Data Privacy Policy

1. About this policy

Penrith Canoe Club ("PCC", "the Club", "we", "us" or "our") is committed to protecting the privacy and personal information of our members, participants, volunteers, coaches, parents, guardians and other people who interact with the Club.

This Privacy Policy explains:

• what personal information we collect;
• why we collect and use it;
• the lawful bases we rely upon;
• who we may share it with;
• how we keep it secure;
• how long we retain it; and
• your rights in relation to your personal information.

We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For the purposes of data protection law, Penrith Canoe Club is the data controller for personal information covered by this policy.

We may update this policy from time to time. The current version will be published on our website.

2. Who we are

Penrith Canoe Club is a community canoe and kayaking club providing paddlesport activities, coaching, training, competitions and other club activities.

You can contact us about data protection or this policy at:

Penrith Canoe Club
Email: info@penrithcanoeclub.co.uk
Website: www.penrithcanoeclub.co.uk

Data Protection Contact: Chris Archer

3. Information we collect

The information we collect depends on how you interact with the Club.

Membership and contact information

We may collect:

• your name;
• address;
• email address;
• telephone number;
• date of birth or age;
• membership information;
• Paddle UK membership or affiliation information where relevant;
• details of membership fees and payments; and
• information about your involvement with the Club.

We use this information to administer memberships, communicate with members and operate the Club.

Our lawful bases will normally be the performance of our membership agreement with you and/or our legitimate interests in administering and operating the Club.

Children and young people

The Club provides activities for children and young people and therefore processes personal information relating to junior members.

This may include:

• name;
• date of birth or age;
• parent or guardian information;
• contact details;
• emergency contact information;
• relevant medical or accessibility information;
• membership details; and
• information necessary for participation, safeguarding and competitions.

Where appropriate, information about younger members may be provided by their parent or guardian.

We take particular care when processing information relating to children and young people and only collect information reasonably required to operate activities safely and effectively.

Emergency contacts

We may collect the names, telephone numbers and relationship details of emergency contacts.

We use this information where necessary to protect the safety and welfare of members and participants, including contacting a parent, guardian or other emergency contact.

Our lawful basis is normally our legitimate interests in protecting participants and meeting our duty of care.

Health, medical and accessibility information

Members or their parents or guardians may provide information about medical conditions, allergies, medication, disabilities, accessibility requirements or other health matters that may be relevant to safe participation in Club activities.

Health information is classed as special category personal data under UK data protection law.

We will only process this information where there is an appropriate lawful basis and an additional condition permitting the processing of special category data.

We will limit access to this information to people who reasonably need it for safety, welfare, safeguarding or the operation of Club activities.

Coaching, qualifications and volunteering

For coaches, officials and volunteers we may process information including:

• contact details;
• coaching qualifications;
• paddlesport qualifications;
• training records;
• first aid qualifications;
• safeguarding training;
• relevant checks or accreditation information; and
• roles undertaken within the Club.

We use this information to organise Club activities and help ensure that activities are appropriately staffed and supervised.

Attendance, activities and competitions

We may record information about participation in Club sessions, training, events, courses and competitions.

Where necessary, relevant participant information may be provided to competition organisers, governing bodies, venues or other organisations involved in delivering an activity.

Incidents and accidents

If an accident, injury, safeguarding concern or other incident occurs during a Club activity, we may collect information including:

• the names of people involved;
• date, time and location;
• details of what happened;
• injuries or medical information;
• first aid or other treatment provided;
• witnesses;
• emergency contacts;
• involvement of emergency services;
• actions taken following the incident; and
• details of the person completing the report.

Incident reports may contain special category personal data, particularly health information.

We process this information where necessary to protect the welfare and safety of participants, manage incidents, meet our legal and insurance responsibilities, and establish, exercise or defend legal claims.

Access to incident and accident records will be restricted to authorised individuals who have a legitimate need to access them.

Photographs and video

We may take photographs or video during Club activities, events and competitions.

These may be used for purposes such as:

• promoting the Club;
• the Club website;
• social media;
• newsletters;
• publicity;
• recording Club activities; and
• coaching or training.

Where consent is required, particularly in relation to children and young people, we will obtain appropriate consent before using photographs or video.

We will respect reasonable requests not to be photographed or filmed.

Website and enquiries

When you use our website or contact us through a website form, we may collect information including:

• your name;
• email address;
• telephone number;
• information contained in your enquiry;
• IP address;
• technical information associated with your request; and
• information submitted through forms on the website.

We use this information to respond to enquiries, administer Club activities, maintain the security of our website and provide requested services.

Our website may also create technical server and security logs to help us maintain its reliability and security.

4. How we use your information

We only use personal information where we have a lawful reason to do so.

