Sport and Physical Activity Privacy Notice
Last updated: 29 July 2026
See our Social Sport Privacy Notice.
See our Gryphons Go Privacy Notice.
This privacy notice explains how we will collect and use your personal data.
If you have any questions or if anything is unclear you can contact us at [email protected]
Our data protection officer can be contacted at [email protected].
The university’s data controller registration number provided by the Information Commissioner’s Office is: Z553814X
Throughout this Notice, “University”, “we”, “our” and “us” refers to the University of Leeds. “You” and “your” refers to those data subjects using the University’s Sport and Physical Activities facilities (SPA).
1.0 How we collect your information
1.1. From you
You will be asked to provide personal data when you register as a user. You may also be invited to subscribe to newsletters or other activities throughout the duration of your membership. When you are required to provide personal data the uses of this data will be explained at the point of collection.
1.2. From the University’s SAP(staff) and BANNER (student) CRM systems
Your name, address, date of birth, gender, department, phone number, student status, completion date and year of study are regularly updated from the University’s CRM systems. This allows us to correctly identify you and supports your use of SPA facilities and services throughout your time with us.
1.3. From external sources
Our marketing team will have access to your UCAS form to provide you with information about sports or physical activities which you have expressed an interest in. If you are a member of a Leeds University Union club they will share details of your membership, year and semester of study and your university email address with us so that we can provide you with relevant information about access to training facilities and to allow access to your training sessions by adding a Gryphons Pass to your XN profile.
1.4. Cookies
Our website uses first-party cookies; which are small text files placed on your device by the websites that you visit.
Find out more about the cookies we use and why in our cookie policy.
2.0. The purposes for which we process your personal data and the lawful basis for that processing
The processing of your personal data is necessary for the performance of the contract that you have entered into with the University to access the Sports and Physical Activity provisions.
From time-to-time, we may need to contact you to let you know about facility or service closures within Sports & Physical Activity. We will only contact you via the preferred method which you expressed at the time of registration.
If you do not want your personal data to be used in the manner described, then you will need to terminate your contract with SPA.
Where there is a legitimate interest to do so, the University will collect data about you from third parties to tailor the service that SPA provides.
By engaging with Sport & Physical Activity you will be added to our mailing list under the basis of legitimate interests for the duration of your membership. You have the option to opt out of such communications at any time.
3.0. How do we keep this information secure?
The information we hold about you will be stored on University of Leeds secure systems and accessible to university staff administering the Sport & Physical Activity offering including GOGA, The Edge and those managing University Sport through the Leeds Gryphons Partnership.
This data will be stored within our CRM systems (see 4.1), our email marketing system (see 4.2) or in secured protected drives.
The marketing team will store email addresses, names and joining dates on an email marketing system (see 4.2). Only the marketing team will have access to this information for the purposes of sending email communications.
Your data will not be transferred outside the EEA.
4.0. Who has access to data about you?
The information you provide to the University will be stored securely and access will be restricted to staff who need it. We may disclose personal data to trusted third-party suppliers where this is necessary for them to provide services on behalf of the University. These arrangements are managed through appropriate contractual and data protection obligations.
We use trusted third-party suppliers to help deliver some of our services on behalf of the University. Personal information may be disclosed to these suppliers where necessary to administer memberships, bookings, events, communications, facilities and services. These suppliers process personal data on behalf of the University under appropriate contractual and data protection arrangements.
| Supplier | Function carried out on behalf of Sport & Physical Activity |
| XN Leisure | Membership application and customer management support. |
| Campaign Monitor | Email and SMS communications with customers. |
| GymSales Ltd | Customer enquiry management and communications by email, SMS or phone. |
| Technogym / Mywellness | Fitness equipment, app functionality and membership verification. |
| Calendly | Appointment scheduling for tours and enquiries. |
| TLF Research | Market research and focus group administration. |
| Microsoft Clarity | Website analytics to help improve website performance and user experience. |
| SpeedyBooker (Redburn Innovations Ltd) | Booking and administration of selected sport facilities and activities. |
| Ticket Tailor | Event registration and ticketing for selected Sport & Physical Activity events and activities. |
5.0 How long we keep this information
Sport & Physical Activity will keep your personal information only for as long as it is needed for the purpose it was collected, including membership administration, booking management, event administration, legal, financial, audit and reporting requirements. Where you are a member, we will keep your membership information for the duration of your membership and securely delete it after 4 years once you are no longer a member.
