Data Protection and Privacy Policy

The British Biathlon Union (BBU) is committed to protecting your privacy and security and ensuring you remain informed and in control of the information you supply to us. At BBU we are strongly committed to protecting your privacy and every reasonable effort is taken to ensure that your information is kept secure and intact.

This Privacy Notice will help you understand how we collect, use and protect your personal information, about the people who visit our website and give us their data over the phone, face-to-face, and in writing. This policy also states how and why we use data, how we store it and how individual personal preferences can be amended.

We, The BBU, are the ‘controllers’ of the information which we collect about you (‘personal data’). Being controllers of your personal data means we are responsible for how your data is processed. The word ‘process’ covers most things that can be done with personal data, including collection, storage, use and destruction of that data.

This notice explains why and how we process your data, and explains the rights you have around your data, including the right to access it, and to object to the way it is processed. Please see the section on ‘Your rights as a data subject’ for more information.

The BBU was formed in 1996 to deliver the Olympic Sport of Biathlon in Great Britain. (Company Number 03270191). The BBU is a full member of the International Biathlon Union (IBU), The British Olympic Association (BOA), National Olympic Committee (NOC) and UK Sport. It is a not for profit, membership based organisation, funded through membership, the IBU and wider donors.

 

Our contact details are:

Address: BBU, Kings Arms Vaults, Watton, Brecon, Powys, Wales, LD3 7EF

Email: info@britishbiathlon.com

Telephone number: 07508 015053

Our Data Compliance Officer (DCO) is Elizabeth Winfield , who you can contact at the address, phone number or email above if you have any queries about this notice or anything related to data protection.

The terms of this policy may change, so please check it from time to time. This version published on 30 March 2021, supersedes all previous versions.

The BBU as the Data Controller, is registered with the Office of the Information Commissioner under the General Data Protection Regulation (GDPR) registration no.APPLIED WAITING CONFIRMATION NUMBER TBC.

 

BBU Privacy Statement

GDPR provides the legal framework that defines how personal information can be used. The BBU is fully committed to complying with the principles set out in GDPR and has a legal duty to protect any information we collect from you. Please read this privacy policy to understand how we use your data. In summary:

• Only information that we need is collected.
  
  
• Your personal information is only used for the purpose for which we collect it.
  
  
• Your personal information is only seen by those who need it to do their jobs.
  
  
•  We will only disclose data when we have your consent, or where we are obliged to disclose personal data by law, or as expressly permitted under the GDPR (through contract; legal obligation, vital interests; public task; or legitimate interests).
  
  
• We will keep your information up to date. Inaccurate or misleading data will be corrected as soon as possible.
  
  
• Personal information is retained only for as long as it is required for the purpose collected; normally, this will be for a maximum of 6 years if we do not hear from you during this time. Unless there is a legal requirement to do otherwise, at the six year point, we will take steps to remove your information from our records.
  
  
• Your information will be protected from unauthorised or accidental disclosure and processed in an appropriate manner to maintain its integrity and confidentiality.
  
  
• We will provide you with a copy of your personal information on request (please see below for information on access rights and requests).

These principles apply whether we hold your information on paper or in electronic form.

 

What information do we collect about you?

We are committed to protecting all your personal data, and we only process data if we need to for a specific purpose, as explained below.

We collect your personal data mostly through our contact with you, and the data is usually provided by you, but in some instances we may receive data about you from other people/organisations.

Personal Data is any information that relates to a living, identifiable person. This can include your name, address, age, date of birth, gender, contact details, passport details, and if applicable, bank account details.

For monitoring purposes this can also include ‘special categories’ of data, which is information about a person’s race or ethnic origin, religious, political or other beliefs, physical or mental health, or sexual orientation. The collection and use of these types of data is subject to strict controls and will only be held with your explicit consent.

We also gather general non-personal information about the use of our website, such as which pages users visit most often, and which are of most interest. We may also track which pages users visit when they click on links in BBU emails. Wherever possible we use aggregated or anonymous information which does not identify individual visitors to our website. Please see the section below on Cookies.

If you are a sponsor we will collect financial information (direct debit/standing order details) and company information.

How do we use this information?

We will use the information you provide in the ways set out below:

• promote the objectives of BBU;
  
  
• to communicate with our members, dealing with your enquiries and requests, recording any contact with you;
  
  
• to provide you with information that you have indicated an interest in, for example information about our training camps and competitions;
  
  
• we may use this information to personalise the way our website is presented when users visit it, to make improvements to our website and to ensure we provide the best service for users;
  
  
• to conduct market research;
  
  
• Segmentation, so that we can offer members information relevant to them;
  for administrative purposes.

