Data Protection Policy
V1.2 [Updated 1/1/2019]
GDPR came into force on the 25th May 2018, it gives increased privacy rights to individuals whose data is being collected.
Ultimate Cheer is committed to a policy of protecting the rights and privacy of individuals, members, volunteers staff and others in accordance with The Data Protection Act 1998. The policy applies to all voluntary, members and staff at Ultimate Cheer.
Data are protected by the Data Protection Act 1998, which came into effect on 1 March 2000. Its purpose is to protect the rights and privacy of individuals and to ensure that personal data are not processed without their knowledge, and, wherever possible, is processed without their consent.
The Act requires us to register the fact that we hold personal data and to acknowledge the right of ‘subject access’ – voluntary and Ultimate Cheer members and staff must have the right to copies of their own data.
Requests can be made by emailing email@example.com
Purpose of data held by the Community Association
Data may be held by us for the following purposes:
There are many reasons why Ultimate Cheer will need to store members personal data.
- Ultimate Cheer will need to take register of all members that attend each session for safety reasons.
- We will also need all member to fill out an emergency contact form which will be kept on file for the duration of your time at Ultimate Cheer, and destroyed after one year of non-membership.
- Your details will also be registered with each event we attend purely for the event providers to know who is attending and which age category you fall into, the information they will need is minimal.
- Ultimate Cheer will also ask permission to take photographs and videos for the website, social media and also promotional materials such as flyers and posters.
- Ultimate Cheer will need to keep in touch with members or their guardians for example via email or whatsapp, in order to organise team training and events
- Ultimate Cheer may store personal data provided by prospective new members for communication purposes for example, regarding becoming a member of the club
- Data Protection Principles
In terms of the Data Protection Act 1998, we are the ‘data controller’, and as such determine the purpose for which, and the manner in which, any personal data are, or are to be, processed. We must ensure that we have:
- Fairly and lawfully processed personal data
We will state our intentions on processing the data and state if, and to whom, we intend to give the personal data.
- Processed for limited purpose
We will not use data for a purpose other than those agreed by data subjects (prospective members, members, staff and others). If the data held by us are requested by external organisations for any reason, this will only be passed if data subjects (prospective members, members, staff and others) agree. Also external organisations must state the purpose of processing and abide by The Data Protection Act 1998.
- Adequate, relevant and not excessive
Ultimate Cheer will monitor the data held for our purposes, ensuring we hold neither too much nor too little data in respect of the individuals about whom the data are held. If data given or obtained are excessive for such purpose, they will be immediately deleted or destroyed.
- Accurate and up-to-date
We may ask members to complete forms from year-to-year in order to maintain accurate and up-to-date records. All amendments will be made immediately, and data no longer required will be deleted or destroyed. It is the responsibility of individuals and organisations to ensure the data held by us are accurate and up-to-date. Completion of an appropriate form (provided by us) will be taken as an indication that the data contained are accurate. Individuals should notify us of any changes, to enable personnel records to be updated accordingly. It is the responsibility of the Association to act upon notification of changes to data, amending them where relevant.
- Not kept longer than necessary
We discourage the retention of data for longer than it is required. All personal data will be deleted or destroyed by us after one year of non membership has elapsed. Member medical records will be kept for up to 3 years after the member has left and will then be destroyed.
Data collected from prospective new members is kept private and stored securely until a time it is no longer required or has no use.
- Processed in accordance with the individual’s rights
All individuals that the Association hold data on have the right to:
- Be informed upon the request of all the information held about them
- Prevent the processing of their data for the purpose of direct marketing.
- The removal and correction of any inaccurate data about them.
Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of data.
All electronic data is password protected. Data provided on paper will be electronically uploaded then destroyed.
- Not transferred to countries outside the European Economic Area, unless the country has adequate protection for the individual.
Data must not be transferred to countries outside the European Economic Area without the explicit consent of the individual.
- Processing Data
GDPR requires Ultimate Cheer to document why we need to lawfully process people’s data. This includes the information we keep, what it is being used for and our reasons for needing it.
We have the following reasons for processing people’s data –
- Legal - we have the following legal obligations for processing data which include but are not limited to health and safety, insurance and child protection.
- Contractual - which allows Ultimate Cheer to provide members with the services associated with our programme such as sending requests for payment, registers, and entrance to events.
- Legitimate interests – which is when the processing is necessary for the Ultimate Cheer’s legitimate interests such as but not limited to marketing.
- Consent – Is when the individual has given clear consent for you to process their personal data for a specific purpose. For example taking photographs for the Ultimate Cheer website.
Data collected by prospective members, members, parents/guardians includes the following:
- Name, address, date of birth, gender, telephone numbers, next of kin details and email address.
- Family Doctors details.
- Health Records
- Pre-existing medical conditions.
- Ongoing medical conditions
- Any medication currently being taken.
- Various communications where members may be mentioned by name.
- Emails, text, phone calls, post.
- Individual progress monitored via progress trackers.
- Records of Financial Transactions that have taken place.
- IP address
The reasons for needing the above information is covered in section B under Processing Data. The data will be collected directly from members, parents/guardians. The data collected will be shared with staff at Ultimate Cheer, Event Providers and Hotels at which the team will be staying at for competitions. Members/guardians contact details may be shared with other members/guardians for communication purposes, for example being added to team social media groups/pages. Photographs taken, and/or footage filmed during practices and performances may be shared with other members/guardians in social media groups/pages, for example a team whatsapp group.
- I can confirm that I have read and understood why Ultimate Cheer has to process certain types of date.
- I can confirm I understand who this data will be shared with and the reasons for sharing this data.
- I understand that I also have right to withdraw consent at any time by outlining my request in an email to the Data Controller.