Privacy & data protection

Last updated: October 2026

This policy sets out how City of Preston Triathlon Club for Juniors (the “Club”, “we”, “us”) collects, uses and protects personal data in line with the UK GDPR, the Data Protection Act 2018 and all other applicable data protection legislation in force from time to time.

For the purposes of that legislation the Club is a data controller. This means we decide how your personal data is processed and for what purposes. You can contact us about anything in this policy at cityofprestontriclub@gmail.com.

Key terms

• Your data means the personal data of you and/or your child (as appropriate).
• Personal data is information relating to an identifiable individual, such as names, contact details, dates of birth and photographs.
• Special category data is sensitive data such as medical records, health conditions and safeguarding information, which needs additional legal protection under Article 9 of the UK GDPR.
• Data processor means any third party processing personal data on behalf of the Club (for example registration platforms or governing bodies).
• Child means any individual under the age of 18.
• Consent is explicit permission for processing personal data. Parental or guardian consent is required for children under 13, unless a lawful exemption applies.

1. What personal data we collect

We may collect, use and store the following personal data about you and/or your child:

• Identity and contact details: name, date of birth, gender, email address, postal address and telephone numbers.
• Membership and emergency details: emergency contact names and phone numbers.
• Qualification details: details of any coaching qualifications you hold.
• Special category data: relevant medical conditions, health information, injuries or dietary requirements disclosed for training, racing, other events or welfare and safety.
• Financial data: records of membership fee payments or event entry fees. Bank details are typically processed by secure third-party platforms such as Stripe, GoCardless, or the British Triathlon or England Athletics platforms, not by the Club.
• Participation data: training attendance, records of athletic performance during training, race results and event entries.
• Images: photographs or videos captured during club events or training, subject to consent having been obtained.

2. How we collect your data

We collect data when you or your child:

• register or renew membership with the Club (for example through Spond or any other membership or communications platform);
• sign up for training sessions, coached swims or club-organised races; or
• communicate with us by email, social media or through our website.

3. Lawful basis for processing your data

We process your data under the following lawful bases:

• Parental consent (children under 13). Parental or guardian consent is required for processing the personal data of children under 13. Consent is verified through secure mechanisms, such as signed consent forms or authenticated digital platforms.
• Legitimate interests (children aged 13 and over). We may rely on legitimate interests for processing involving children aged 13 or older, such as scheduling training, managing memberships and safeguarding, and we make sure this processing does not override the child’s rights or freedoms. We also rely on legitimate interests for managing club communications, internal administration and organising club activities.
• Consent. Where we ask for your explicit permission to use your data, for example to publish race photos on our website or social media accounts, or to send direct marketing.
• Vital interests and legal obligations. Processing sensitive medical data in an emergency, or complying with safeguarding and insurance requirements through British Triathlon.

4. How we store and protect your data

• Digital security: data is stored on password-protected cloud platforms, restricted membership databases (Spond, Google Drive) or encrypted devices. Access to personal data is limited to trained personnel directly involved in delivering club services, such as coaches, officials and safeguarding officers.
• Physical security: any paper forms (such as emergency contact or medical sheets at training sessions) are kept in a locked container or held only by the Chair, and destroyed securely when no longer needed.
• Data retention: we keep your personal data only as long as necessary to run the Club and meet statutory and insurance obligations. This is typically up to 3 years after membership lapses, unless a longer period is required for insurance or legal claims.

5. Sharing your data

We will never sell or rent your data to third parties. We may share data with:

• Home nation governing bodies: British Triathlon, Triathlon England, Triathlon Scotland, Welsh Triathlon or England Athletics, for insurance and membership verification or to register for competitions and events.
• Coaches and session organisers: limited emergency and medical information, shared strictly on a need-to-know basis for training safety.
• Service providers: IT, communication or event management platforms used to run the Club, such as Spond. Each provider processes data in accordance with its own privacy policy, for which the Club is not responsible.
• Emergency services, local authorities or child protection services: in the event of welfare concerns or health and safety incidents, or if required by law.

6. Your rights

Under applicable data protection legislation, children (as appropriate) and their parents or guardians have the right to:

• access a copy of the personal data the Club holds (a subject access request);
• correct or update inaccurate personal data;
• ask for your data to be erased (the “right to be forgotten”), where applicable;
• restrict or object to the processing of your data; and
• withdraw consent at any time, where we rely on consent to process your data.

To exercise any of these rights, please contact cityofprestontriclub@gmail.com.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, if you feel your data has been handled incorrectly. See ico.org.uk.

7. Responding to a data breach

If a breach involves personal data, the Chair and the Welfare Officer will coordinate immediate containment measures. Affected parties, including parents and guardians, will be notified within 72 hours, with details of the breach, the risks and the action being taken. Breaches will be reported to the ICO where there is significant potential for harm.

8. This website

Our website is a static information site. It has no accounts, no comment forms and no analytics, and it sets no cookies of its own (see our cookies page). When you visit:

• our hosting provider (Amazon Web Services) processes standard technical data such as your IP address and browser details in server logs, to deliver the site and keep it secure;
• your browser loads fonts from Google Fonts, which means Google receives your IP address; and
• if you follow the link to our Training Interest form, you leave our site and the form is run by Google Forms. Information you enter is held in the Club’s Google account and used only to arrange a taster session, not for marketing.

If you email us we use your address and message only to reply to you.

9. Changes to this policy

We may update this policy from time to time. The date at the top of the page shows when it was last changed.