The privacy and security of your personal data is of the utmost importance to Castle Leisure and we invest heavily into measures that help protect your data protection rights.

This policy describes how and why we collect, store, process and manage the personal data we hold from our members. The term ‘Personal Data’ refers to any information relating to an identifiable individual or his or her personal identity.

This policy outlines how your data will be processed lawfully, fairly and in a transparent manner.

Castle Leisure does not sell or rent your personal data to third parties for marketing purposes whatsoever.

We will ensure that the personal data we process is accurate, adequate, relevant and not excessive, given the purpose for which it was obtained. We will not process personal data obtained for one purpose for any unconnected purpose unless the person has agreed to this or would otherwise reasonably expect this.

As your employer Castle Leisure needs to process your personal data during your recruitment, during your employment with us and following the termination of your employment.

Castle Leisure has appointed a Data Protection Officer (DPO) who is responsible for ensuring that personal data is managed responsibly throughout the company. You can contact the DPO using the details listed at the end of this document.

You have the right to see the data we hold on you, rectify that data and also for requesting us to delete that data at any time.

This policy is not contractual and may be amended at the Company’s absolute discretion.

  1. Introduction

1.1           Castle Leisure is defined as the data controller with regard to all of the information contained within this document.

1.2           This Privacy Policy sets out the way in which Castle Leisure Limited (“we”, “us” or “Castle Bingo”), collects and processes Personal Information of our club members. Castle Leisure is registered for the purposes of data protection with the Information Commissioner’s Office in the UK (Registration Reference Z879812X).

1.3           By applying for a position with the Company, you acknowledge that you have read, and understand the terms of this Privacy Policy in relation to our lawful basis of processing.


  1. The information we collect

2.1           As part of maintaining your employment we collect your Personal Information. “Personal Information” means any information from which you, as a ‘data subject’, can be personally identified, including (for example) your name, email address, home address, telephone number, or date of birth. It does not include data that has been anonymised. The Company may hold personal data about you on email systems, electronic and paper HR files.


2.2           We collect your Personal Information when you apply for vacancies

  1. Your rights as a ‘data subject’

3.1           Under data protection law you retain the following rights over your personal data outlined in paragraph 3.2

3.2           The right to access the data we hold about you

The right to rectification of any data that is inaccurate or incomplete.

The right to erasure of your data (also known as ‘the right to be forgotten’)

The right to restrict processing of your data

The right to data portability

The right to object to the processing of your data

Rights in relation to automated decision making and profiling.

  1. Our basis for processing personal data

4.1           The Company processes personal data where necessary to manage the employment relationship and the main lawful basis for processing your data are:

  • To comply with our legal obligations
  • To perform your contract with us
  • Because it is necessary for our legitimate interests

Where we process special category data we will only do so where one of the lawful reasons set out above applies and where either, you have given explicit consent:; processing is necessary under employment law: processing is necessary to protect you or another person’s vital interests and you are capable of giving consent: you have made the data public; processing is necessary for a legal claim; it is necessary for occupational medical reasons, or for the assessment of medical capacity. Where we plan to process special category data relating to you we will explain this and set out the reasons, at the time.

Special category data is information such as racial or ethnic origin, politics, religion, trade union membership, genetics, biometrics, health, sex life or sexual orientation.

We may collect information from you relating to some of these matters but will usually do so in an anonymised way, so as to monitor the effectiveness of our equal opportunities policies. Where this is the case it will not be considered to be personal data. However where the data has not been anonymised, this will clearly be special category data and be treated as such.

The Company processes personal data relating to criminal convictions to meet our regulatory requirements.

  1. How we use your Personal Information

5.1 Your Personal Information is processed by us, as your employer during your recruitment. We will use this data to decide whether to employ you, check you have the right to work in the UK, decide what salary and other terms to offer you and then administer the ongoing contract between us including for example managing your performance and conduct, making reasonable adjustments if you have a disability, paying you and deducting tax and national insurance.   Personal data may be provided to us by you, but may also be provided to us by third parties such as former employers or may be created during the employment relationship such as appraisal records or on its termination such as references provided to prospective employers.

The following are examples of the personal information we may process and retain:

  • Your name and date of birth
  • Your address, telephone number and personal email address
  • Your identification documents and information about your immigration status
  • Your national insurance number and details of your tax status
  • Information about your previous employment history
  • Your qualifications and professional memberships
  • Your gender, marital status and details of any dependants


This information will be retained by the Company in line with our Data Retention Policy.


  1. Disclosure of your Personal Information

6.1           We may disclose your Personal Information to any of the following recipients:

  • Payroll or HR system providers
  • Any law enforcement or regulatory body which may have any reasonable requirement to access your Personal Information.
  1. Accessing and Updating your Personal Information

8.1           You may update your Personal Information at any time by contacting the company data protection officer using the details below.

8.2           You may obtain a copy of your Personal Information held by from The Data Protection Officer, Castle Leisure, 1 City Road, Cardiff, CF24 3TQ, or online via email at Requests for access to your personal data are free of charge, and we require one calendar month in order to respond to such requests.

  1. How long do we keep your data for?

9.1           We retain your data for no longer than is necessary for compliance with a legal obligation as defined in 4.1. This length of time is different for each type of personal data that we hold dependant on company and legislative requirements. These retention periods are subject to change only where deemed necessary by the Data Protection Officer

  1. Security

10.1         We use a number of methods to ensure that all employee information remains confidential. We have developed a comprehensive policy for data protection management which is reviewed and updated as necessary.

  1. Complaints

Castle Leisure takes the personal data we hold very seriously and is happy to receive any queries or concerns you may have. If you believe that we have not adhered to this policy or that your data has been handled in a way which you feel is not in accordance with your wishes then you may complain to the Data Protection Officer using the contact details below.

The Data Protection Officer, Castle Leisure, 1 City Road, Cardiff, CF24 3TQ

02920 48 44 22

Alternatively you may contact the Information Commissioners Officer (ICO) directly who are the body responsible for managing data protection compliance in the UK.

You can contact the ICO at the following address: Information Commissioner’s Office

Wycliffe House

Water Lane




0303 123 1113

  1. Contact information

Please contact us via the contact form on our website or in writing at;

The Data Protection Officer, Castle Leisure, 1 City Road, Cardiff, CF24 3TQ

02920 48 44 22