Third Space Employee Privacy Notice

This privacy notice explains how and why Third Space and its subsidiaries collects, uses, stores and shares personal data about you in connection with your work for us. In this notice, “you” and “your” mean our job applicants, all team members (including employees and contractors) and former team members. Third Space Holdings Limited is the controller for this personal data.

Personal data means any information relating to an identified or identifiable individual. This notice sits alongside your contract of employment or service agreement, our other policies applicable to team members and our Member Privacy Notice which can be found here Privacy – Third Space. It does not form part of your contract of employment or service agreement, and we may update it from time to time.

This notice applies to the personal data we hold about you when you apply to work for us, while you are employed or engaged by us as a team member, and after your employment or engagement with us ends.

Your Personal Data

The personal data we collect and use about you depends on your role and our relationship with you. Under UK Data Protection Law, we can only use your personal data where we have a proper reason to do so, for example:

to perform our contract with you or take steps before entering into it;
to comply with our legal and regulatory obligations; for our legitimate interests (or those of a third party) provided your rights and interests do not override these; or
in limited cases, where you have given consent.

Where we rely on legitimate interests for collecting and processing your personal data, we carry out an assessment to balance our interests against yours.

The table below explains what we use your personal data for, what persona; data involved and our lawful reason for using it. Not all of the below will apply to every team member.

