This policy is effective as of 9th October 2018.
At TGO we are committed to respecting and protecting your online privacy. This includes your right to know what we do with the personal information you share with us. It also guides our policies regarding the management of your data, including how the information is collected, how it is processed, and for what purposes.
It is important to us that we communicate our policies and procedures with you clearly and in a manner that provides clarity to you a member of TGO Activate. As such, this policy covers the following key areas:
1. Background Information
2. Why we need your data
3. Categories of data
4. What data we collect
5. What data we Share
6. How we contact you
7. How we protect your information
8. Retention Periods
9. Automated Decision Making
10. Your rights to manage your data
1. Background Information
TGO Activate is the trading name for The Great Outdoor Gym Company Activate Ltd Registered address: 2 Jubilee Way, Faversham, Kent ME13 8GD, UK. Company number 12175723
Our designated Data Protection Officer is Georgie Delaney
Questions about this privacy policy may be submitted to TGO Activate via e-mail to [email protected]
2. Why We Need Your Data
We need your data to process your order of a class and course and keep in touch with you about this course and other courses. We also will use your feedback and tracking to evaluate our success and may use this data in an anonymized format to track efficacy of our workouts to improve health.
The General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA) require that all information we collect must be done so under a specific lawful basis. There are six clearly-defined lawful bases for processing information, and we categorise the majority of our data processing under three of those: Contract, Legitimate Interests and Consent.
2.1. Contract
When you register at TGO-Activate.com we need certain information about you to enable us to provide you with the service of a digital class or course and to ensure those courses are delivered to an appropriate standard, and to allow us to provide you with accurate records of your participation.
This lawful basis also includes any administrative or service-related emails, for example, to confirm that you have registered with us or taken part in one of our classes, or to alert you of an update to this Privacy Policy or other policies that are relevant to you. These therefore do not offer an option to unsubscribe as they are necessary to provide the services you requested.
If you do not provide the information required then we will not be able to provide you with records of your participation.
2.2. Legitimate Interests
Outside of your direct participation we also wish to develop the reach and impact of our classes and course and as such have a legitimate interest to process certain information with this aim. This includes things like carrying-out research to further understand what you thought of our services.
2.3. Consent
Above and beyond simple participation in a TGO Activate class or course, there are a number of ways you can help us to ensure our courses positively impact the fitness and wellbeing of their local communities.
One of the best ways to support us in this way is by consenting to receive emails regarding things like, event profiles, offers, competitions and emails from our partners, training tips, and more. We therefore provide the opportunity at registration, and via your profile, to opt in to these communications. You can opt out at any time.
Due to GDPR requirements for providing consent, we do not process any data on children under the age of 13 as it would require consent as the lawful reason for processing. For this reason, children under the age of 13 do not have the option to opt in to the above emails.
2.4. Other Bases
Although extremely rare, there can be occasions where we are required to process information under one of the other three lawful bases: Legal Obligation, Vital Interest, Public Task.
3. Categories of Data
We utilise the following definitions for the types of data we collect:
3.1. Profile & Identity
Email, password, physical activity levels, wellbeing, date of birth, gender, full name, images, postcode (not used for purposes of contact), goals, medical/health information, third party linking information are included in the information we ask for.
3.2. Contact
Email address, mobile phone number (SMS results service).
3.3. Technical
IP address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, records of pages visited and other information about the devices you use to access the site.
3.4. Incident
As part of our continual review of incidents at TGO Activate events we maintain a record of relevant details.
3.5. Survey
Any data submitted to us as part of research activities.
3.6. Event Imagery
Filming and photography captured at our publicity or launch events.
4. What Data We Collect
There are a number of ways where either you are able to explicitly share data with us or we are able to collect it as a result of your actions:
4.1. At registration
We collect information about you that allows us to sign you into TGO-activate.com. We use this information to create a profile for you on our database, to which we can connect the TGO events you have attended that in turn track your progress toward various TGO Activate participation milestones. We also collect information around your activity levels and other relevant personal information that may help us support your participation more appropriately.
4.2. Using your profile
You can update information such as your progress, goals and feedback as you go on your user dashboard.
4.3. Research Surveys
From time-to-time we send out research surveys that allow us to develop an understanding of TGO Activate and its participants.
4.4. Partner surveys
Sent out by us, help to support our sponsors and other stakeholders in understanding their level of connection with the TGO Activate communities they support.
4.5. Incident reports
Compiled by our local Activate teams in the event of an incident. Relevant data is collected by the volunteers and uploaded directly or via email to our secure online incident reporting system. In some cases staff add to this data through the process of following-up on incidents.
4.6. Cookies
When you visit our websites, cookies will be stored on your computer. Generally, cookies and similar technologies work by assigning to your browser or device a unique number that has no meaning outside of TGO Activate. We use these technologies to personalise your experience and to assist in delivering content specific to your interests. Additionally, after you’ve launched and the TGO Activate App and entered you name. e-mail and password we save that information so you don’t have to re-enter it repeatedly. Most browsers automatically accept cookies.
