Penzance Swimming and Waterpolo Club, Penzance, Cornwall

Last updated: [date] | Review date: [date, at least annually]

1. Who we are

Penzance Swimming and Waterpolo Club ("the Club", "we", "us") is a [volunteer-run / affiliated] swimming and water polo club based in Penzance, Cornwall. We are the "data controller" for the personal information described in this policy, which means we decide how and why it is used.

Contact for data protection matters: Data Protection Lead: [name / role] Email: [email address] Postal address: [club address]

We are not required to appoint a Data Protection Officer, but the person named above is responsible for handling privacy questions and requests.

2. What this policy covers

This policy explains what personal information we collect about members, parents and carers, volunteers, coaches, officials, and visitors to our website, how we use it, who we share it with, and what rights you have. We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

3. What information we collect

Membership and registration

Name, date of birth, gender, address, email address and telephone number

Parent or carer details for members under 18

Emergency contact details

Swim England or other governing body membership number

Squad, group or team allocation

Health and welfare information (special category data)

Medical conditions, allergies, disabilities, medication and other health information you choose to give us so that we can keep members safe and make reasonable adjustments

Accident and incident reports

Performance and competition

Attendance, times, results, and progress records

Entries for galas, tournaments and matches

Photographs and video

Images of members taken at training, competitions and events (see section 8)

Volunteers, coaches and officials

Contact details, qualifications and training records

Safeguarding and DBS check information where required

Payments

Records of subscriptions, fees and payments. We do not store full card details; payments are handled by our payment provider [name].

Website and communications

Messages you send us, and basic technical data such as IP address and cookies if you use our website (see section 11)

4. How and why we use your information

Under data protection law we must have a lawful basis for using personal information. Ours are:

Purpose

Lawful basis

Managing membership, training sessions and fees

Contract, or legitimate interests of running the Club

Entering members into competitions and registering with governing bodies

Legitimate interests, and contract

Keeping members safe, including safeguarding and emergency contact

Legal obligation and legitimate interests

Health and medical information

Explicit consent, and where necessary, vital interests (in an emergency)

Safeguarding records and DBS checks

Legal obligation, and substantial public interest (safeguarding of children and individuals at risk)

Sending Club news, fixtures and event information

Legitimate interests

Fundraising or marketing emails and texts

Consent

Photographs and video for publicity (website, social media)

Consent

Accounts, insurance and legal claims

Legal obligation and legitimate interests

5. Children and young people

Many of our members are under 18. We take extra care with their information. We collect it from parents or carers wherever possible, we communicate with parents or carers about under-16s, and we do not use children's information for marketing without parental consent. Our safeguarding policy sets out how we protect young people, and information relating to safeguarding concerns may be shared with the appropriate authorities without consent where the law allows or requires it.

6. Who we share your information with

We only share information where we need to, and only what is necessary. Recipients may include:

Governing bodies: Swim England, Swim England South West, and for water polo the relevant national and regional bodies, for membership registration, competition entry and safeguarding purposes

Venues and event organisers: for galas, tournaments and matches

Coaches, committee members and volunteers: on a need-to-know basis

Service providers: such as our membership or club management system [name], payment provider [name], email provider [name], and insurers

Emergency services and medical professionals: in an emergency

Statutory and safeguarding agencies, the police, or courts: where required by law or to protect someone's safety

Accountants or professional advisers: where needed

We do not sell your personal information. Where service providers act on our behalf, we require them to protect your information and use it only on our instructions.

7. Transfers outside the UK

Some of our providers may store data outside the UK. Where this happens, we make sure appropriate safeguards are in place, such as an adequacy decision or the UK International Data Transfer Agreement or Addendum.

8. Photography, video and social media

We will ask for consent before using identifiable photographs or videos of members for publicity, including on our website and social media.

For under-18s, consent is given by a parent or carer. You can withdraw consent at any time by contacting us.

We will not name children alongside their photographs without specific permission.

Parents, carers and spectators may only take photographs at Club sessions and events in line with our photography policy and the rules of the venue. Photography in changing areas is strictly prohibited.

9. How long we keep your information

We keep personal information only as long as we need it.

Information

Retention

Membership records

Duration of membership plus [2] years

Financial records

6 years (legal requirement)

Accident and incident records

Adults: [3–7] years. Children: until the child turns 21, or longer where advised by our insurers

Safeguarding records

Kept in line with national guidance, which may mean long-term retention

Volunteer and coach records

Duration of role plus [2] years

Marketing consents

Until you withdraw consent

[Adjust these periods to match your club's actual practice and insurer or governing body guidance.]

10. How we keep your information safe

We use sensible measures to protect personal information, including password-protected systems, restricting access to those who need it, secure storage of paper records, and keeping devices and software up to date. Committee members, coaches and volunteers are reminded of their responsibilities. If there is a personal data breach that is likely to risk your rights and freedoms, we will report it to the Information Commissioner's Office (ICO) within 72 hours and tell affected individuals where required.

11. Our website and cookies

Our website [address] may use cookies to make it work and to understand how it is used. Where cookies are not strictly necessary, we will ask for your consent through a cookie banner. You can change your browser settings to block cookies, though some parts of the site may not work properly. [Delete or adapt this section if the Club website does not use cookies.]

12. Your rights

You have the right to:

Be informed about how we use your data (this policy)

Access the personal information we hold about you

Correct information that is wrong or incomplete

Erase your information in certain circumstances

Restrict how we use your information in certain circumstances

Object to us using your information for legitimate interests or direct marketing

Data portability in certain circumstances

Withdraw consent at any time where we rely on consent (this will not affect past use)

To use any of these rights, contact our Data Protection Lead using the details in section 1. We will respond within one month. We may need to verify your identity first. Parents and carers can exercise these rights on behalf of children, and older children can do so themselves where they understand their rights.

Some rights are limited where we have a legal duty to keep information, for example financial or safeguarding records.

13. Complaints

If you are unhappy with how we have handled your information, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office:

Website: ico.org.uk Telephone: 0303 123 1113

14. Changes to this policy

We will review this policy at least once a year and update it when our practices or the law change. The latest version will be available on our website and from the Club on request. Significant changes will be communicated to members.

This policy is a template written for the Club and should be checked against how the Club actually handles data. Consider having it reviewed by your committee and, if possible, against Swim England's current club guidance. The Club may also need to register with the ICO and pay the data protection fee unless it qualifies for an exemption (the ICO's online self-assessment will confirm this).