Purpose	Further details of why we use your Personal Data	What Personal Data used	Lawful reason
Recruitment and onboarding	When you apply for a role and during onboarding, to assess your suitability, verify your identity and check your eligibility to work in the UK, and set you up as a team member. If your application is unsuccessful, we will retain your personal data for a period of three years and may contact you about future opportunities from time to time. You can opt out at any time via Eploy.	Your name, contact details, address, date of birth, CV and application, employment history, qualifications, references, right-to-work documents (such as a passport or visa) and interview notes. For specific roles, we also hold psychometric data, DBS Checks, Credit Checks and Address History checks.	Contractual necessity and legal and regulatory obligation: to take steps before entering your contract and to check your right to work in the UK.
Your employment or service contract and records	To enter into and manage your contract of employment or service agreement, including your role, working hours, location and terms.	Your name, home address, contact details, date of birth, National Insurance number, job title, start date, working pattern and contractual terms	Contractual necessity: to enter into and perform your employment contract.
Emergency contacts	To contact someone on your behalf in an emergency	The name and contact details of your next of kin or emergency contact	Legitimate interests: to protect your safety and that of others at work (and vital interests in a genuine emergency)
Pay, tax and pensions	To pay you, administer income tax and National Insurance, and enrolling and manage your pension	Your bank details, salary, National Insurance number, tax code, pension contributions and payroll records	Contractual necessity and legal and regulatory obligation: to pay you and meet our tax, National Insurance and pension duties
Benefits	To provide and administer any benefits you are entitled to or choose to take up, such as staff membership or healthcare benefits	Your name and details relevant to the benefit	Contractual necessity or consent where a benefit is optional: to deliver those benefit to you
Managing your employment or provision of services	To manage your day-to-day employment/provision of services, including rotas, hours of work, attendance, performance, appraisals, training and development	Your name, working hours, attendance records, performance and appraisal records and training records	Contractual necessity and legitimate interests: to run our business and manage our workforce effectively
Absence and sickness	To manage sickness absence, pay statutory or contractual sick pay, and consider any adjustments you may need	Your name, absence records and information about your health including occupational health reports (see section 6 below)	Legal and regulatory obligation and contractual necessity: to meet our obligations and manage your employment
Conduct, disciplinary and grievance	To deal with conduct, disciplinary, capability and grievance matters, including any investigations	Your name, details of the matter, investigation records such as witness statements and other evidence, correspondence and, where relevant, CCTV footage (see below)	Legitimate interests and, where applicable, legal and regulatory obligation: to manage conduct and performance and protect our business, team members and club users
Health and safety	To meet our health and safety duties, including keeping accident and incident records	Your name and details of any accident, injury or incident at work	Legal and regulatory obligation: to comply with health and safety law
IT, systems and security	When you use our IT systems, email, applications and premises, including monitoring to keep our systems and information secure	Your name, log-in and usage records, and system and access logs	Legitimate interests: to keep our systems, information, people and premises secure
CCTV	Images of you captured on CCTV in our clubs and premises, used for safety, security and crime prevention and, where relevant, in conduct and disciplinary matters	Images of you recorded on CCTV	Legitimate interests: to keep our team members, club users, contractors, suppliers and premises safe and to investigate conduct where necessary (see below)
Photographs	For example for a staff record or internal communications	Your name and image	Legitimate interests or consent depending on how the image is used: to run our business securely, operate access controls and maintain team member records. Where an operational use is optional or goes beyond this, we rely on your consent
Marketing images	Where you agree, use of your image from Third Space marketing photoshoots in marketing materials including on our website, social media, advertising and in-club displays	Your image, including photographs and video	Consent: by your agreement to taking part in marketing photoshoots when offered, which you can withdraw at any time
Equal opportunities monitoring	To monitor equal opportunities and diversity, where you choose to provide this information, including during the application process.	Information such as your ethnicity, gender, disability, religion or similar, provided voluntarily (see below)	Legitimate interests and legal and regulatory obligation, and usually your explicit consent where provided voluntarily: to monitor and promote equal opportunities and diversity across our workforce. Where it is special category data (such as your racial or ethnic origin, religion or belief, disability or health, or sexual orientation), we also rely on your explicit consent, or on the “equality of opportunity or treatment” condition under the Data Protection Act 2018, which allows us to use this data to identify and review equality between different groups, subject to appropriate safeguards. You do not have to provide it, and you can ask us to stop using it at any time
When you leave and references	To administer your departure, provide references, and keep records we are required to keep	Your name, employment records and details relevant to a reference	Legitimate interests and legal and regulatory obligation: to administer your departure, to provide references at your or a third party’s request, and to keep appropriate records of your employment and where we are required by law to keep certain records after your employment ends, for example payroll, tax and other statutory records. We keep this data only for as long as necessary, in line with our retention policy
Legal claims	To establish, exercise or defend legal claims	Your name and any personal data relevant to the claim	Legitimate interests: to protect our business, interests and rights. Where the information involved is special category data (for example health information), we also rely on the condition in data protection law that permits processing necessary for the establishment, exercise or defence of legal claims.
Corporate transactions	To share your personal data (anonymised where possible) with any party that may take ownership of some or all of our business, and their advisers	Any personal data relevant to the transaction	Legitimate interests and/or legal and regulatory obligation: to protect, realise or grow the value of our business and assets. Where we are required to disclose personal data to comply with a legal or regulatory obligation in connection with such a transaction, we rely on that obligation. Any recipient is bound by confidentiality

We may also use and share aggregated data, for example anonymised workforce statistics. This is not personal data because it does not identify you, either directly or indirectly.

What happens if you do not provide personal data

Where we need to collect personal data by law, or under the terms of your contract, and you do not provide it when requested, we may be unable to enter into or perform your contract of employment – for example, to pay you or to meet our legal obligations.

How we collect your personal data
We collect personal data about you:

directly from you, for example in your application, onboarding forms and during the course of your work with Third Space;
that is generated during your employment, for example attendance and performance records, IT and system use, and CCTV; and
from third parties, such as recruitment agencies, referees and previous employers, right-to-work and background-check providers, occupational health providers, our pension and benefits providers, and HMRC.

Special category and criminal records data

Some of the personal data we hold about you is special category data, such as information about your health, including sickness absence and any workplace adjustments and, where you choose to provide it, information about your racial or ethnic origin, religion or beliefs, or trade union membership for equal opportunities monitoring. We only use special category data where the law allows, for example where it is necessary for employment purposes, for occupational health and to establish, exercise or defend legal claims, or with your explicit consent.
Where a role requires it, we may also process information about criminal convictions and offences (for example through a DBS check), where we are legally permitted to do so.

