Privacy Policy

Cardiff International White Water Privacy Policy

If you have booked an activity on behalf of a group, you are responsible for ensuring that each group member has read and agrees to the use of their information in accordance with this privacy policy.

1. Why read this?

Data is important to the services that we provide to you in relation to the activities at our premises and also at St Fagan’s National Museum of History (the “Activities”).  This policy tells you how we use your personal information, and what we do to keep it safe.

2. What certain words mean

This Privacy Policy (the “Policy”) describes how County Council of the City and County of Cardiff, County Hall, Atlantic Wharf, Cardiff CF10 4UW (“we”, “us” and “our”) collects, stores and uses information about you in connection with our Activities, including your use of our website (the “Site“).

“Data Protection Law” means the Data Protection Act 1998, the GDPR, and the Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended from time to time, and all other applicable privacy and data protection laws and regulations, as well as any guidance and/or codes of practice issued from time to time by the Information Commissioner.

For the purposes of Data Protection Law, we are data controllers, which means we control the processing of your personal information in accordance with Data Protection Law and are responsible for holding your personal information safely.

3. Information we may collect about you

  • Contact name(s), address, email, phone number
  • Credit/debit card details and related payment information
  • Voucher information
  • Information we collect when you send us emails or letters
  • Information about your engagement with us on social media
  • Health, medical history and safety paperwork, which includes information you give about existing medical conditions and records we keep of accidents
  • Anonymous information about visitors to our Site, such as where they are from geographically, the pages they visit, the devices and browsers they use
  • Information about your engagement with our social media sites, such as Twitter, Instagram, YouTube and Vimeo

4. Information about other individuals

If you give us information on behalf of another person, including other people in your group, it is your obligation to show this Policy to them, to ask them to read it thoroughly and to make sure they acknowledge and agree to their personal data being processed in accordance with this Policy.

5. What’s the legal basis for us processing your information?

We’ll process your personal data in accordance with this Policy only in one or more of the following circumstances:

  • you have given us consent, for instance i) you complete a booking form, phone or email us to give us information so that we can manage your booking of the Activities and ii) you give us information, including relating to your health, so that we can assess whether it is safe for you to undertake the Activities
  • where it’s necessary for us to enter into a contract with you, including to provide you with quotes, provide our services, process your payment and to respond to enquiries made by you
  • for compliance with our legal obligations
  • for the purpose of furthering our legitimate interests, including in respect of improving our services, social media, the Site and the Activities

6. How we use your Information

We may process your information for the following purposes:

  • to help us identify you and any booking for Activities you have made with us
  • to remind you about your booking with us
  • to notify you of any changes to your booking, updates to our terms or other changes to our services that may affect you
  • to contact you in relation to any enquiry you send to us
  • to enable us to contact the parent/guardian in an emergency
  • to ensure medical treatment or first aid you receive at our facilities is given in accordance with any medical information you give us
  • to keep records of accidents or incidents that relate to Activities
  • to facilitate produce development, to operate, maintain and improve our services, Site and Activities
  • to monitor how our website and social media is working and to enable us to improve its information and functionality
  • to analyse data collected by cookies on our Site and social media, in an anonymised way, to check usage and trends, and to plan future marketing campaigns

7. Sharing your information

The information we collect is for our own use and we do not share it further other than:

  • we may disclose your information to service providers assisting with our business activities such as our telematics providers, payment services providers, telematics distribution providers, IT hosting providers, providers of IT support, providers of cloud based software or services used by us, accounting, compliance and law firms
  • we will disclose your data to law enforcement agencies if it is required by law, a court order or our regulators, or if necessary to establish, exercise or defend our legal rights, including if we suspect fraud or attempted fraud

8. Keeping your information secure

We are committed to protecting your information that we collect and to keeping that information safe and confidential. Accordingly we limit access to your personal information to employees and certain third parties (see above) who need to process it in accordance with this Policy.

We’ll use technical and organisational physical, electronic and procedural safeguards in accordance with good industry practice to safeguard your information collected against unauthorised or unlawful processing and against accidental loss, damage, destruction, alteration or disclosure.

We’ll keep your information only for as long as we need to hold it, including to comply with our legal and regulatory obligations.

9. Retention of your data

We will keep your personal data for no longer than is necessary.

Regulatory and legal requirements may require us to hold data for a longer period. When we no-longer need to hold your data, it will be anonymised and/or deleted.

10. Marketing

We will not contact you with regards to marketing by mail, telephone or email.  

When you respond to one of our adverts or social media posts by clicking a link that takes you to our Site, we track that activity from a special cookie or tag that the social media platform uses and reports to our analytics tool. 

The Site may contain links to the websites or apps of our partners or third parties. Please note that if you follow any of these links, the websites, apps and services provided through them will have their own privacy policies and terms of use. We do not accept any responsibility or liability for their respective privacy policies and terms of use, or the collection and use of any personal data collected through these websites, apps or services. You’ll need to make sure that you review the relevant privacy policies and terms of use before providing any personal data or using these websites, apps and services.

11. Your rights

You have the following rights in accordance with data protection legislation. Please note that some of the rights may only apply under certain circumstances:

  • the right to obtain a copy of the personal data we have collected about you, and to transmit said copy to another data controller;
  • the right to update or amend the personal data we have collected about you if it is inaccurate or incomplete;
  • the right to erase, or restrict the processing of, the personal data we have collected about you;
  • the right to object to the processing of the personal data we have collected about you, including in respect of any data processed for direct marketing purposes;
  • the right to withdraw any consents you have provided in respect of our processing of your personal data, and;
  • the right to lodge a complaint with the ICO (www.ico.org.uk).

To exercise any of these rights please write to us using the contact information stated above in section 1. In case you want to amend your personal data you can also do so via our Site.

12. Changes to this Policy

We may change this Policy from time to time. You should check this Policy regularly to ensure you are aware of the most recent version that will apply each time you use the Site.

13. Links to other websites

Our Site may contain links to other websites. This Policy only applies to our Site.  If you access links to other websites any Information you provide to them will be subject to the privacy policies of those other websites.

14. Contact Details

Anything unclear? If you have any questions about this policy, please contact us at dataprotection@cardiff.gov.uk

You can also contact us at Cardiff Council, County Hall, Atlantic Wharf, Cardiff CF10 4UW

If it’s urgent, you can also contact our data protection officer directly at 02920 872 480. Our data protection officer ensures that our processing personal data is carried out in accordance with applicable law.