If you enter your contact details in one of our online registration forms, we may use this information to contact you even if you don’t “send” or “submit” the form. We will only do this to see if we can help with any problems you might be experiencing with the form or with our websites.

How and why we collect information about you?

How do we collect information?

If you provide services to the BBU, we will collect information in line with your contract for services.

We may also collect technical information relating to your use of our website, including your browser type or the Internet Protocol (IP) address used to connect your computer to the internet.

We obtain personal information from you when you enquire about our activities – including membership – register with us, send or receive an email, ask a question or otherwise provide us with personal information.
We will only ever collect the information that we need, including data that will be useful to help improve our services. The information is either needed to fulfill your request or to enable us to provide you with a more personalised service. You don’t have to disclose any of this information to browse our sites.

Why do we collect this information?

We collect this information for the purpose of promoting the aims of the Charity and communicating effectively and appropriately with our supporters and, in particular, providing support to our athletes / beneficiaries.

 

Legal basis for processing

The lawful basis for which we process your information is:

• your consent: the individual has given clear consent for us to process their personal data for a specific purpose.
  
  
• processing is necessary for the performance of a contract to which you are
  a party. If you fail to provide this information we may be unable to perform the contract;
• processing is necessary for compliance with our legal obligations, for example to comply with our obligations as an employer to disclose employee salary details to HMRC;
  
  
• processing is necessary to protect your interests or that of another person;
  
  
• processing is necessary for the performance of a task carried out in the public interest;
  
  
• processing is necessary for the purpose of the legitimate interest pursued by us or a third party, except where your rights as a data subject override our legitimate interest. The legitimate interest we rely upon is subject to an assessment based on the specific context and circumstances.
  
  
• the processing of data is necessary for us to perform a task in the public interest or for our official functions

 

Your rights as a data subject

In general terms, we process your data in order to manage our relationship with you by phone, email, in person, via our website and via third party organisations to:

• Carry out our obligations arising from any agreement entered into by you and us for the provision of information, advice and services to support you in your time with the BBU.
  
  
• Seek your views or comments on the services we provide
  
  
• Send you communications which you have requested
  
  
• Inform our future service developments to ensure they are fully accessible
  
  
• Monitor our work
  
  
• Comply with a legal or regulatory obligation
  
  
• When processing of data is necessary for the performance of a contract to which the data subject is party.
  
  

At times, we may further process data which we have already collected. We will only do this if the new purpose for processing it further is compatible with the original purpose that the data was collected for. We will tell you about any further processing before carrying it out.

You have a right to object to the BBU processing your personal information (‘right to object’) at any time where we rely on our legitimate interests for doing so. Such a request must be sent to the Data Compliance Officer at the above address.

You also have a right to object to our processing your data for the purposes of marketing. The BBU always acts upon your choices around what type of communications you want to receive and how you want to receive them. You have a choice about whether you want to receive information about the achievements and news of the BBU. We make it easy for you to tell us how you want us to communicate, in a way that suits you. Our forms have clear marketing preference questions; if you don’t want to hear from us then that’s fine. We will not use your personal information for marketing purposes if you have indicated that you do not wish to be contacted. You can change your marketing preferences for what you receive from us and how, at any time, by contacting the BBU. You have a right to ask us to confirm whether we are processing information about you, and to request access to this information (‘right of access’). We will ask you for proof of your identity before we can act upon your request.

To obtain a copy of the personal information we hold about you, please write to us.
You have a right to obtain your personal data from us and reuse it for your own purposes, perhaps for another service, without hindering the usability of the data (‘right of portability’). This right does not apply where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

You have a right to seek the erasure of your data (often referred to as the ‘right to be forgotten’). You may wish to exercise this right for any reason, for example where it is no longer necessary for us to continue holding or processing your personal data you may withdraw your consent. You should note that we are entitled to and reserve the right to retain your data for statistical purposes. This right is not absolute, as we may need to continue processing this information, for example, to comply with our legal obligations, or for reasons of public interest.

We want to ensure you remain in control of your personal information. Part of this is making sure you understand your legal rights. As a data subject, you have the following rights in relation to your personal data processed by us:

• To be informed about how your data is handled;
  
  
•  To gain access to your personal data;
  
  
•  To have errors or inaccuracies in your data changed;
  
  
•  To have your personal data erased, in limited circumstances;
  
  
• To object to the processing of your personal data for marketing purposes or when
  the processing is based on the public interest or other legitimate interests;
  
  
•  To restrict the processing of your personal data, in limited circumstances if:
  
  –  you contest its accuracy and we need to verify whether it is accurate
  
  –  the processing is unlawful and you ask us to restrict use of it instead of erasing it
  
  –  we no longer need the information for the purpose of processing, but you need it to establish or defend legal claims
  
  –  you have objected to processing of your information being necessary for the performance of a task carried out in the public interest, or for the purposes of our legitimate interests. The restriction would apply while we carry out a balancing act between your rights and our legitimate interests.
  
