Active Cheshire Privacy Policy

Active Cheshire (“us” or “our”) is committed to complying with data protection law and to respecting the privacy rights of individuals. This policy applies to all of our staff, workers, directors, volunteers and consultants (“Workers”)., as well as to our online properties/websites and all products and services offered by Active Cheshire.

First formed in 1989, Active Cheshire now take a whole system approach to work with a diverse range of organisations to have a positive impact in all walks of life; ensuring people can embed activity into all aspects of everyday life – at home, school, in the workplace and everywhere in between.

Active Cheshire’s maxim is to inspire and engage to encourage greater collaboration and coordination between partners to tackle physical inactivity locally. We want to encourage a change in the behaviour of local people of all ages, enabling physical activity to become part of their everyday habit.

We champion and support a range of simple affordable and fun interventions including active travel, workplace health, school sport and community games.

Active Cheshire is all about working with everyone who delivers opportunities directly to local people, driven by local needs and ambition. We are here to support, as well as providing insight, brokerage, knowledge and expertise to anyone working in physical activity and sport in Cheshire and Warrington.

This Policy set outs our commitments to you, in compliance with and beyond the General Data Protection Regulation (commonly known as the GDPR) and explains how we collect, store and use your personal information.

We have appointed a Data Protection Officer (Steve Densley) who has overall responsibility for data protection compliance in our organisation. If you have any questions about this Policy or what we do with your personal information, their contact details are set out in the “Contact” section below.

PERSONAL IDENTIFICATION INFORMATION

The type of information we collect.

This will vary dependent on the purpose of the collected information. We may collect anonymised information by simply asking for gender and age range. We may also ask for personal identifiers, contacts and characteristics (for example, name and contact details) and other information classed as personal or sensitive data for specific projects. We treat the security of all data sets in compliance with the GDPR.

How we get the personal information and why we have it

We may collect personal identification information from Users in a variety of ways, including, but not limited to –

• Users visiting our website,
• Subscribing to the newsletter,
• Responding to a survey,
• Filling out a form,
• Taking part in an Active Cheshire event (including still and video images)

We may also collect information in connection with other activities, services, features or resources we make available on our website and generally through our work and the work of those funded through us. We will collect personal identification information from Users only if they provide consent and voluntarily submit such information to us. Users can always refuse to supply personal identification information, except that it may prevent them from engaging in certain related activities. Users may visit our website anonymously.

Collecting specific, relevant personal information is a necessary part of us being able to provide you with any services you may request from us or in providing services to our customers and members or just managing our relationship with you. We may also from time to time conduct research and surveys to better understand the efficacy of the services we provide directly or through funding

When we hold or use your personal information as a data controller (see below for a description of what this is) we will always obtain consent and will if necessary provide you with an additional privacy notice which sets out in detail what information we will collect and hold about you (such as your contact details, address, etc.), how your personal information may be used and the reasons for these uses, together with details of your rights.

Where we collect personal information from you directly, we will provide this privacy notice at the time we collect the personal information from you. Where we receive your personal information indirectly, we will provide this privacy notice when we first contact you, first pass the data to someone else or within a month, whichever is the earlier.

We will only provide this privacy notice to you once, generally at the start of our relationship with you. However if the applicable privacy notice is updated substantially, then we may provide you with details of the updated version. You are encouraged to check back regularly for updates.

We may share your information with Sport England or with other parties as part of our work to increase physical activity and analyse the impact of our activities. In most cases the data we share will by anonymised (eg gender and age group) however further information including (but not limited to)

• Name and address
• Age
• Photos or Video footage (Which may be shared on social media or on our website)
• Information of a personal/medical nature which is relevant to participation in a particular activity
• Race
• Gender

may be collected. In such cases we will always obtain your consent before sharing data.

You are able to withdraw consent at any time or ask that data be updated or removed by emailing support@activecheshire.org

Collecting information from or about Minors or Vulnerable Adults

Data relating to individuals under the age of 18 or those with additional needs can be particularly sensitive. We will always obtain parental/guardian consent before collecting or processing personal or sensitive data relating to any such individuals (including still and video images). We have written a “child friendly” version of our privacy policy to help explain this to minors, vulnerable adults or those with additional needs.

Photography & Videography

During events organised by or in association with Active Cheshire we may take video and still images for use on social media. We will obtain permission from the relevant parties before sharing this. In the case of a school this may be a global permission for an entire class or year group that has been obtained by the school. When we are planning an event with a customer – whether that be a school, college, community group or a business we utilise an Events Manual signed by all involved which includes this Privacy Notice. We will not take still or video images of participants without permission. There may be occasions during larger events where members of the public may be in attendance. In such cases Active Cheshire photographers will wear suitable identification and a photography notice will be published and posted around the event to ensure attendees can ask that their images are not captured.

