You must collect customers details

If you offer an on-site service to customers, you must collect contact details for all customers, store this information for 21 days, and share it with NHS Test and Trace or local public health officials, if requested. This applies to hospitality, leisure and close contact services. Click here to read the full list of applicable businesses.

Hospitality venues must refuse entry to a customer or visitor who refuses to use the app or leave details. The only exceptions are those under 16 years old or those who are unable to provide their contact details because of a disability or health reason.

Other venues do not need to refuse entry but, if they are required by law to display the poster, they must ask customers and visitors to scan the poster or otherwise share their details. This is vital to support NHS Test and Trace.

You Must Download and Display an NHS QR Code Poster

From Thursday 24 September, applicable businesses are required by law to display an NHS QR code poster. Visit www.gov.uk/create-coronavirus-qr-poster to generate and download your unique official NHS QR poster. Posters must be displayed at all entry points to the venue. Customers should be encouraged to scan the QR code on their smartphone using the new NHS COVID-19 app, click here to download the app.

The time and date of the customers check-in, along with a venue identifier is stored securely on the user’s smartphone for 21 days. If it is later found that the user has been in the same venue at the same time as someone who tests positive for coronavirus, the Health Protection Teams in England and Wales will anonymously alert users who may have come into contact with COVID-19, via the app.

The use of NHS QR code poster at these specified businesses is mandatory and enforceable by law. Failure to display the NHS QR code poster will result in a fixed penalty notice.

If businesses are already using their own QR code systems, they are required to move to the NHS COVID-19 app QR code system.

The business is also required to maintain an alternative check-in method for visitors who do not have a smartphone or have not downloaded the app. Data should be recorded electronically if possible, for example through an online booking system, but a paper record is acceptable. You must record the customer’s name; contact number (if not applicable then email address, or lastly home address); date and time of visit including, where possible, departure time; and if they will interact with only one member of staff – the name of the assigned staff member.

Enforcement

We will be visiting businesses in Fylde to check that the NHS COVID-19 QR poster is displayed and the system is being used. We will be encouraging the public to report any breach of COVID regulations related to a business at this link. Where guidelines are not followed enforcement action will be taken. Find out more about how to make your business COVID-secure.

Fixed Penalty Notices will be issued against businesses who are non-compliant.

Additional Support

Click here to read the official guidance on GOV.uk

Thank you for your co-operation and support.

Collection of contact details: Business FAQs

Any venue that offers an on-site service, including hospitality, the tourism and leisure industry, and close contact services. A full list of settings can be found at this link. 

If you have a venue outside of these categories that is visited by members of the public and has a space where people congregate, then we also encourage you to create a QR code poster for the entrance to that venue. 

Supermarkets and other shops don’t have to display the poster, except in cafés or other similar facilities. This is because customers generally move around a supermarket or shop rather than congregate, and are expected, by law, to wear face coverings. But we encourage any business to consider displaying the poster to help with efforts to fight the virus. 

The requirements to take details and refuse entry only apply to venues that are required to display the poster, not to those that are not required to display it but choose voluntarily to do so. 

No, you must generate your own unique poster for an individual venue by visiting www.gov.uk/create-coronavirus-qr-poster 

If your business, organisation or event operates across multiple venues, you will need to create at least one poster for each unique location. 

You can display your QR code poster at your venue using digital signage, for example, a TV screen or iPad. 

You should ask to check each customer’s phone screen to ensure they have successfully checked in. 

No, you do not have to request details from people who check in with the official NHS QR poster, and venues should not ask people to do both. 

You must provide an alternative option for contact details to be left by anyone who is unable to use the QR code system. You need to record the customer’s name, contact number (if not applicable then email address, or lastly home address), date and time of visit including – where possible – departure time, and if they will interact with only one member of staff – the name of the assigned staff member. 

Data should be recorded electronically if possible, for example through an online booking system, but a paper record is acceptable. If you are keeping a paper record, this should be out of public sight and stored securely. 

In hospitality venues the contact details of everyone in attendance must be provided as part of the mandatory requirement. If not using the NHS COVID-19 app, details of all parties can be provided by one lead member of the group or be given individually.  

Hospitality venues must refuse entry to a customer or visitor who refuses to use the app or leave details. The only exceptions are those under 16 years old or  those who are unable to provide their contact details because of a disability or health reason. 

Other venues  do not need to refuse entry but, if they are required by law to display the poster, they must ask customers and visitors to scan the poster or otherwise share their details. This is vital to support NHS Test and Trace.

