Data Privacy Policy

Download PDF of the Bowmen of Darenteford Data Privacy Policy

version 2

Version 2
Approved by committee 24 May 2018
Next review as needed

1. Introduction

The Bowmen of Darenteford Archery Club is a non-profit making Club run by and onbehalf of its Members in accordance with its Constitution. In order to provide membership services, the Club necessarily collects and holds personal information about its Members, and is committed to protecting and keeping such data private.

The data the Club holds about its Members, the way in which it is held, by whom andfor how long has been reviewed in order to comply with the General Data Protection Regulation (GDPR).

To comply with GDPR, the Club must hold and process your data using one or more of the 6 lawful bases as set down by GDPR law. Of these bases, Contract, Consent and Legitimate Interest apply to the Club's affairs, and are stated in the tables of processing activities set out in Section 2.

According to the GDPR definitions, the Bowmen of Darenteford is the Data Controllerand is responsible for your personal data. Since the Club is solely for recreational purposes, there is no requirement to be registered with the Information Commissioner's Office (ICO).

This document sets out the Club's Data Privacy Policy, and provides you with details of how we collect and process (use) your personal data. It also outlines where privacy options are available for you to opt-in or out of the Club using your personal data in a particular way. To that end, you will be required to complete a GDPR Consent Form specifying if you wish to opt-in or opt-out of the various options.

Sensitive Data

We may need to collect sensitive data about you in order to administer your membership correctly and deliver our services safely. This may include your disability status and any health issues which may affect your safety or safety of others. We require your explicit consent for processing such sensitive data and will request your signature for this consent.

It is very important that the information we hold about you is accurate and up todate. Please let us know if at any time your personal information changes by emailing us at [email protected].

2. How we gather and use your data

The Club gathers certain data about you which is collected in the following ways:

a. Data you give us

b. Data we generate by processing your shooting scores

c. Photographs

The following describes how we collect and why we process your data.

2a1. Application to become a Member of the Club

What lawful basis are you using to hold andprocess my data?
Contract & Legitimate interest
What data is collected about me?
Name, gender, postal address, email address, phone number, date of birth, any previous experience, any disability
How do you obtain my data?
Supplied by you on a signed Membership Application form.
Some data may be supplied by you initially via email or phone when making enquiries.
Why is my data needed?
To register you as a Club Member for administration and contacting you with relevant information about its activities.
Also used to assign the class of membership (full, associate, non-shooting, senior, junior).
How is my data used?
Some of your data will be used to place you in the right category when entering Club competitions.
Generally, only your name, gender and age group.
Who holds my data?
Membership Secretary collects and holds your data securely.
Data from your Application form is transferred to a spreadsheet.
Is my data shared within Club?
Yes, Membership Secretary creates and maintains spreadsheet of current Members which is given to selected Committee Members. Key users are Membership Secretary, Treasurer and Records Officer.
Limited information regarding applications from new and returning members is sent to all Committeefor vetting prior to acceptance.
Is my data shared outside Club?
Yes, certain data is sent to Archery GB (AGB), Southern Counties Archery Society (SCAS) and Kent Archery Association (KAA) to provide your membership services.
Each has its own Data Privacy Policy which you can inspect. AGB offers you the option to receive material by email and/or phone.
How long is my data held for?
Your original paper Application form held by the Membership Secretary for 2 years following membership expiry. Spreadsheets of current Members held by Committee members until the next update.
Held in case you later want to return.
Is there any financial data held about me?
Yes, payment of Club, AGB, SCAS & KAA membership fees are monitored by the Membership Secretary on spreadsheets and recorded by the Treasurer in the Club's account.
Records of payments received maintained by the Membership Secretary for the current year only, and by the Treasurer fora minimum of 7 years.

2a2. Application to undertake a Beginners course

What lawful basis are you using to hold and process my data?
Contract & Legitimate interest
What data is collected about me?
Name, gender, postal address, email address, phone number, age (if under 18), physical criteria, any previous experience, any disability
How do you obtain my data?
Supplied by you on a signed Course Application form.
Some data may be supplied by you initially via email or phone when making enquiries.
Why is my data needed?
To register you on the Course, thus ensuring you will be covered by AGB's insurance.
How is my data used?
To contact you and to ensure the Club has sufficient and suitable resources to provide yourtraining.
Who holds my data?
Training Officer collects and holds your data securely.
Attendance lists are created giving name, age category and physical criteria.
Is my data shared within Club?
Yes, Club Coaches are informed of your name, age (if under 18), physical criteria and anydisability.
Necessary to select suitable equipment and teaching methods.
Is my data shared outside Club?
No
How long is my data held for?
Original paper or electronic Application forms held by the Training Officer for up to 1 year after the course.
Held in case you later want to apply for membership.
Is there any financial data held about me?
Yes, Course fees are monitored by Training Officer and recorded by Treasurer in the Club'saccounts.
Records of payments received maintained by the Treasurer for a minimum of 7 years.