HOW DO WE USE YOUR PERSONAL INFORMATION?

We will use your personal information as described in this privacy policy and/or in the privacy notice provided to you. We may use your personal information to administer any account(s) you have with us or to send you information we think you might find useful, provided you have indicated that you are happy to be contacted for these purposes (consent). We may also use information gathered from surveys and activities to further our research into the benefits of Physical Activity or to help improve our services.

To fulfil our contractual needs

As a charity we frequently receive funding from external organisations to deliver projects in our area. These projects may come with legally binding clauses that require us to share participants data with the relevant funding body. In many cases this may be anonymised as described above.

NON-PERSONAL IDENTIFICATION INFORMATION

We may collect non-personal identification information about subjects involved in our projects or as part of research and community engagement. This information may include such things as gender and age group but would not be sufficient to identify an individual.

How we use collected information

Active Cheshire may collect and use Users’ personal information for the following purposes:

• To improve customer service
• Information you provide helps us respond to your customer service requests and support needs more efficiently.
• To personalise user experience

We may use information in the aggregate to understand how our Users as a group use the services we provide to the community and resources provided on our Site.

• To improve our Site
• We may use feedback you provide to improve our products and services.
• To run a promotion, contest, survey or other Site feature
• To send Users information they agreed to receive about topics we think will be of interest to them.
• To send periodic emails

We may use the email address to respond to their inquiries, questions, and/or other requests. If User decides to opt-in to our mailing list, they will receive emails that may include company news, updates, related product or service information, etc. If at any time the User would like to unsubscribe from receiving future emails, we include detailed unsubscribe instructions at the bottom of each email or User may contact us via our Site.

How we protect your information

We adopt appropriate data collection, storage and processing practices and security measures to protect against unauthorized access, alteration, disclosure or destruction of your personal information, username, password, transaction information and data stored on our Site. We obtain GDPR statements and/or policies from suppliers that we use to store data such as Microsoft SharePoint and Salesforce CRM.

THE DIFFERENCE BETWEEN DATA CONTROLLERS/PROCESSORS

A data controller is a person who controls how personal information is processed and used. A data processor is a person who processes and uses personal information in accordance with the instructions of a third party, i.e. the data controller.

This distinction is important. You have certain rights in relation to your personal information, for example the right to be provided with the personal information held about you and details of its use and the right to have certain of your personal information either erased or anonymised, commonly referred to as the right to be forgotten (see below to see what rights you have). These rights can generally only be exercised against a data controller of your information.

In most cases we will be a data controller of your personal information. In any case where we are not a data controller this means that you cannot exercise these rights against us directly (i.e. where we only act as a data processor), but you can do so against the data controller (i.e. the person who controls how we process the personal information). In these cases we will endeavour to inform you who is the data controller of your personal information so that you can direct any such requests to them.

Also it is only a data controller that will provide you with a privacy notice about your personal information, so where we process your personal information as a data controller we will provide you with a privacy notice. Where we process your personal information as a data processor for a third party, that third party should provide you with a privacy notice which will set out details regarding the processing of your personal information, which should also include the processing to be carried out by us on their behalf

SECURITY

We employ a variety of technical and organisational measures to keep your personal information safe and to prevent unauthorised access to, or use, or disclosure of it. Unfortunately, no information transmission over the Internet is guaranteed 100% secure nor is any storage of information always 100% secure, but we do take all appropriate steps to protect the security of your personal information.

Sharing your personal information

We do not sell, trade, or rent Users personal identification information to others. We may share generic aggregated demographic information not linked to any personal identification information regarding visitors and users with our business partners, trusted affiliates and advertisers for the purposes outlined above. We may use third party service providers to help us operate our business and the Site or administer activities on our behalf, such as sending out newsletters or surveys. We may share your information with these third parties for those limited purposes provided that you have given us your permission.

Details of how we disclose your personal information are set out in the relevant privacy notice provided to you, but generally it is where we need to do so in order to run our organisation (e.g. where other people process information for us). In such circumstances, we will put in place arrangements to protect your personal information. Outside of that we do not disclose your personal information unless we are required to do so by law.

If we transfer personal information about you outside the European Economic Area (EEA), for example to the World Health Organisation as part of a global research program, we will let you know and ensure that all reasonable security measures are taken and that any third party processers will be required to process the information in accordance with information protection laws and we will notify you in your privacy notice if we are the information controller.

We do not sell, trade or rent your personal information to others.

HOW LONG DO WE HOLD ON TO YOUR PERSONAL INFORMATION?

