This notice applies to individual persons who are external to Southbank Centre. This notice does not form part of any contract and may be updated at any time.
1. The purpose of processing your data
Southbank Centre processes Visitors’ personal data for the purposes of site security, health and safety and facilitating visitor meetings. We require Visitors to our offices to sign in at reception using an electronic log in system.
We will also take a photograph of Visitors when they register. This is also for the purposes of site security, safety and facilitating visitor meetings. These photographs will be shared with the site contact to notify them of the Visitor’s arrival.
We have engaged a third party processor, InVentry, who provide the system software and hosting infrastructure for the registration system. This third party processor may process Visitors data for the purposes of providing those services.
2. Types of Data Processed
Adults: Names and photographs for sign-in purposes, signing in times, company or organisation name and vehicle registration details (if applicable).
Children: Names, in hardcopy, in certain circumstances. Please see section 7 for more details.
3. The lawful basis for processing your data
Southbank Centre processes Visitors’ personal data for the purposes of the legitimate interests pursued by the controller as detailed above.
4. Your rights
Visitors have the following rights regarding their personal data:
- you have the right to request access to your data
- you have the right to correct your data if it is incorrect
- you have the right to obtain from the controller the erasure of your data
- you have the right to object to your data being processed
5. If you do not provide your personal data
If a Visitor does not provide all of the requested personal data then Southbank Centre may be unable to permit them access to all or part of our buildings.
6. Data Storage and Transfers
Visitors’ personal data will be held and stored locally on the InVentry unit within an AES 256 encrypted SQL database.
In the event of an evacuation visitor information is transferred via a secure HTTPS connection to a UK based cloud database service.
7. How long we keep your personal data
Adult Visitors’ personal data will be retained for one month after each visit at which point it will be automatically purged from the local SQL database and the cloud database hosting service.
Any data transferred to the cloud database service as part of an evacuation is deleted at 23:59:59 on the day of entry.
Data relating to children is only obtained in hardcopy and is destroyed within 24 hours. Data collected relating to children is for security purposes only and not for the purposes of marketing or creating personality or user profiles. Data pertaining to children will only be collected it has been explained to their parent or Guardian how their child’s personal data will be collected and used.
8. Change of purpose
We will only process Visitors’ personal data for the purpose for which we collected it.
9. How to lodge a complaint or exercise your rights in respect of section 4
If you have a complaint regarding the processing of your personal data or wish to exercise any of your rights as a data subject as outlined in section 4 of this privacy notice then please contact us:
London SE1 8XX
You also have a right to lodge a complaint with the Information Commissioner’s Office.