6.0. Your data protection rights
You have the right to:
- access your personal data;
- request the rectification or deletion of your personal data;
- request the restriction of the processing of your personal data;
- object to the processing of your personal data;
- receive your personal data in a structured, commonly used format and to;
- complain to the regulator (the Information Commissioner’s Office)
Please see the ICO website for further information on the above rights.
You may also contact the Sport & Physical Activity team at [email protected] for further information about how we treat your data.
You have a right to complain to the Information Commissioner’s Office about the way in which we process your personal data. Please see the ICO website
Information Commissioner’s Office
Wycliffe House
Water Ln
Wilmslow
SK9 5AF
Telephone: 0303 123 1113
See a full list of the cookies and help on managing cookies
Essential Cookies
These cookies are required for our website to function.
| Cookie | Information |
|---|---|
| NSC* | NetScaler Appliance session cookie Purpose Information |
| PHPSESSID | PHP Session Cookie Purpose This cookie stores a unique ID assigned by the web server. It is used to enable some site functionality to work properly. It is native to PHP and enables websites to store serialised state data. It is used to establish a user session and to pass state data via a temporary cookie, which is commonly referred to as a session cookie. Information Duration It is deleted when you close your browser. |
Analytics Cookies
These cookies are used to track website visitors and their user behaviour. This data is then used to improve how the website works which can result to more effective user experience.
| Cookie | Information |
|---|---|
| _ga _ga_{container_id} | Purpose These cookies are installed by Google Analytics. They are used to calculate visitor, session, campaign data and keep track of site usage for site’s analytics report. The cookie store information anonymously and assign a randomly generated number to identify unique visitors. More information Google privacy policy Duration 2 years |
| NID | Purpose Registers a unique ID that identifies a returning user’s device. The ID is used for targeted ads. |
| _gcl_au | Purpose This cookie is used by Google Analytics to understand user interaction with the website. It is used by Google Tag Manager to track and store conversions. Duration 3 months |
| _fbp | Purpose This cookie is set by Facebook to deliver advertisement when the are on Facebook or a digital platform powered by Facebook advertising after visiting the website. Duration 3 months |
| _hjSession_{site_id} _hjSessionUser_{site_id} | Purpose A cookie that holds the current session data. This cookie makes sure that subsequent requests within the session window will be attributed to the same Hotjar session. Duration 30 minutes |
First-party session cookie
These cookies are required for our website to function.
| Cookie | Information |
|---|---|
| the_edge_popup_cta_clicked | Purpose We use this cookie to manage the display of The Edge Membership promotional popup on our website. This cookie helps ensure that you do not repeatedly see the same popup after you have either interacted with it or closed it. Duration Personal Data |
Third party cookies and tracking
If you share content from our website through other websites, for example Facebook or Twitter, cookies or a form of tracking may be used by these services and you need to manage your privacy via your account (and not through our site).
| Cookie | Information |
|---|---|
| __cf_bm | Cloudflare Bot Management Type Analytical Cookie Purpose Cloudflare’s bot products identify and mitigate automated traffic to protect your site from bad bots. Cloudflare places this cookie on end-user devices that access customer sites protected by Bot Management or Bot Fight Mode. This cookie is necessary for these bot solutions to function properly. Information Duration 1 day |
Manage your cookies and privacy
You can also manage your privacy settings, including cookies, through your browser settings.
Further information about cookies can be found on the Information Commissioner’s Office website.
