Introduction
The Club needs to gather and use certain information about membership. This policy describes how this personal data must be collected, handled and stored to meet the data protection standards — and to comply with the law.
Why this policy exists
This data protection policy ensures the Club:
- Complies with data protection law and follow good practice
- Protects the rights of membership
- Is open about how it stores and processes individuals’ data
- Protects itself from the risks of a data breach
Data protection law
The Data Protection Act 2018 (or superseding Acts) describes how organisations — including the Club— must collect, handle and store personal information.
These rules apply regardless of whether data is stored electronically, on paper or on other materials. To comply with the law, personal information must be collected and used fairly, stored safely and not disclosed unlawfully.
The Data Protection Act is underpinned by these important principles. These say that personal data must:
- Be processed fairly and lawfully
- Personal data should not be disclosed to unauthorised people, either within the club or externally.
- Be obtained only for specific, lawful purposes
- Be adequate, relevant and not excessive
- Be accurate and kept up to date
- Not be held for any longer than necessary
- Processed in accordance with the rights of data subjects
- Be protected in appropriate ways
- Not be transferred outside the European Economic Area (EEA), unless that country or territory also ensures an adequate level of protection People, risks and responsibilities
Policy scope
This policy applies to:
- All Wistow Tennis Club Management Committee
- All Wistow Tennis Club Membership on shared communication channels
- All contractors, suppliers and other people working on behalf of the club
- It applies to all data that the club holds relating to identifiable individuals, even if that information technically falls outside of the Data Protection Act 2018. This can include:
Names of individuals
Email addresses
Telephone numbers
…plus any other information relating to individuals
Data protection risks
This policy helps to protect the club from some very real data security risks, including:
- Breaches of confidentiality. For instance, information being given out inappropriately.
- Failing to offer choice. For instance, all individuals should be free to choose how the club uses data relating to them.
- Reputational damage. For instance, the club could suffer if hackers successfully gained access to sensitive data.
Responsibilities
Everyone who is a member of Wistow Tennis Club has some responsibility for ensuring data is collected, stored and handled appropriately.
However, these people have key areas of responsibility:
- Wistow Tennis Management Commitee is ultimately responsible for ensuring that the Club meets its legal obligations.
- The IT/Website manager, is responsible for:
- Dealing with requests from individuals to see the data the Club holds about them (also called ‘subject access requests’).
- Ensuring all systems, services and equipment used for storing data meet acceptable security standards.
- Performing regular checks and scans to ensure security hardware and software is functioning properly.
Opting out
Even where the organisation is not relying on consent, it may wish to give people the opportunity to opt out of their data being used in particular ways.
GDPR & Data Protection
General Data Protection Regulations (GDPR) 2018
In agreeing to the clubs ‘code of conduct’ and ‘be a member of the whatsapp group’, you give the club, permission to collect, retain and process personal information about you such as name, date of birth, contact information e.g. email and phone. This information will be used for management purposes in connection with your membership with Wistow Tennis Club. If your personal circumstances change, you are required and agree to inform the Club.
Policy Awareness
If an individual contacts the club requesting this information, this is called a subject access request.
Subject access requests from individuals should be made by email addressed to the Club. Individuals will not be charged for the subject access request. The Club will aim to provide the relevant data within 14 days.
The Club will always verify the identity of anyone making a subject access request before handing over any information.
Disclosing data for other reasons in certain circumstances, the Data Protection Act allows personal data to be disclosed to law enforcement agencies without the consent of the data subject.
Under these circumstances, the Club will disclose requested data. However, the club will ensure the request is legitimate, seeking assistance from the legal advisers where necessary.
Providing information
The Club aims to ensure that members are aware that their data is being processed, and that they understand:
- How the data is being use
- How to exercise their rights