2a3. Application to undertake an organised Have-a-go session

What lawful basis are you using to hold and process my data?
Contract & Legitimate interest
What data is collected about me?
Name, email address, age if under 18, physical criteria, any disability.
Your phone number may also be volunteered.
How do you obtain my data?
Supplied by you by email or phone when making enquiry.
Some data may be supplied verbally by you at time of session.
Why is my data needed?
To register you for the session, thus ensuring you will be covered by AGB's insurance.
How is my data used?
To contact you and to ensure the Club has sufficient and suitable resources to provide your training.
Who holds my data?
Training Officer collects and holds your data securely.
Attendance lists are created giving name, age category and physical criteria.
Is my data shared within Club?
Yes, Club Instructors informed of your name, gender, age, physical criteria and any disability.
Necessary to select suitable equipment and teaching methods.
Is my data shared outside Club?
No
How long is my data held for?
(Privacy options apply)
If requested, paper or electronic records will be held by the Training Officer for up to 1 year after session, otherwise deleted.
Held in case you want to be notified of a follow-up Beginners Course.
Is there any financial data held about me?
Yes, Session fees are monitored by Training Officer and recorded by Treasurer in the Club's accounts.
Records of payments received maintained by the Treasurer for a minimum of 7 years.

The above applies to closed have-a-go sessions (usually of longer duration) for which attendance has been registered in advance. No personal data is collected from those attending 'walk-in' have-a-go's open to the public, e.g. when run at a fete. At such events, suitability to take part will be assessed at the time by the Club Instructor and noted mentally. If a person asks to be put on a mailing list for further training opportunities, then any personal data volunteered will be noted and held as prescribed for a closed have-a-go above.

2b. Shooting Records

What is the lawful basis are you using to hold and process my data?
Legitimate interest
What data is collected about me?
Name, gender, age if under 18, scores for rounds shot
How do you obtain my data?
Personal data supplied by the Membership Secretary. Shooting data supplied by you on signed scoresheets.
Scores may be obtained from other clubs if you attend competitions hosted by them.
Why is my data needed?
To calculate your archery handicap and classification.
Also to award you progress badges.
How is my data used?
Your scores are entered into a computer using Golden Records™ software.
Paper records or spreadsheets may also be used to calculate results of competitions.
Who holds my data?
Records Officer collects and holds your data.
Backups of Golden Records™ are kept in secure remote storage.
Is my data shared within Club?
Yes, notably with Tournament Officer to organise and administer Club competitions and league matches.
Typically your name, gender, age (if under 18), current handicap and classification in order to arrange field layout and determine competition results.
Is my data shared outside Club?
Yes, usually given to host Club Officer to organise and administer competitions and league matches.
See below Note 1, about data shared with host clubs
See below Note 2, about data shared with KAA
Typically your name, gender, age (if under 18),current handicap and classification in order to arrange field layout and determine competition results.
How long is my data held for?
(Privacy options apply)
If requested, your paper score sheets will be returned to you, otherwise destroyed. Your shooting scores and derived data held in Golden Records™ will be kept for 2 years following membership expiry (in case you return). Club records held by you and competition awards made to you will be maintained for posterity.
Club records are ongoing and maintained until broken. Past seasonal highest scores and results of competitions, league matches, etc are archived for posterity. Privacy options allow for your records to be anonymised.
Is there any financial data held about me?
No, any ad hoc payments you make for badges, etc, will be anonymised and recorded by the Treasurer in the Club's accounts.
Anonymised records of payments received are maintained by the Treasurer for a minimum of 7 years.
Are my shooting scores and achievements displayed?
(Privacy options apply)
Yes, unless you specifically opt-out. Any Club records you break, results of competitions and league shoots in which you take part, etc will be displayed on the Club's website (and certain information echoed on its facebook group). Your handicaps and classifications will not be so displayed.
The Club's GDPR Consent Form provides various options for you to decide whether or not you want your achievements be displayed (with or without being identified) on the Club's website and its facebook groups.

Note 1 - Data shared with Clubs hosting competitions.

If you take part in competitions or league matches hosted by other clubs or organisations, then they become the Data Controllers. Refer to their published Data Protection policy, procedures and privacy notices to assure your personal privacy preferences are satisfied.

Note 2 - Data shared with KAA (Kent Archery Association).

If you consistently achieve high scores (at least 3 times shooting 8 dozen arrow rounds in a summer season) you may be eligible to shoot for the county (Kent). You may send your qualifying scores to the KAA directly, or the Records Officer will do it on your behalf with your consent (verbal consent acceptable). If you are a junior (under 18), you will also need consent from your parent/guardian in writing or by email.