Some third-party services we use, such as Google Analytics, may place cookies in your browser. This Privacy Policy covers use of cookies by TGO Activate only, and not the use of cookies by third parties.
To manage the collection of information through cookies or other equivalent technology you can use the settings on your browser or mobile device.
4.7. Log Files
The collection of information: Every time you connect to TGO websites your IP (Internet Protocol) address registers on our servers. Your IP address reveals no information other than the number assigned to you. We do not use this technology to obtain any personal data against your knowledge or free will (i.e. automatically recording email addresses of visitors). Nor do we use it for any purpose other than to help us monitor traffic on our website, or (in case of criminal activity or misuse of our information) to cooperate with law enforcement.
4.8. Web Beacons
These are small pieces of code that deliver a graphic image on a web page or in an email for the purpose of transferring data back to us. The information collected via this process will include information such as IP Address, as well as information about how you respond to an email campaign (e.g. at what time the email was opened, which links you click on in the email, etc.).
We may use web beacons on our websites or include them in e-mails that we send to you. We use this information for a variety of purposes, including but not limited to, site traffic reporting, unique visitor counts, advertising, email auditing and reporting, and personalisation.
In some cases we allow our partners to include web beacons in emails served by us on their behalf. In these instances they are only able to collect anonymous data and have no access to personal information.
4.9. Social Media
When you engage with TGO Activate over social media, it will usually be as a registered user of that social media platform. The use of personal data on social media is governed by your agreement with that platform’s own privacy policy or terms and conditions. TGO Activate official social media pages are administered by The Great Outdoor Gym Company Ltd as a data controller of these pages. These social media platforms may process user personal data to deliver anonymised user statistics to the local administrator of that page or event. We do not use the personal data you have made available on social media outside of that platform, unless you have given us your consent to do so.
4.10. Event Photography and Filming
Photography or filming is likely to take place at our events, is common practice, and helps us to inspire other people to engage in physical activity and to redefine what it means to be active. It also provides a means for historical recording of our events over time. Furthermore, our use of images helps to demonstrate diverse groups of people engaging in and enjoying physical activity both during TGO Activate events but also as part of the wider community.
We ensure compliance with safeguarding laws and are supported both in-house through our Safeguarding Lead and externally with the support of other experts in the field of safeguarding. All photographers at TGO Activate events are registered with TGO Activate and required to wear a TGO high-vis vest, further details of our Photography Policy are published Enter Link
In line with the lawful basis of Legitimate Interest individuals have the right to object to this method of data processing by contacting the event team directly, or TGO Activate head office, and requesting deletion of relevant imagery. At event-level we will also seek, where the event is informed in on the day, not to photograph those individuals who have previously objected.
4.11 Anonymity
In exceptional circumstances, such as for our participants within the custodial system, we allow/require participants to register under a pseudonym. If you have any questions on this process please e-mail [email protected]
5. What Data We Share
5.1 Third-Party Connections
Across the TGO Activate sites we offer a number of opportunities for our members to connect their TGO Activate accounts with other accounts in their name. This could be for the purposes of linking to activity tracking platforms, or sending activity data to wellness programs. This can only happen at the request of the user, the specific data shared is clearly defined, and the integration can be stopped at any time by the user simply opting out.
5.4. Personal Contact Details
Sent to our database on behalf of our partners are sent directly by us and only where you have consented for us to do so.
6. How We Contact You
The large majority of our outgoing communication, to the TGO Activate community, is via email. Sending an email to you is a form of data processing, and as such may only be carried out under a specific lawful basis.
6.1. Under the Lawful Basis of Fulfilling a Contract
In order to fulfil our obligation to you as a member of TGO activate, to ensure our events are delivered in a safe and appropriate manner, and to ensure the TGO organisation is managed appropriately, there are some communications we send to everyone. The following communications fall into this category:
- Confirmation you have registered with us.
- Updates to key documents, such as this privacy policy.
- Confirmation that your participation has been recorded by the local event team.
- Participation in surveys to improve the events we deliver.
6.2. Under the Lawful Basis of Legitimate Interest
There are some occasions where we may contact you as part of our mission to make the world healthier and happier. For example, where we write to people who’ve registered but not participated, with the aim of understanding why and then being able to create a more supportive environment. The following types of communications fall into this category:
- Questionnaires aimed at developing our understanding of who is participating.
- Emails sign-posting participants to peer-support groups we feel may be suitable based on information you have provided.
- Questionnaires for research aimed at understanding the effect of TGO Activate on global health and wellbeing.
