to the coronavirus.
What data will we collect?
As a customer/visitor of Parkdean Resorts you will be asked to provide some basic information and contact details. The following information will be collected:
- the names of all customers or visitors, or if it is a group of people, the name of one member of the group
- a contact phone number for each customer or visitor, or for the lead member of a group of people
- date of visit and arrival time and departure time
Parkdean Resorts, as the data controllers for the collection of your personal data, will be responsible for compliance with data protection legislation for the period of time it holds the information. When that information is requested by the NHS Wales Test, Trace, Protect service, the service would at this point be responsible for compliance with data protection legislation for that period of time.
The NHS Wales Test, Trace, Protect service as part of safeguarding your personal data, has in place technical, organisational and administrative security measures to protect your personal information that it receives from the venue/establishment, that it holds from loss, misuse, and unauthorised access, disclosure, alteration and destruction.
How long will we retain the data?
NHS Wales Test, Trace, Protect service have asked us to retain this information for 21 days from the date of your visit, to enable contact tracing to be carried out by NHS Wales Test, Trace, Protect service during that period. We will only share information with NHS Wales Test, Trace, Protect service if it is specifically requested by them.
For example, if another customer at the venue reported symptoms and subsequently tested positive, NHS Wales Test, Trace, Protect service can request the log of customer details for a particular time period (for example, this may be all customers who visited on a particular day or time-band, or over a 2-day period).
Under government guidance, the information we collect may include information which we would not ordinarily collect from you and which we therefore collect only for the purpose of contact tracing. Information of this type will not be used for other purposes, NHS Wales Test, Trace, Protect service will not disclose this information to any third party unless required to do so by law (for example, as a result of receiving a court order). In addition, where the information is only collected for the purpose of contact tracing, it will be destroyed by us 21 days after the date of your visit.
However, the government guidance may also cover information that we would usually collect and hold onto as part of our ordinary dealings with you (perhaps, for example, your name, date of birth and phone number). Where this is the case, this information only will continue to be held after 21 days and we will use it as we usually would, unless and until you tell us not to.
Your information will always be stored and used in compliance with the relevant data protection legislation.
What is our lawful basis for collecting and sharing this data?
The use of your information is covered by the General Data Protection Regulations Article 6 (1) (c) – a legal obligation to which we as a venue/establishment are subject to. The legal obligation to which we’re subject, means that we’re mandated by law, by a set of new regulations from the Welsh government, to co-operate with the NHS Wales Test, Trace, Protect service, in order to help maintain a safe operating environment and to help fight any local outbreak of corona virus.
By law, you have a number of rights as a data subject, such as the right to be informed, the right to access information held about you and the right to rectification of any inaccurate data that we hold about you.
You have the right to request that we erase personal data about you that we hold (although this is not an absolute right).
You have the right to request that we restrict processing of personal data about you that we hold in certain circumstances.
You have the right to object to processing of personal data about you on grounds relating to your particular situation (also again this right is not absolute).
Do you have a question or complaint?
If you have a question or wish to complain about how your personal data is used, you should contact our Data Protection Officer for further information.
Data Protection Officer
Parkdean Resorts UK Ltd
One Gosforth Park Way
Gosforth Business Park
Newcastle upon Tyne
If you are still not satisfied, you can complain to the Information Commissioner’s Office. The Information Commissioner can be contacted at:
Information Commissioner’s Office Wycliffe House
0303 123 1113
We keep our privacy notice under regular review, and we will make new versions available on our website. This privacy notice was last updated on 01 October 2020.