FPSC Data Privacy Policy Version 4 January 2023

1. Who are we?
   1. We are Frensham Pond Sailing Club (FPSC) including Frensham Pond Sailability. We can be contacted by post addressed to Data Protection Manager, Frensham Pond Sailing Club, Pond Lane, Churt, Surrey, GU10 2QA; by telephone on 01252 792859; or by email to dpmanager@sailfrensham.org.uk
   2. FPSC is a non-profit making organisation affiliated to the RYA which aims to encourage amateur boat sailing and racing.
      
2. About this Policy
   
   1. This policy explains when and why we collect personal information about registered users of the booking and membership system, members, instructors, staff and suppliers; their rights in relation to it; how we use it; how we store it; and how we keep it secure.
   2. We reserve the right to amend this Data Processing Policy without prior notice but will inform you if we do.
   3. We are the “controller” of all personal data we hold about you and will comply with the General Data Protection Regulation (GDPR).
      
3. What information we collect and why.
   1. We will only collect personal information about you and your dependents directly from you. It will normally be supplied by you through our online booking and membership system, by email or on paper.
   2. Details of the type of information we collect and what we use it for are shown in the table below.
      
      

Type of information	Purposes	Legal basis of processing
Member's name, address, telephone numbers, e-mail addresses.	Managing the Member’s membership of the Club. Managing the duty roster. Communicating with the Member about Club activities. To inform entrants to racing, training or other events about future Club activities they could be interested in after their membership ceases.	Performing the Club’s contract with the Member. For the purposes of our legitimate interests in operating the Club. We will seek consent on the membership, event entry or booking form.
Member’s name and telephone number.	Publication in the Handbook to enable members to contact each other in relation to activities at the Club.	Electronic Version : For the purposes of our legitimate interests in operating the Club. Printed Version : We seek the Member’s consent to publish this information when they apply for or renew their membership. Consent may withdrawn at any time but contact details cannot be removed from existing printed material.
The names and ages of the Member’s dependants.	Managing the Member’s and their dependants’ membership of the Club.	Performing the Club’s contract with the Member.
Date of birth / age related information.	Managing age related membership categories.	Performing the Club’s contract with the Member.
Gender.	Provision of adequate changing and facilities for each gender. Collating race results which are classified according to gender. Reporting information to other organisations in support of memberships, registrations, accreditations and applications for funding, licences and consents.	For the purposes of our legitimate interests in providing sufficient and suitable facilities. Performing the Club’s contract with the Member. For the purposes of our legitimate interests in promoting the Club; and maintaining or developing facilities and activities. For the purposes of other organisations’ legitimate interest in monitoring & maintaining diversity.
Staff names, addresses, telephone numbers, e-mail addresses, National Insurance numbers, tax references and qualifications.	Managing staff employment and duty rotas; communicating with staff; paying staff; ensuring staff are qualified appropriately for their work.	Performing the Club’s contract with staff and for the purposes of our legitimate interests in operating the Club.
Emergency contact details for members and staff.	Contacting next of kin in the event of emergency.	Protecting the Vital Interests of members, their dependants and staff.
Bank account details of members, staff, or suppliers.	To make payments for expenses incurred, wages or goods / services supplied.	Performing the Club’s contract with members / staff / supplier.
Medical information (which includes information on dietary intolerances).	Awareness of special needs and dealing with any medical emergency.	We seek the Member’s consent to hold this information. Members may withdraw their consent at any time. Information may be disclosed to third parties such as but not limited to the ambulance service to protect the Vital Interests of the Member in the event of an emergency.
The Member’s name, class of boat and sail number.	Managing race entries and race results. Sharing race results with other clubs, class associations, and the RYA. Publishing race results on the Club’s website, social media pages and in press releases to local and national media. Allocating berths in the boatpark.	For the purposes of our legitimate interests in holding races for the benefit of members of the Club. For the purposes of our legitimate interests in promoting the Club. For the purposes of our legitimate interests in operating the Club
Photos and videos of members and their boats.	To use as a training / coaching aid, recognise achievement, assist with race management, and to assist with event management. To promote the Club through its handbook, newsletters, leaflets, books, presentations, websites, social media and in press reports.	For the purposes of our legitimate interests in training and coaching members; for the legitimate interest of the Member receiving training or coaching. If they can reasonably be identified then we seek the Member’s consent to use their image. The Member may withdraw consent at any time by updating their preferences in myClubhouse.
Photographs of members.	To issue RYA certificates.	Performing the Club’s contract with the Member.
Bank account details of members, staff, or suppliers.	To make payments for expenses incurred, wages or goods / services supplied.	Performing the Club’s contract with members / staff / suppliers.
Instructor’s name, address, email addresses, phone numbers and relevant qualifications / experience.	Managing instruction at the club and demonstrating to the RYA that instructors have appropriate and current qualifications.	For the purposes of our legitimate interests in ensuring that we can contact those offering instruction and provide details of instructors to members.
Name, email address and telephone number of each Club official, including Officers, Committee Members, training organisers and Class Captains.	Information published on the Club’s website; in the Club’s newsletter and other publications; in the Club’s marketing materials; and made available to the RYA. In each case as a point of contact at the Club.	For the purposes of our legitimate interests in operating and promoting the Club.
Personal data of the staff and representatives of suppliers to the Club.	Entering into and managing arrangements with suppliers.	Entering into and performing contracts with suppliers.
CCTV Images.	To deter and help investigate theft, vandalism and other activity detrimental to the Club’s and its members’ interests.	For the purposes of our legitimate interests in operating the Club.