- Local event teams directly contacting specific TGO Activate Member using e-mail
You have a right to object to receiving these emails, to do that please e-mail [email protected]
6.3. Under the Lawful Basis of Consent
Not only is our mission statement focused on improving the fitness and wellbeing of our communities, but we have also made a commitment that participation in our BCW (Big community workouts) will be free, forever, for everyone. There are ways in which we rely on TGO Activate members to achieve both of those ambitions, some of which require us to be able to send certain communications. We therefore offer all TGO Activate members the chance to opt-in (at registration or via their profile) to receive regular updates from us and our partners.
Consent can be withdrawn at any time but does not apply to processing that happened before the consent was withdrawn.
7. How We Protect Your Information
We work extremely hard to apply appropriate security measures in order to protect your data from being accessed or disclosed without your permission, or lost. We have a relatively small staff team, who are regularly updated on good practice in data handling, all personal data is password protected and only available to those with a specific need for access.
In the event of a data breach we will notify you and any applicable regulator, where legally required to do so.
The only personal information event teams hold on their participants is a list of participants name and their age to allow the right level of workout to be delivered.
Some event teams also use Facebook to communicate with participants, in these cases we retain admin control centrally and are able to control/remove access when required.
8. Retention Periods
In order to present our data retention periods as simply as possible we have chosen to do so
using our definitions of categories of data defined in section 3 above.
8.1. Profile & Identity Data – In perpetuity
This is in order to create our results tables, maintain historic records of participation, and to allow anyone who is registered with us to participate at any future TGO Activate events without the requirement to re-register.
8.2. Contact Data – Ten years from most recent participation instance
It is common for people to leave significant time periods between our events. It is also common for people to enjoy receiving our communications without participating at our events themselves.
8.3. Technical Data – Three years from point of data collection
In order to provide the best possible service to our users, to support the administration of our systems and processes, and to comply with legal obligations.
8.4. Incident Data – In perpetuity
We retain this data in order to keep a historical record of our incident profile, from which we are able to continually review our operating policies in order to enable the safe and appropriate delivery of our events.
8.5. Survey Data – In perpetuity
This data is used for the purposes of understanding our community in greater detail. Changes over time are of particular interest where comparison of current versus historical data allows us to assess the impact of our events and associated interventions.
8.6. Event Imagery – In perpetuity
Event imagery is predominantly processed under the lawful basis of Legitimate Interest, and may be stored securely by event teams in perpetuity as it represents a historical record of that event. Although extremely rare, there can be occasions where we are required to process information conveyed in photographs under another of the lawful bases, such as Legal Obligation, Vital Interest, Public Task.
9. Automated Decision Making and Profiling
In some situations we make automated decisions based on various types of data that we hold, this is also known as profiling. Examples of where we use this might be to send research surveys to people who have only ever participated once or to market products to specific demographics of people, such as advertising a local TGO Activate event to members in that area.
Whilst our automated decision making processes do not have a legal or similarly significant effect on the individuals concerned, you do have the right to object to us applying these processes to your data.
To understand more about automated decision making and profiling please see this section of the ICO website.
10. Your Rights
You have the right to:
10.1. Be informed if your personal data is being used
Where appropriate we endeavor to inform you of this at the point where your data is being collected, however for circumstances where that is not practical or possible please refer to this Privacy Policy.
10.2. Get copies of your data
You are also free, at any time, to request a downloadable copy of all the data we hold on you. This would include details of all your attendances at TGO Activate events and as such is something we particularly recommend prior to any request for us to delete your data. To do this please
10.3. Have your data corrected
If at any time you feel the data we hold on you is incorrect, and you are unable to change it via your profile, please e-mail Enquiries@tgo-activate.com
10.4. Have your data deleted
Should you wish, at any time, for us to delete your data then please contact us via support and we can enable this process. Please note that this is not something that can be undone and as such we would recommend downloading your historical results (see next section) before doing so.
Although we approach every request for deletion on a case-by-case basis, we do not as a rule remove TGO Activate member data simply on request. This is in order support potential future challenges, enquiries, or investigations where this information may be critical.
10.5. Limit how we use your data
If you are concerned about the accuracy of the data or how it is being used please e-mail [email protected] where you have previously provided us with consent to use your personal data in a specific way, you can remove your consent at any time (or opt-out) via your parkrun profile page.
10.6. Data portability
Following from point 10.2 (above) we will provide copies of your data in standard machine-readable formats. In such cases, please e-mail [email protected]
10.7. Object to the use of your data
Where we are processing your data under the lawful basis of Legitimate Interest you have the right to raise an objection to that processing. This is not an absolute right to object and we will carry out a balancing test where we assess the reasons for your objection in the context of our legitimate interests.
10.8. Raise a concern
If, at any time, you have a concern as to how we are handling your information then please e-mail [email protected]. If you feel that we have not addressed your concerns appropriately you have the right to raise them directly with the ICO (read more).