Further details of how long we hold onto your personal information for are set out in the relevant privacy notice provided to you, but we will only hold your information for as long as is necessary or where you ask us to delete records we may delete it earlier.

The duration for which we retain your personal information will differ depending on the type of information and the reason why it was collected. However, in some cases personal information may be retained on a long term basis: for example, personal information that we need to retain for legal purposes will normally be retained for at least six years in accordance with usual commercial practice and regulatory requirements.

WEBSITE PRIVACY

Third party websites

Users may find advertising or other content on our Site that link to the sites and services of our partners, suppliers, advertisers, sponsors, licensors and other third parties. We do not control the content or links that appear on these sites and are not responsible for the practices employed by websites linked to or from our Site. In addition, these sites or services, including their content and links, may be constantly changing. These sites and services may have their own privacy policies and customer service policies. Browsing and interaction on any other website, including websites which have a link to our Site, is subject to that website’s own terms and policies.

Advertising

Ads appearing on our site may be delivered to Users by advertising partners, who may set cookies. These cookies allow the ad server to recognise your computer each time they send you an online advertisement to compile non personal identification information about you or others who use your computer. This information allows ad networks to, among other things, deliver targeted advertisements that they believe will be of most interest to you. This privacy policy does not cover the use of cookies by any advertisers.

Linking with third party sites

Our Site may, from time to time, contain links to and from the websites of our commercial partners, other regional bodies, advertisers and clubs. If you follow a link to any of these websites, please note that these websites have their own privacy policies and they will be a data controller of your personal information. We do not accept any responsibility or liability for these policies and you should check these policies before you submit any personal information to these websites.

In addition, if you linked to this Site from a third-party site, we cannot be responsible for the privacy policies and practices of the owners or operators of that third-party site and recommend that you check the policy of that third party site and contact its owner or operator if you have any concerns or questions.

Changes to this privacy policy

Active Cheshire has the discretion to update this privacy policy at any time. When we do, we will revise the updated date at the bottom of this page. We encourage Users to frequently check this page for any changes to stay informed about how we are helping to protect the personal information we collect. You acknowledge and agree that it is your responsibility to review this privacy policy periodically and become aware of modifications.

Any changes we may make to this Policy in the future will be posted on our Site and, where appropriate, notified to you by e-mail. When we change this Policy in a material way, we will update the version date at the bottom of this page. Please check back frequently to see any updates or changes to this Policy and should you object to any alteration, please contact us as set out in the “Contact” section below.

YOUR ACCEPTANCE OF THESE TERMS

Website Users

By using this Site, you signify your acceptance of this policy and terms of service. If you do not agree to this policy, please do not use our Site. Your continued use of the Site following the posting of changes to this policy will be deemed your acceptance of those changes.

Other Users

By supplying information to Active Cheshire following the issue of or reference to the privacy notice you signify your acceptance of this policy and terms of service. If you do not agree to this policy, please do not provide any information to Active Cheshire.

WHAT ARE YOUR RIGHTS?

Full details of your rights set out in the relevant privacy notice provided to you, but you are entitled by law to ask for a copy of your personal information at any time. You are also entitled to ask us to correct, delete or update your personal information, to send your personal information to you or another organisation and to object to automated decision making. Where you have given us your consent to use your personal information in a particular manner, you also have the right to withdraw this consent at any time.

To exercise any of your rights, or if you have any questions relating to your rights, please contact us by using the details set out in the “Contact” section below. You can also unsubscribe from any direct marketing by clicking on the unsubscribe link in the marketing messages we send to you.

You should note that some of your rights may not apply as they have specific requirements and exemptions which apply to them and they may not also apply to personal information recorded and stored by us. However your right to withdraw consent or object to processing for direct marketing are absolute rights.

In the event of any query or complaint in connection with the information we hold about you, please email support@activecheshire.org or write to us at the address below.

If you are unhappy with the way we are using your personal information you can complain to the UK Information Commissioner’s Office or your local data protection regulator. More information about your legal rights can be found on the Information Commissioner’s website at https://ico.org.uk/for-the-public/. However, we are here to help and would encourage you to contact us to resolve your complaint first.

Contacting us

If you have any questions about this Privacy Policy, the practices of this site (or Active Cheshire), or your dealings with this site (or Active Cheshire), please contact us at:

Active Cheshire

Postal Address: Wyvern House, The Drumber, Winsford, Cheshire, CW7 1AU.

Office Telephone: 01606 330 212

E-mail: support@activecheshire.org

Website: www.activecheshire.org

Data Protection Officer: Steve Densley steve.densley@activecheshire.org