CCTV

For the safety and security of everyone who attends our clubs and premises, and for the prevention and detection of crime, we operate CCTV in public areas of all of our clubs. CCTV is not installed in any changing areas. We hold CCTV recordings on a secure server for approximately 14 days, after which they are automatically deleted, unless they are downloaded and held for longer for legal, regulatory or investigatory purposes.

CCTV footage may also be reviewed and used where an issue of team member conduct or performance arises. This includes using footage as part of an investigation and in any related disciplinary, capability or grievance proceedings involving employees. Where footage is needed for this purpose, it may be retained beyond the usual 14-day period for as long as is necessary to deal with the matter, including any appeal or related legal claim.

For the safety and security, and to protect the vital interests, of those who use our swimming pools and adjacent wet areas, we operate underwater imaging cameras in our swimming pools, which sound an alarm if a lack of movement is detected. We hold these images on a secure server for approximately 14 days, after which they are automatically deleted, unless they are downloaded and held for longer for legal or regulatory purposes.

Monitoring

We may monitor the use of our IT systems, email, applications and premises to keep our systems, information, team members and club users secure and to check compliance with our policies. Any monitoring is carried out proportionately and in line with the law, and we will tell you about any monitoring that materially affects you.

Sharing your personal data

We may share your personal data with:

other companies within the Third Space group;
HMRC and other tax, regulatory and government bodies;
our payroll provider, pension provider(s) and benefits and healthcare providers;
occupational health providers and, where relevant, right-to-work and background-check providers;
our IT, systems and HR software providers who help us run the business;
our external auditors and professional advisers (like lawyers), who are bound by confidentiality;
law enforcement agencies, courts, tribunals and regulators, where we are required to share data by law; and
any party that acquires, or may acquire, our business or assets (and their advisers) in connection with a corporate transaction or restructuring, on an anonymised basis where possible.

We only allow these organisations to handle your personal data where we are satisfied that they take appropriate measures to protect it, and we impose contractual obligations on them where appropriate.

Where your personal data is held and international transfer

Your personal data may be held at our offices and those of our group companies and service providers. Some of these may be based outside the UK and EEA. If we transfer your personal data outside the UK/EEA, we do so only where there is an adequacy regulation, appropriate safeguards (such as legally-approved standard data protection clauses), or another exception permitted under UK Data Protection law.

How long we keep your personal data

We will not keep your personal data for longer than we need it. We generally keep your employment records for the duration of your employment and for a period afterwards in line with our retention policy and our legal obligations for a period of six years after the end of you employment. Recruitment records for unsuccessful applicants are kept for a shorter period of 3 years and then securely deleted or anonymised.

Your rights

You have the following rights in relation to your personal data:

Access: to be provided with a copy of your personal data:
Rectification: to require us to correct any mistakes in your personal data;
Erasure: in certain situations, to require us to delete your personal data;
Restriction: in certain situations, to require us to restrict the processing of your personal data;
Portability: in certain situations, to receive your personal data in a structured, commonly used and machine-readable format;
To object: to object to processing based on our legitimate interests in certain situations;
Not to be subject to automated decision-making: not to be subject to a decision based solely on automated processing that significantly affects you; and
To withdraw consent: where we rely on your consent to withdraw it at any time (this does not affect the lawfulness of processing before withdrawal).

To exercise any of these rights, or if you have any questions, please contact data@thirdspace.london. You also have the right to complain to us, and to the UK Information Commissioner’s Office (ICO), if you believe we have not handled your personal data in line with the law.

Keeping your personal data secure

We have appropriate security measures in place to prevent personal data from being accidentally lost, or used or accessed unlawfully. We limit access to your personal data to those who have a genuine business need to see it, and those handling it are subject to a duty of confidentiality. We have procedures to deal with any suspected data security breach and will notify you and any applicable regulator where we are legally required to do so.

Changes to this notice and how to contact us

We may update this privacy notice from time to time. When we make changes, we will make the updated notice available to you. You can contact us, or our Data Protection Officer, at data@thirdspace.london if you have any questions about this notice or the personal data we hold about you, or to exercise any of your rights.

This notice was last updated on 4th September 2026.

Version 1.0