2c. Photographs

What lawful basis are you using to hold and process my data?
Consent
Are photographs of me displayed?
(Privacy options apply)
Yes, unless you specifically opt-out. Photographs in which you appear either as an individual or as part of a group will be displayed on the Club's website (and certain images echoed on its facebook group).
The Club's GDPR Consent Form provides various options for you to decide whether or not you want any photograph in which you appear to be displayed on the Club's website and/or facebook (see section 3 below).
How long are photographs of me displayed for?
(Privacy options apply)
Indefinitely, if you have consented to have photographs of you displayed on the Club's website.
The Club's Webmaster holds electronic copies of all images, and others taking them may also keep the originals.

3. Website and Facebook

The Club maintains a website open to the public for the benefit of its Members and to promote the Club's activities to a wider audience. It is hosted by a reputable company and does not incur advertising from them or third parties. The website address is www.darenteford.org.uk.

Records of Members' achievements at competitions, league shoots and other eventsare displayed on the website; such information being limited to (but not always including) Members' names, scores, placings and named photographs. No contact information relating to individual Members is included, though sometimes the email address of a contact is displayed, e.g. for signing up to a competition. Archives of competition and league results, Club records, Members' achievements, etc, are maintained on the website.

Names of all Committee Members and Club contacts are displayed on the website along with their email addresses. The email addresses are held in a format which precludes the use of data-mining or other forms of automated trawling. Cookies are not used on the website, and no record is made by the Club of website pages visited or Internet Protocol (IP) addresses from which they are accessed. Links to some associated archery websites are displayed on the website, and it is up to Members following these links to read the data protection privacy policies of those websites. This Data Privacy Policy only applies to the Darenteford website.

The Club also has two group accounts on facebook; a closed group essentially for Members and invited guests only and an open group accessible by the general public. The closed group is used to announce events and convey messages between members quickly, and is also used to display results of competitions, etc, with photographs much the same as on the Club's website. The open group is used to promote the Club to the general public, with a link to the Club's website, and displays occasional announcements and unnamed photographs of people and events.

The Club's GDPR Consent Form provides various options for you to decide whetheror not you want any photograph in which you appear to be displayed (with or without being identified) on the Club's website and facebook groups.

4. Marketing and disclosure of your personal data

With the exceptions listed below, the Club will not disclose your personal details to any third party or outside organisation (including archery shops) without your specific consent.

Exceptions

We require all third parties to whom we may disclose your data to respect the security of your personal data and to treat it in accordance with the law. We only allow such third parties to process your personal data for specified purposes and in accordance with our instructions.

We do not transfer your personal data outside the European Economic Area (EEA).

5. Data Security

The Club has in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered ordisclosed. In addition, access to your personal data is limited to those Committee Members and other third parties who have a need to know such data. They will only process your personal data on our instructions and they are subject to a duty ofconfidentiality.

We have put in place procedures to deal with any suspected personal data breach andwill notify you and any applicable regulator of a breach where we are lawfully required to do so.

6. Data Retention

The Club will only retain your personal data for as long as necessary to fulfil thepurposes it was collected for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we have consideredthe amount, nature, and sensitivity of the personal data, the potential risk of harmfrom unauthorised use or disclosure of your personal data, the purposes for which weprocess your personal data and whether we can achieve those purposes through othermeans, and the applicable lawful requirements.

By law the Club has to keep basic information about you (including name, contact details, financial and transaction data) for six years after you cease being a Memberfor tax purposes.

In some circumstances your personal data may be anonymised (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

7. Your Legal Rights

Under certain circumstances, you have rights under data protection laws in relationto your personal data. These include the right to:

You can see more about these rights at ico.org.uk- Guide to the GDPR individual rights.

If you wish to exercise any of your rights set out above, please contact the Club's Membership Secretary.

The Club Secretary may request specific information from you to help confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. The Club may also ask you for further information in relation to your request to speed up its response.

8. Enquiries and Complaints

The Club's Membership Secretary is the first point of contact regarding any enquiries arising from this policy and procedures. Where possible, please raise all enquiries in writing/email.

If you are not happy with any aspect of how the Club collects and uses your data, or something that it has done or failed to do, please inform the Club Secretary in writing. The Club Secretary will acknowledge receipt of your complaint and will endeavour to investigate it within 15 working days.

If your complaint cannot be satisfactorily resolved by the Club, or you are concerned with how it is handling your personal data, you may also complain directly to theInformation Commissioner's Office using their online form which can be found at ico.org.uk/concerns/handling.Please let the Club know if you decide to take this action.

9. If you change your mind about your consents

You may change your consent at any time by asking the Membership Secretary for a new GDPR Consent Form. You may also ask to see what information the Club holds about you and have it changed or removed if you know something is wrong.