Depending on the circumstances, this may include:

• fulfilling our membership agreement with you;
• operating and administering the Club;
• organising sessions, events, courses and competitions;
• communicating with members;
• maintaining participant safety;
• responding to accidents and emergencies;
• safeguarding children and vulnerable participants;
• administering payments;
• maintaining appropriate coaching and volunteer records;
• complying with legal, regulatory or insurance requirements;
• maintaining the security of our website and systems; and
• pursuing our legitimate interests in operating and developing the Club.

Where we rely on legitimate interests, we will consider those interests against the rights and interests of the people whose information we process.

Where we rely on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect processing that took place before consent was withdrawn.

5. Sharing your information

We do not sell your personal information.

We only share personal information where reasonably necessary and where we have an appropriate lawful basis for doing so.

Depending on the circumstances, information may be shared with:

• Paddle UK or other relevant governing bodies;
• competition and event organisers;
• coaches, officials and authorised Club volunteers;
• venues and activity providers;
• insurers and insurance advisers;
• emergency services;
• medical professionals where appropriate;
• safeguarding organisations or authorities;
• professional advisers;
• payment providers;
• website, hosting, email and IT service providers; and
• public authorities where disclosure is required or permitted by law.

We will only provide information that is reasonably necessary for the relevant purpose.

Where another organisation processes personal information on our behalf, we will take reasonable steps to ensure appropriate data protection and security arrangements are in place.

6. International transfers

Some organisations that provide technology or other services to the Club may process or store information outside the United Kingdom.

Where personal information is transferred internationally, we will ensure that the transfer complies with UK data protection law and that appropriate safeguards are in place where required.

7. Keeping your information secure

We take reasonable technical and organisational measures to protect personal information against:

• unauthorised access;
• accidental loss;
• misuse;
• alteration;
• disclosure; and
• destruction.

Access to personal information is restricted to Club officials, volunteers and service providers who reasonably require access for their role.

Particularly sensitive information, including medical information, safeguarding information and accident or incident reports, will have additional access restrictions where appropriate.

No internet-based service can be guaranteed to be completely secure. We therefore regularly review how personal information is stored and accessed and take reasonable steps to protect it.

If a personal data breach occurs, we will investigate it and take appropriate action. Where required by law, we will notify the Information Commissioner's Office and affected individuals.

8. Payments

Where payments are made online, payment information may be processed by a recognised third-party payment provider.

The Club will not retain complete payment card information unless this is necessary and we are permitted to do so.

We may retain appropriate financial and transaction records for accounting, legal and administrative purposes.

9. How long we keep your information

We will only keep personal information for as long as reasonably necessary for the purpose for which it was collected and to meet any applicable legal, regulatory, safeguarding, insurance or accounting requirements.

Different categories of information may therefore be retained for different periods.

When determining an appropriate retention period, we consider:

• why the information was collected;
• whether it is still required;
• legal and regulatory requirements;
• safeguarding requirements;
• insurance requirements;
• accounting and tax requirements; and
• whether information may be required to establish, exercise or defend a legal claim.

Information that is no longer required will be securely deleted, destroyed or anonymised where appropriate.

We will periodically review the personal information we hold and our retention requirements.

10. Your data protection rights

Depending on the circumstances and the lawful basis on which we process your information, you may have the right to:

• ask us for a copy of the personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to erase your personal information;
• ask us to restrict how your information is processed;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent; and
• complain about how your personal information has been processed.

These rights are not absolute and may not apply in every circumstance.

If you wish to exercise any of these rights, contact:

info@penrithcanoeclub.co.uk

We will normally respond to a valid request within one month, although the law allows additional time in certain circumstances.

We may need to confirm your identity before providing personal information or acting on a request.

11. Complaints

If you have concerns about how Penrith Canoe Club processes your personal information, please contact us first so that we can investigate the matter:

Email: info@penrithcanoeclub.co.uk

You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Website: ico.org.uk

12. Cookies and third-party services

Our website may use cookies and similar technologies that are necessary for the website to operate.

Where we use non-essential cookies, analytics or other technologies that require consent, we will provide appropriate information and obtain consent where required.

Our website may contain links to external websites or services. Penrith Canoe Club is not responsible for the privacy practices of websites operated by other organisations.

Further information about cookies used by our website may be provided in a separate Cookie Policy.

13. Changes to this policy

We may update this Privacy Policy when our activities, systems, service providers or legal obligations change.

The latest version will be made available on the Penrith Canoe Club website and the date at the top of this policy will show when it was last updated.

14. Contact us

Questions, requests or concerns about this policy or the way Penrith Canoe Club handles personal information should be sent to:

Data Protection Contact: Chris Archer
Email: info@penrithcanoeclub.co.uk

Penrith Canoe Club
www.penrithcanoeclub.co.uk