Data Privacy Policy
MENGEHAM RYTHE SAILING CLUB
1. INTRODUCTION
Mengeham Rythe Sailing Club ("the Club") processes (collects, records, organizes, structures, stores, retrieves, uses, and discloses by making available) personal information in respect of individuals ("data subjects") in the course of managing the Club or organising events. In so doing the Club seeks to comply with the principles and provisions of the EU General Data Protection Regulations 2016/679 and the UK Data Protection Acts.
This policy statement makes available to data subjects information with regard to the personal data processed in respect of them and the basis on which it is so processed.
2. DATA CONTROLLER AND DATA PROTECTION OFFICER
The Club is the Data Controller under the Act in that it determines what personal information is held and how it used. The Club's representative in this regard is its Data Protection Officer (secretary@mengeham.org.uk).
3. DATA PROCESSING
The Club has identified the circumstances in which it knowingly processes personal data:
a. information in respect of members, or prospective members, being
- i. names of member(s) by membership class
- ii. their postal and email addresses
- iii. their telephone number(s)
- iv. their dates of birth
- v. their category (by active water interest).
b. information in respect of members and non-members participating in boating events, including races, rallies and courses, organized by the Club including, when appropriate, i. their names, postal and email addresses, telephone number(s), dates of birth,
- ii. boat details,
- iii. any particular health issues or dietary requirements.
c. information in the form of photographs of members or non members engaging in club activities.
4. DATA PROCESSING IS LAWFUL IF
(i) Membership data: The provision of a member's name, date of birth, postal and email addresses, and telephone numbers is a requirement of the Club rules (Rule 4.5(ii) below) which forms the basis of the contract between members and the Club.
either a. NECESSARY FOR THE PERFORMANCE OF A CONTRACT TO WHICH THE DATA SUBJECT IS PARTY, and/or b. NECESSARY FOR THE PURPOSES OF THE LEGITIMATE INTERESTS PURSUED BY THE CLUB.
A. The data is held primarily (but not exclusively) in the membership data base and is necessarily processed to communicate with members with regard to Club business; to monitor progression of membership where applicable, to create annual invoices for membership dues and to undertake statistical analysis of the club membership as a whole.
B. Membership application forms are held for the period of probationary membership. In the event of membership not being offered or accepted all data will be destroyed within 28 days of the decision being communicated. Otherwise, data is held for one year beyond any current membership year for audit purposes, whether or not the membership remains current, or for six years in so far as it is relevant to the requirement under VAT legislation to preserve accounting records.
C. Members' duties are published in the hard copy annual programme provided to every member; an electronic copy is published for one year in the members section (password protected) of the club web site.
D. The Club email addresses of Club Officers and other members with responsibilities in the Club are published in the hard copy annual programme to enable members to contact them with regard to Club business.
E. A record of members' skills and qualifications are held, but not generally published, for the purpose of allocating duties and for using member expertise in the context of a self help club.
F. The business of Club committee meetings is minuted and may be published on club notice boards or the club web site. The presence of committee members will be minuted, and contributions to debate may be attributed; matters relating to individual club members will be attributed by membership no. not name (except as regarding the acceptance for, or resignation of, membership) in the published record of meetings.
G. The telephone numbers and email address of members undertaking club duties are available (through a separate password protected duty allocation data base, currently "Dutyman") to other members to enable the efficient swapping and performance of allocated duties. Data held for this purpose is updated annually, with no record of previous years being retained.
H. E-mails circulated as a matter of club business to all or a particular group of members are circulated on a blind copy basis.
(ii) Data required for entering events or courses
A. Training Courses may require personal details including any particular health issues or dietary requirements. The latter are required in so far as this is considered to be necessary, in particular with regard to the Club's duty of care. These are destroyed at the end of each calendar year unless retention is considered necessary because of a reasonably perceived possibility of subsequent legal claim or action.
B. The data required for completion of the entry form for a sailing race or event is the basis of the contract between competitors, or the parent or guardian of the competitor, and the Club. Any data with regard to personal health will be used in attending to the competitor's safety given the Club's duty of care. Entry forms will be destroyed within 28 days of the event unless retention is considered necessary because of a reasonably perceived possibility of subsequent legal claim or action.
(iii) Data recording Club activities
A. Race results are published in the clubhouse and on the club web site; these, and photographs of the racing (published by the Club on the club web site and on Facebook pages associated with the Club), may be shared with class associations or the yachting press for publication; they may also be retained in hard copy or electronically as a matter of record this contributes to sustaining interest in sail racing in general and that at the Club in particular, and is generally expected and welcomed by competitors.
B. Photographs of persons' participation in other club activities may be published by the Club, provided they are then over 18, on the Club web site, on Facebook pages associated with the Club, in the club programme or in other communications thereby giving members and potential members a flavour of the activities at the Club.
5. DATA PROCESSING REQUIRING CONSENT
(i) Members Directory: the telephone numbers and email addresses of members over 18 are made available to other members during the currency of membership in the members' directory published in hard copy (separately from the programme) and issued only to members (excluding honorary and temporary members). Members may consent to either or both telephone numbers and emails.
(ii) Photographs of the participation of persons under 18 in club activities may be published by the Club on the Club web site (without names attributed), on Facebook pages associated with the Club, in the Club programme or in other communications whilst they are under 18, only if their parents or guardian consent.
6. RIGHTS OF MEMBERS AND OTHERS (DATA SUBJECTS)
Members, other participants in Club activities, or their parents or guardian may at any time
- (i) ask to see any data the Club holds with regard to them, withdraw any consent they have given to data being processed, or request rectification of any data held by the Club, by contacting the Club's Data Protection Officer (secretary@mengeham.org.uk),
- (ii) lodge a complaint with the Information Commissioner's Office with regard to any data processed by the Club relating to themselves or to their children or wards.
7. INFORMATION WE DO NOT HOLD OR DISCLOSE
- (i) It is the Club's policy not to hold personal financial information such as bank account details; these are not required for the collection of dues. Where such information is required for making electronic payments to members (either in repayment of dues or as reimbursement of expense incurred on behalf of the Club) this is held by the Club's bank, not by the Club.
- (ii) It is the Club's policy not to sell personal data to any third party, nor to disclose it otherwise than in accordance with the policy set out above.
8. SOCIAL MEDIA
(i) The Mengeham Rythe SC, the Mengeham Finn and the Dragon Force Facebook pages were set up by individual members for their own recreational interests and as such are exempt from the Data Protection legislation. Most postings are by individual members, although members with a position of responsibility within the Club may post in that capacity in compliance with the policy above. The Club does not moderate postings by individuals. However it will use its influence to ensure that any request by the parent or guardian of any person under 18 remove to remove a posting of photographs (digital images) of that person is complied with, whether or not the parent or guardian has given consent as above for publication generally by the Club.