  –  you exercise your right to restrict processing, we would still need to process your information for the purpose of exercising or defending legal claims, protecting the rights of another person or for public interest reasons.

• To obtain a copy of some of your data in a commonly used electronic form, in
  limited circumstances;
  
  
• Rights around how you are affected by any profiling or automated decisions.

You may ask us, or we may ask you, to rectify information you or we think is inaccurate, and you may also ask us to remove information which is inaccurate or complete information which is incomplete (‘right to rectification’). If you inform us that your personal data is inaccurate, we will inform relevant third parties with whom we have shared your data so they may update their own records. If your personal details change, please help us to keep your information up to date by notifying us at the email address below: info@britishbiathlon.com

If you would like to exercise any of your rights above, please contact the DCO at our address, unless we have provided specific contact details in respect of one of the rights we have set out. We will act in accordance with your instructions as soon as reasonably possible and there will be no charge.

You have a right to report any of your concerns about our use of your data to the Information Commissioner’s Office. You may do so by calling their helpline at; 0303 123 1113.

 

Withdrawing consent

If we are relying on your consent to process your data, you may withdraw you consent
at any time.

 

Personal data received from third parties

This is a list of your personal data that we may receive from other people or organisations. This data will only be passed onto us with your consent.

 

Source

• IBU
  
  
• BOA
  
  
• UK Sport
  
  
• UKAD
  
  
• Club
  
  
• Friend or family member

 

Data

The personal information we collect from other people or organisations could include your name, address, age, date of birth, gender, contact details and if applicable.

For monitoring purposes this can also include ‘special categories’ of data, which is information about a person’s race or ethnic origin, religious, political or other beliefs, physical or mental health, or sexual orientation.

 

Who we share your data with

We share your personal information with our members, wider sports body, sponsors and internal management team, who we engage to process data on our behalf. In such cases information is only shared for the purpose of providing services on our behalf relating to communications, or agreements between yourself and the BBU. Such processing is conducted under relevant Data Processing Agreements.

We also may need to disclose your information if required to do so by law or as expressly permitted under applicable data protection legislation.

We do not sell personal details to other charities or other third parties.

Our website may include links to websites run by other organisations. The BBU is not responsible for the privacy practices of these other websites so you should read their privacy policies carefully before sharing any personal or financial data.

For some processing purposes we share your data with third parties. We will never sell your personal data. This is a list of the information we may share with external recipients, and for what purpose:

Recipients of your data

• International Biathlon Union where applicable for race entry and classification
  
  
• British Olympic Association where applicable for race entry and classification
  
  
• UK Anti-Doping to provide training and education.

Purpose for sharing

The information we may share with third parties will include your name, address, age, date of birth, gender, contact details and if applicable, details of your designated NOK. For monitoring purposes this can also include ‘special categories’ of data, which is information about a person’s race or ethnic origin, religious, political or other beliefs, physical or mental health, or sexual orientation.

Name and address to post a copy or our newsletter, kit and equipment.

How we store your data

We recognise the concerns that many people have about giving personal information online. We place great importance on the security of all personally identifiable information associated with our athletes, members, sponsors and staff. We have security measures in place to protect against the loss, misuse and alteration or destruction of personal data under our control. Information is stored by us on computers located in the UK – in electronic formats. We may also store information on paper files.

All of our online forms are protected. We also use a secure server where you can make payment via our website.

Electronic data, including emails, is stored on secure servers which are located in the UK. However, no data transmission over the internet is 100% secure. As a result, whilst we cannot absolutely guarantee that loss, misuse or alteration of data will not occur while it is under our control, we use our best efforts to prevent this and protect your personal information.

How long we keep your data

The BBU takes appropriate actions to make sure that the data we hold about you, whether that is on paper or electronically in a computer file or database, is stored securely. We will only hold this data for as long as it is necessary for the purposes for which it is provided to us. We will dispose of unnecessary personal data using secure deletion methods (electronic) or shredding. We will contact you periodically (at least every 3 years) to confirm that the data we hold about you is accurate and up-to-date and that we may continue to contact you. We will then update our records accordingly.

A copy of our retention schedule is available on request.

