Scottish Endurance Riding Club

Data Protection Policy

Our data protection policy sets out our commitment to protecting personal data and how we implement that commitment with regards to the collection and use of personal data.

We are committed to:

• Ensuring that we comply with the eight data protection principles, as listed below
• Meeting our legal obligations as laid down by the General Data Protection Regulation {GDPR} May 2018 which seeks to protect and enhance the rights of EU data subjects.  These rights cover the safeguarding of personal data, protection against the unlawful processing of personal data and the unrestricted movement of personal data within the EU and its storage within the EEA.
• Ensuring that data is collected and used fairly and lawfully
• Processing personal data only in order to meet our operational needs or fulfil legal requirements
• Taking steps to ensure that personal data is up to date and accurate
• Establishing appropriate retention periods for personal data
• Establishing that data subjects’ rights can be appropriately exercised
• Providing adequate security measures to protect personal data
• Ensuring that a nominated club officer is responsible for data protection compliance and provides a point of contact for all data protection issues
• Ensuring that all club/branch officers are made aware of good practice in data protection
• Ensuring that everyone handling personal data knows where to find further guidance
• Ensuring that queries about data protection, internal and external to the organisation, are dealt with effectively and promptly
• Regularly reviewing data protection procedures and guidelines within the club

  Data Protection Principles

 The Data Protection Act states that those who record and process personal information must be open about how the information is used and must follow the eight principles of ‘good information handling’.

These principles are:

1. Personal data shall be processed fairly and lawfully
2. Personal data shall be obtained for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes
3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed
4. Personal data shall be accurate and, where necessary, kept up to date
5. Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or purposes
6. Consent – through agreeing this privacy notice/policy you are consenting to Scottish Endurance Riding club processing your personal date for the purposes outlined.  You can withdraw consent at any time by using the postal, email address or telephone number provided at the end of this Privacy Notice/Policy
7. Disclosure – Scottish Endurance Riding Club will keep your personal information safe and secure, only our administration team will have access to your contact details. Scottish Endurance Riding Club will not disclose your Personal Information unless compelled to, in order to meet legal obligations, regulations or valid governmental requests. The Club may also enforce its rules and constitution, including investigating potential violations of its rules and constitution to detect, prevent or mitigate fraud or security or technical issues; or to protect against imminent harm to the rights, property or safety of its members.
8. Retention – Scottish Endurance Riding Club will process personal data during the duration of membership of the Club and will continue to store only the personal data needed for 8 years after membership has expired to meet legal obligations.  After 8 years all personal data will be deleted, unless basic information needs to be retained by the Club to meet its future obligations to you, such as erasure details.  Records concerning minors to have been members of the Club will be retained until the child has reached the age of 25.
9. Personal data shall be processed in accordance with the rights of data subjects under the General Data Protection Regulation [GDPR] May 2018
10. Appropriate technical and organisational measures shall be taken against unauthorised and unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data
11. Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal date.

By law, data controllers, including Scottish Endurance Riding Club, must keep to these principles.

If you believe in any way that Scottish Endurance Riding Club is not processing your personal data in accordance with these principles, please contact Scottish Endurance Riding Club’s General Secretary. 

How does Scottish Endurance Riding Club collect data?

There are several means by which Scottish Endurance Riding Club collects personally identifiable data, for example:

• Through membership application
• Through a ride entry
• Acceptance for inclusion on a mailing list or database
• For research, surveys or monitoring purposes
• By entering into email or telephone correspondence with an official of Scottish Endurance Riding Club

All personally identifiable information provided to Scottish Endurance Riding Club is processed in accordance with the principles of the General Data Protection Regulation [GDPR] May 2018.

Data storage

All data is held in the United Kingdom.

Is information passed to third parties?

It is Scottish Endurance Riding Club policy to only disclose information to third parties if explicitly required to do so by United Kingdom Law.

Scottish Endurance Riding Club will obtain your consent before passing on any information to any third parties.

Scottish Endurance Riding Club does not collect or compile personally identifying information for dissemination or sale to external parties for marketing purposes or host mailings on behalf of third parties.

Your Rights as a data subject

At any point whilst Scottish Endurance Riding Club are in possession of, or processing your personal date, all data subjects have the following rights:

Right of access – you have the right to request a copy of the information that we hold about you.

Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.

Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.

Right to restriction of processing – where certain conditions apply you have a right to restrict the processing.

Right of portability – you have the right to have the data we hold about you transferred to another organisation.

Right to object – you have the right to object to certain types of processing such as direct marketing.

Right to object to automated processing, including profiling – you also have the right not to be subject to the legal effects of automated processing or profiling.

In the event that Scottish Endurance Riding Club refuses your request under rights of access, we will provide you with a reason as to why, which you have the right to legally challenge.  At your request Scottish Endurance Riding Club can confirm what information it holds about you and how it is processed.

  You can request the following information

•   Identity and the contact details of the person or organisation Scottish Endurance Riding Club that has determined how and why to process your data.

• Contact details of the data protection officer, where applicable.
• The purpose of the processing as well as the legal basis for processing.
• If the processing is based on the legitimate interests of Scottish Endurance Riding Club and information about these interests.
• The categories of personal data collected, stored and processed.
• Recipient(s) or categories of recipients that the data is/will be disclosed to.
• How long the data will be stored.
• Details of your rights to correct, erasure, restrict or object to such processing.
• Information about your right to withdraw consent at any time.
• How to lodge a complaint with the supervisory authority (ICO).
• Whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the personal data and the possible consequences of failing to provide such data.
• The source of personal data if it wasn’t collected directly from you.
• Any details and information of automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.

Access to personal information?

Scottish Endurance Riding Club tries to be as open as it can be in terms of giving people access to their personal information.  You can find out if we hold any personal information about you by making a ‘subject access request’ under the Data Protection Act 1998.  Make your request, in writing, to the Club General Secretary.

Your request should include details and provide documented evidence of who you are [e.g. driving licence, passport, birth certificate]. You should also provide as much detail as possible regarding the information you wish to access [e.g. where and by whom information is believed to be held, specific details of information required etc.].

You are not required to state WHY you wish to access the information but you should include any details which will help us locate and retrieve the information.

Scottish Endurance Riding Club adopts a general policy of openness in terms of allowing individuals access to their personal information and wherever possible we aim to waive the £10 administration fee (permitted under the Data Protection Act 1998).

If we do hold information about you we will:

• give you a description of it
• tell you why we are holding it
• tell you who it could be disclosed to
• let you have a copy of the information in an intelligible form

All efforts will be made to provide you with a response within 40 calendar days. In any event, you will receive all the information that has been located and can be released within 40 days and an explanation for any information that cannot be provided at that time.

Complaints

In the event that you wish to make a complaint about how your personal data is being processed by Scottish Endurance Riding Club you have the right to complain to us.  If you do not get a response within 30 days, you can complain to the ICO.

Complaints should be addressed to the Chairman of Scottish Endurance Riding Club.  Details can be found on the website – www.scottishendurance.com