If in the rare case that a customer or visitor becomes unruly, you should follow your own security procedures. This may include calling the police if you feel the individual poses a risk to yourself or others. 

Yes, you must keep a record of staff, customers and visitors for 21 days. Keep a record of all staff working on your premises and shift times on a given day, along with their contact detailsThis covers anyone providing a service or activity including volunteers. 

No, you do not need to collect contact information where services are taken off site immediately, for example, a food or drink outlet which only provides takeaways. If a business offers a mixture of a sit-in and takeaway service, contact information only needs to be collected for customers who are dining in. 

No, you do not need to ask for contact details for people whose visit is for the sole purpose of making a delivery or collection by supplies or contractors, including food or physical goods. 

You must now use the official NHS QR code system.  

If you use any other QR code system at your venue, you must ensure that it does not show any NHS or NHS Test and Trace logos. You should also explain to your customers and visitors that you are using more than one QR code system in your venue. Unofficial QR codes will not work with the NHS COVID-19 app, can cause confusion for visitors, and could result in them missing important public health advice. 

If a customer at a hospitality venue gives a name or contact information which you have reason to believe is inaccurate, you must refuse them entry. This applies, for example, to obviously false names or addresses. Otherwise, the accuracy of the information provided will be the responsibility of the individual who provides it. You do not have to verify an individual’s identity. 

You do not need to ask for contact details for those under the age of 16. If an individual says they are under the age of 16, you should not ask for identification unless you judge this to be false. 

For the first offence, the fixed penalty is £500, if paid before the end of the period of 14 days following the date of the notice. If it not paid within this time period if will be £1000. 

For a person’s second offence, the fixed penalty notice is £2000, for the third £3000 and for the fourth £4000. Any subsequent fixed penalty notices will be £4000. 

The person responsible for the organisation is liable. This could be the owner, proprietor or manager with overall responsibility of the organisation, business or service. 

For the first offence, the fixed penalty is £500, if paid before the end of the period of 14 days following the date of the notice. If it not paid within this time period if will be £1000. 

For a person’s second offence, the fixed penalty notice is £2000, for the third £3000 and for the fourth £4000. Any subsequent fixed penalty notices will be £4000. 

The person responsible for the organisation is liable. This could be the owner, proprietor or manager with overall responsibility of the organisation, business or service. 

We are strongly encouraging places of worship to maintain staff, customer and visitor logs and to display an official NHS QR code poster. However, places of worship, including when the venue is used for events and other community activities, are not included in these regulations.  

No, this requirement does not apply to services that are designed to feed homeless people. 

NHS Test and Trace will, if necessary, undertake an assessment and work with you to understand what actions need to be taken. 

NHS Test and Trace will give you the necessary public health support and guidance. 

If a staff member, customer or visitor tells you they have tested positive for COVID-19, you should tell them to stay at home and self-isolate as soon as possible (along with the rest of their household) and encourage the individual to inform NHS Test and Trace of their recent contacts. You must not use the information you have collected to contact people. 

NHS Test and Trace will provide the necessary public health advice and support if they assess an individual was on your premises while potentially infectious. If NHS Test and Trace identifies more than one case of COVID-19, or any other specific risk circumstances, at your venue you will be contacted to receive support and to share the contact details you have collected so that they can contact anyone who may have been exposed to the virus. 

If you identify that there is more than one case of COVID-19 on your premises, you should contact PHE Cumbria and Lancashire Health Protection Team at Lancashire County Council to report the suspected outbreak. Email cl.hpt@phe.gov.uk and PHE.clhpt@nhs.net Phone: 0344 225 0562 option 2  Out of office: 0151 434 4819 

Most businesses will already  pay a data protection fee to the Information Commissioner’s Office.  The only circumstances where you will need to pay a data protection fee just because of Track and Trace is if your business does not process personal data at all except for Track and Trace. The ICO has published its own detailed guidance on collecting customer and visitor details for contact tracing. 

Yes, venues introducing new systems to manage contact details must conduct a data protection impact assessment under the General Data Protection Regulations. The Information Commissioner’s Office (ICO) has guidance to help you minimise data protection risks. You must not use this data for any other purposes other than for NHS Test and Trace, unless you would already collect it for another business purpose. 

You need to explain to people why you are collecting this data but this does not mean that you have to inform every customer individually. You might, for example, display a notice at your premises or on your website setting out what the data will be used for and the circumstances in which it might be accessed by NHS Test and Trace. A template privacy notice can be found at this link. 

Visit www.ico.org.uk/for-organisations to find out more about appropriate technical and security measures that must be in place to protect customer contact information.