4. How we protect your personal data
   1. We have implemented generally accepted standards of technology and operational security to protect personal data from loss, misuse, unauthorised alteration or destruction.
   2. Your personal data will only be processed within systems which comply with GDPR or such other standard which provides equivalent protection.
   3. Where you are transmitting information to us over the internet this can never be guaranteed to be secure.
   4. We will only use the online secure payment system operated by the Club’s bank to make any payments to you.
   5. We will notify you promptly in the event of any breach of your personal data which might expose you to serious risk.
      
      
5. Who else has access to the information you provide us?
   
   1. We will never sell your personal data. We will not share your personal data with any third parties without your prior consent (which you are free to withhold) except where required to do so by law or as set out in the table above or paragraphs 5.2, 5.3 and 5.4 below.
   2. We may pass your personal data to third parties who are service providers, agents and subcontractors to us for the purposes of completing tasks and providing services to you on our behalf. We will only disclose the personal data that is necessary for the third party to deliver the service. We have contracts in place that require them to keep your information secure and not to use it for their own purposes.
   3. RYA Instructors’ personal data will be shared with the RYA as part of its inspections of the FPSC Training Centre.
   4. On successful completion of certain RYA courses your name, contact details, date of birth, certificate number and date of issue will be shared with the RYA through a secure web portal. The data will be stored on the RYA’s central database. This information allows the RYA to record your qualification, to update any records they may hold for you, and to verify or replace your certificate if required. The RYA will deal with your data according to its privacy policy which can be viewed at www.rya.org.uk/go/privacy. It will be made clear to you when you book your course if your personal data will be shared in this way.
      
6. How long do we keep your information?
   
   1. We will retain your personal data whilst you are a member of the Club and will review it every year (normally when membership renewals are due) to establish whether we are still entitled to process it.
   2. If we decide that we are no longer entitled to process your personal data then we will stop doing so except that we will retain it in an archived form in order to be able to comply with future obligations such as but not limited to compliance with tax requirements and exemptions; the establishment exercise or defence of legal claims; annual inspections by the RYA; and the replacement of lost RYA certificates.
   3. The periods for which we retain different types of data are shown in the FPSC Record Retention Policy which is available via the Club web site or from the Data Protection Manager.
   4. We destroy or delete all financial information once we have used it and no longer need it.
      
      
7. Your rights
1. You have rights under the GDPR :
   • to be informed about how your personal data is processed
   • to request access to your personal data.
   • to have your personal data corrected if it is inaccurate
   • to have your personal data erased in certain circumstances
   • to object to or restrict how your personal data is processed
   • to have your personal data copied or transferred to yourself or to another organisation in certain circumstances.
     
2. You have the right to take any complaints about how we process your personal data to the Information Commissioner at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF telephone 0303 123 1113 or go to https://ico.org.uk/concerns/
   
8. What you should do if your personal information changes
   
   1. We are unable to service your membership of the Club effectively if we do not have up to date personal information.
   2. Members can normally log in to our online booking and membership system to update their personal information. Otherwise members, staff and suppliers should tell us if their personal information changes or they believe we have incorrect or incomplete information.
      

Please address any questions, comments and requests regarding our data processing practices to the Club’s Data Protection Manager who is best contacted by email addressed to dpmanager@sailfrensham.org.uk