 

Transfer of Information Outside of the EU

Given that the Internet is a global environment, using it to collect and process personal data necessarily involves the transmission of data on an international basis. This means for instance that data you pass to us may be processed outside the European Economic Area, although the data will always be held securely and we will take steps to ensure that any third-party organisation we engage to process data on our behalf provides an adequate level of protection in accordance with GDPR. By submitting your personal information, you agree to this transfer, storing or processing at a location outside the EEA.

 

Exercising your rights, queries and complaints

For more information on your rights, if you wish to exercise any right or for any queries you may have or if you wish to make a complaint, please contact our Data Compliance Officer: info@britishbiathlon.com

Feedback and complaints may also be sent by email to the DCO email or by phone or
to a member of staff. You can contact us for a copy of our complaints procedure or visit
our website.

 

Cookie Usage

The BBU website uses cookies, tracking pixels and related technologies. Cookies are small data files that are served by our platform and stored on your device. Our site uses cookies dropped by us or third parties for a variety of purposes including to operate and personalise the website and to ensure you see content that is relevant to you. Cookies help us to provide you with a better experience by allowing us to understand what areas of the website are of interest to our visitors (e.g. via Google analytics).

Most browsers will allow you to turn off cookies. Please note however that turning off cookies will restrict your use of our website. To learn more about cookies and how to manage them, visit AboutCookies.org.

 

ICO, Data Protection Act 2018 and GDPR

We have registered with the Information Commissioner’s Office (ICO) and adhere to the following principles:

• Access to your information is restricted to our relevant trained staff and volunteers only;
  
  
• Where any hard copies are created, the hard copies of your information and confidential documents are kept securely
  
  
• All our relevant employees and volunteers have received training in how to handle your information. This includes ensuring they are aware of the importance of handling your information safely and securely, and understanding the procedures in place to ensure this happens
  
  
• We will periodically evaluate our database and securely delete any contacts no longer engaged or any information no longer needed by us
  
  
• We have measures in place to keep your information safe and secure. Trademarks and copyright

The BBU website contains material which is protected by copyright and/or other intellectual property rights. All copyright and intellectual property rights including the names, images and logos are owned by The BBU unless otherwise stated. All rights are reserved.

You are responsible for complying with all applicable copyright laws. We permit you to make copies of information on The BBU website as necessary incidental acts during your viewing and you may take a print for your personal use of so much of the site as is reasonable for private purposes. All other uses are prohibited. Nothing in these terms shall be construed as conferring any right to use any trademark, logo, patent right or copyright of the BBU.

 

Complaints to the Information Commissioner

You have a right to complain to the ICO about the way in which we process your personal data. You can make a complaint on the ICO’s website and further information and advice about data protection is available from:

The Office of the Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Tel: +44 (0) 01625 545 745
Website: www.ico.org.uk

 

Data Protection Frequently Asked Questions

Who is responsible for my personal information?

The BBU is the Data Controller for any personal information that you submit to us. This means that we are responsible for the safety of your personal information. We may need to disclose your information to third parties, such as data processors, mailing houses, and data bureaus who are required to adhere to our rules on data protection. As the Data Controller, we have a duty of care to ensure that our employees, our volunteers and those acting on our behalf, respect your right to confidentiality and ensure that your personal information is only used for the purpose for which it was provided.

How is my personal information stored?

Your information is held confidentially on paper or in secure computer files. We have taken steps to ensure that our systems and procedures prevent unauthorised access and unlawful disclosure. For more detail about how we keep your date secure, please refer to our privacy policy.

Why does The BBU process personal data?

We need to process personal data for race entry, communications, to deliver events and for administration. For a more detailed description about the purposes for which we process your data, please refer to our privacy policy.

Do I have the right to see personal data that the BBU holds about me?

Yes. This is an important right that you have under the General Data Protection Regulation (‘GDPR’). You are entitled to ask us whether we hold any personal information about you and, if we do, to be told what it is used for. You are also entitled to know whether we have disclosed your information to any other persons or organisations and to receive a copy of the information we hold about you.

Is there any part of my personal information that I am not entitled to see?

You are normally entitled to see any information that we hold about you, with some specific exceptions. For example, you are not normally entitled to personal information that contains details about someone else, unless the person in question has given their permission to disclose this information about themselves.

How can I apply for Subject Access?

You must contact us in writing (which includes email) to request a copy of any personal information we may hold about you. However, we will not be able to release any personal information until we are satisfied about your identity and current address. You will need to provide us with enough information to enable us to confirm these details.

We will respond to your request within 30 days of receiving a completed application form.