Privacy Notice - Bishop’s Stortford Running Club

Bishop’s Stortford Running Club is committed to protecting and respecting your privacy. For any personal data you provide for the purposes of your membership, Bishop’s Stortford Running Club is the Data Controller and is responsible for storing and otherwise processing that data in a fair, lawful, secure and transparent way.

The Club uses the myClubhouse software supplied by Simmetrics Ltd to process personal data we include on our myClubhouse website in accordance with this privacy policy. Simmetrics Ltd is a Data Processor and processes your personal data on our behalf and they can only do so in accordance with our written instructions.

Throughout this policy the term Club refers to Bishop’s Stortford Running Club, including Stortford Tri and sub-sections thereof. This policy applies to all data collected by the Club, including where a parent or guardian provides data to the Club to sign up their child. Please read this policy carefully to make sure you understand its contents. All queries in relation to this policy are handled by the Committee and any queries should be sent to secretary@bsrc.org.uk.

What personal data we hold about you

You may give us information about you by filling in forms at an event or online, or by corresponding with us by phone, e-mail or otherwise. This includes information you provide when you register with the Club via our online membership portal, myClubhouse. The information you give to us includes your name, date of birth, gender, address, e-mail address, phone number, , emergency contact details, medical information which includes medical conditions (that are relevant to you taking part in any of our activities) and any medication. We also hold data about you that we need to partner with relevant governing bodies. This includes the name of the England Athletics (EA) or British Triathlon Federation (BTF) affiliated clubs with which you are registered and other data (for example, your EA registered athlete number).

Why we need your personal data

We need your personal data so that we can provide the membership services you are signing up to when you register with the Club and also, if applicable, to administer your EA membership (if applicable) and the Club’s affiliation to EA and BTF. Our lawful basis for processing your personal data is that we have a contractual obligation to you as a member to provide the services you are registering for. With respect to any personal data we collect that pertains to your health (including medical information and medication), our additional condition for processing this data is your explicit consent.

For training and competition entry:

• we may share your personal data with club coaches or officials to administer training sessions and to assist with the progression and development of members in the sport.

• we may share your personal data with club team managers to enter events, such as name, date of birth, address, place of birth (if required for county or regional competition). This data may also be shared also with leagues, county associations and other competition providers for entry in events affiliated to either EA or BTF competition.

• We may also hold race result data on athletes submitted to us by individuals following participation in events, or race data gathered directly from publicly available race results.

For funding and reporting purposes:

• we may share anonymised data with a funding partner as condition of grant funding e.g. Local Authority;

• we may share anonymised data of total membership numbers to pay relevant fees to governing bodies;

• we may analyse anonymised data to monitor club trends, for example this enables us to plan coaching capacity for sessions.

The above data is anonymised, which means that it does not identify you and is therefore not classed as personal data.

For membership and club management:

• processing of membership forms and payments.

• sharing data with committee members to provide information about club activities, membership renewals or invitation to social events.

• informing members about the development of the Club, the distribution of the club newsletter promoting club activity and publishing of race and competition results. Your results may also be included in external communications such as Local Newspapers or external facing Facebook pages (or similar social networking sites).

Marketing and communications (where separate consent is provided):

• sending information about promotions and offers from sponsors, external events.

• sending information about selling club kit, merchandise or fundraising.

Any special category health data we hold on you is only processed for the purpose(s) of fitness/ health checks or passing health data to coaches to allow the safe running of training sessions. We process this data on the lawful basis of consent. Therefore, we will also need your explicit consent to process this data, which we will ask for at the point of collecting it. On occasion we may collect personal data from non-members e.g. such as any non-member participant who fills in a health disclaimer or form at a taster event. This information will be stored for 30 days after an event and then destroyed securely. Our lawful basis for processing data is consent. Therefore, we will also need explicit consent from non-members to process this data, which we will ask for at the point of collecting it.

The Club has the following social media pages a private Facebook group, a private StortfordTri Facebook group, a public Facebook group, Instagram and X (formerly known as Twitter) accounts. All members are free to join or follow these pages. If you join one of the Social Media pages, please note that provider of the social media platforms has their own privacy policy and that the Club does not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data on the Club social media pages.

Club members may be members of various WhatsApp chat groups which are not officially run or managed by the Club and the Club does not accept any responsibility for the sharing of data as a result of joining or using these groups.

Who we share your personal data with

When you become a member of the Club you can also choose to be registered as a member of England Athletics Limited. If you do this we will provide England Athletics Limited with your relevant name, gender, email address, date of birth and postal address) which they will use to give you access to the MyAthletics portal. England Athletics Limited will invite you to sign into and update your MyAthletics portal. You can set and amend your privacy settings from the MyAthletics portal. If you have any questions about the continuing privacy of your personal data when it is shared with England Athletics Limited, please contact dataprotection@englandathletics.org. If you choose not to be registered with England Athletics , then we will not share your data with England Athletics Limited. Note, that some competitions require you to be registered with EA.

We may also include your personal information on any request that is shared to us from official Government bodies in line with prevailing legal requirements. The Club does not supply any personal data it holds for this purpose to any other third party unless mentioned in this policy or required to do so by law.

How long we hold your personal data

We will hold your personal data for as long as you are a member with us. Whilst we collect your personal data when signing up to the Club through myClubhouse, you are free to update this information at anytime through your profile there. We recommend that you review your personal data at least annually to ensure the details remain accurate. We will delete any personal data we hold about you four years after you cease to be a member of the Club. Before doing so, we will give you the opportunity to remain in our database for the purposes of receiving emails from the Club. Your data is not processed for any further purposes other than those detailed in this policy.

International Transfers

We do not transfer your personal data outside of the UK.

Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Your rights regarding your personal data

As a data subject you are not obliged to share your personal data with the Club. If you choose not to share your personal data with us we may not be able to register or administer your membership. As a data subject you also have the right to:

• Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:

o If you want us to establish the data's accuracy.

o Where our use of the data is unlawful but you do not want us to erase it.

o Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.

o You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

Date approved - 30 April 2025

Date for next review - within one month of 2026 AGM

Approved by BSRC Committee