In May 2018, the regulations surrounding how companies and organisations can hold your Personal Data changed. This Notice tells you how we handle your Personal Data and the rights you have with regard to this data. This Notice is intended to comply with the provisions of the General Data Protection Regulation EU 2016/679 (GDPR) which governs how Personal Data is processed within the European Economic Area (EEA).
This Notice may be updated from time to time. It was last updated on 9th September 2018.
Who are we?
We are East London Triathletes.
Our website is elt.london and our email address is firstname.lastname@example.org.
We are the ‘Data Controller’ for the purposes of GDPR. This means that we decide how and for what purposes your Personal Data is processed.
Your Personal Data – what is it?
Personal Data is data that relates to a natural person that can be identified from that data. We might be able to identify a person from the data itself or by linking that data to other information to which we have access. GDPR mandates how we must process your Personal Data.
How do we process your Personal Data?
We comply with our obligations under GDPR in the following ways:
- by keeping Personal Data up to date;
- by storing and destroying it securely;
- by not collecting or retaining unnecessary or excessive amounts of data;
- by protecting Personal Data from loss, misuse, unauthorised access and disclosure; and
- by ensuring that appropriate technical measures are in place to protect Personal Data.
We use your Personal Data for the following purposes:
- To manage your membership (if applicable);
- To manage your registration and participation in events, either as a member or non-member;
- To process membership subscriptions, event and other payments
- To inform you of news, events, activities or services which we think you might like to hear about;
- To share your contract details with officials and other authorised people and companies for the purpose of delivering the events, activities and services we provide.
What is the legal basis for processing your Personal Data?
- You have given us consent to use your Personal Data for the purposes given in the consent statement you agreed to when becoming a member of East London Triathletes;
- And/or you have given us consent to use your Personal Data for the purposes given in the consent statement when you entered an East London Triathlete event;
- For sensitive information (such as gender and medical data), we will have asked for and you will have given us explicit consent to store and use that information, again, when becoming a member of East London Triathletes and/or entering an East London Triathletes event.
Sharing your Personal Data
Your Personal Data will be treated as strictly confidential and will be shared only with organisations whose services are required in order to provide the services we offer. We use other companies to help us process your Personal Data so that we can offer you the best possible service.
We will share your Personal Data with other third parties only with your consent. These third parties, in turn, may rely on data processors to provide services that help them help us.
Some third parties we use may operate outside the EEA. In these cases, we will make sure that we have robust contracts in place with those third parties and that adequate safeguards exist to protect and secure your Personal Data.
When you give your consent to our holding of your Personal data you agree to us sharing your Personal Data (including special categories of Personal Data – where we have your explicit consent) with third party processors and sub-processors located both inside and outside the EEA.
How long do we keep your Personal Data?
We keep your Personal Data for as long as you are a member of our organisation or, if a non-member, for as long as necessary to provide you with relevant services . After you leave our organisation or we have provided the relevant services, we will keep your information for no longer than we reasonably need. Usually, this will be for a period of not more than a year but can be up to seven years for accounting purposes.
Your rights and your Personal Data
Unless we have an exemption under GDPR, you have the following rights with respect to your Personal Data: –
- The right to request a copy of the Personal Data which we hold about you, without any charge.
- The right to request that we correct any Personal Data found to be inaccurate or out of date.
- The right to request that your Personal Data is erased where it is no longer necessary for us to keep it.
- The right to withdraw your consent to the processing we carry out at any time.
- The right to request that we provide you with your Personal Data and, where possible, to send that data directly to another data controller.
- The right, where there is a dispute in relation to the accuracy or processing of your Personal Data, to ask us to restrict further processing.
- The right to object to the processing of Personal Data.
- The right to lodge a complaint with the Information Commissioners Office and to seek legal recourse.
If we wish to use your Personal Data for a new purpose, not covered by this Notice, then we will provide you with a new notice explaining this new use. We will do this before we start processing for the new use. We will set out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.
If you would like to discuss anything in this privacy notice or would like to raise a concern regarding the way we are collecting or using your Personal Data, please contact us in the first instance via email to email@example.com.
Alternatively, you can contact the Information Commissioners Office on 0303 123 1113 or via email (https://ico.org.uk/global/contact-us/email) or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.