Introduction

This document sets out B. H. Sports Management Limited (trading as Sport for All Centres) Data Consent Policy. It covers the processing and sharing of personal data. If you require advice and assistance around any data protection matter please contact B. H. Sports Management Limited Data Protection Officer.

The GDPR and Consent

The GDPR sets a high standard for consent. Consent means offering individuals the power to choose and take control of their data.

Genuine consent will put individuals in charge, build customer trust and engagement, and enhance B. H. Sports Management Limited’s reputation.

The GDPR states that an indication of consent must be unambiguous and involve a clear affirmative action (an opt-in).

It specifically bans pre-ticked opt-in boxes. It also requires an individual, also known as “granular” consent options for distinct processing operations. Consent is kept separate from other terms and conditions and should not be a precondition of signing up for a service.

The GDPR gives a specific right to withdraw consent. B. H. Sports Management Limited will inform individuals about their right to withdraw and offer easy ways for customers to withdraw consent at any time.

B. H. Sports Management Limited will keep clear records to demonstrate consent and regularly review existing consents and consent mechanisms that we rely upon to ensure they meet the GDPR standards.

Employees of B. H. Sports Management Limited must have respect for privacy and people’s right to determine what happens to their personal and sensitive information.

If there is any doubt, contact the Data Protection Officer

B. H. Sports Management Limited and its employees and third-party providers have been trained, appraised and understand that:

•  Individuals have the right to withdraw/withhold consent in most circumstances, and this right must be respected and recorded appropriately.
•  Consent must be freely given, specific and informed.
•  All employees must ensure they consider the safety and welfare of the individual when making decisions on whether to share information about them.
•  All employees must establish the capacity of the individual’s ability to provide consent.
•  When requesting consent, staff must ensure that information is provided in a suitable, accessible format or language. If necessary, provide large print or Braille versions, accredited interpreters, signers, or other appropriate special communication skills.

Employees must record the decision to share personal information on an appropriate register or specific system which can be readily accessed in line with B. H. Sports Management Limited policies and procedures on data protection.

What if there is no consent?

B. H. Sports Management Limited acknowledges that obtaining consent is not always possible, or consent may be refused. However, not obtaining consent or the refusal to give consent may not constitute a reason for not processing or sharing information.

There are certain situations where an individual’s information can be disclosed without obtaining it. Consent, if there is a lawful basis for processing without consent in place.

The lawful bases for processing are set out in Article 6 of the GDPR. At least one of these must apply. Whenever you process personal data without consent:

• Contract: the processing is necessary for a contract you have with the individual or because they have asked you to take specific steps before entering into a contract.
• Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
• Vital interests: the processing is necessary to protect someone’s
• Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
• Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)

Different criteria apply to sensitive personal information (now called “special categories of personal data”). This is now defined as data relating to:

•  race;
•  ethnic origin;  politics;
•  religion;
•  trade union membership;  genetics;
•  biometrics (where used for ID purposes);  health;
•  sex life; or
•  sexual orientation.

In order to process special category data legally, you must identify both a lawful basis under Article 6 and a separate condition for processing special category data under Article 9. These do not have to be linked.

In summary, these are:

1. explicit consent of the person concerned
2. for the purpose of carrying out the obligations, exercising specific rights of the controller or of the data subject in the field of employment and social security, and social protection
3. to protect the vital interests of the data subject or of another natural person
4. processing is carried out with appropriate safeguards by a foundation, association or any other not-for- profit body with a political, philosophical, religious or trade union aim
5. the processing relates to personal data, which are manifestly made public by the data subject
6. processing is necessary for the establishment, exercise or defence of legal claims
7. processing is necessary for reasons of substantial public interest
8. for the purpose of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment
9. for reasons of public health
10. processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

Special Cases

 Children

The duty of confidentiality owed to a child/young person who lacks capacity is the same as that owed to any other person. Occasionally, children/young people will lack the capacity to consent. An explicit request by a child that information should not be disclosed to parents or guardians, or indeed any third party, must be respected except where it puts the child at risk of significant harm, in which case disclosure may take place in the ‘public interest’ without consent.

Criminal Offences 

The GDPR rules for sensitive (special category) data do not apply to information about criminal allegations, criminal proceedings or convictions. Instead, there are separate safeguards for personal data relating to criminal convictions and offences or related security measures set out in Article 10 of the GDPR.

To process personal data about criminal convictions or offences, you must have both a lawful basis under Article 6 of the GDPR and either legal authority or official authority for the processing under Article 10.

Article 10 also specifies that you can only keep a comprehensive register of criminal convictions if you are doing so under the control of the official authority.

If you are in any doubt as to how to go about handling special categories of data, such as data concerning children, sensitive data such as race and sexuality, or criminal data, see the checklist at the end of this policy statement and consult B. H. Sports Management Limited ’s Data Protection Officer for further advice and guidance

Policy Breach Statement 

Any breach of this Policy will be investigated and may result in disciplinary action. Serious breaches may be considered gross misconduct and result in dismissal without notice or legal action being taken against you. B. H. Sports Management Limited, as well as those individuals affected, is also at risk of financial and reputational harm. Fines of up to €20 million may be imposed on organisations for serious data breaches.

Please report any actual or potential data breaches or other concerns relating to Data Protection or consent to B. H. Sports Management Limited Data Protection Officer as soon as possible, in accordance with B. H. Sports Management Limited Data Breach Policy.

CHECKLIST

 Asking for consent

• We have checked that consent is the most appropriate lawful basis for processing.
• We have made the request for consent prominent and separate from our terms and conditions. We ask people to positively opt in.
• We don’t use pre-ticked boxes or any other type of default consent  We use clear plain language that is easy to understand.
• We specify why we want the data and what we are going to do with it.
• We give individual granular options to consent separately to different purposes and types of processing.
• We name organisations and any third-party controllers who will be relying on the consent.  We tell individuals they can withdraw their consent.
• We ensure that individuals can refuse to consent without detriment.  We refrain making consent a precondition of a service
• If we offer online services directly to children we only seek consent if we have age verification measures and parental-consent measures for younger children in place.

Recording consent

• We maintain a record when and how we obtained consent from the individual.
• We maintain a record of exactly what they were told at the time

Managing consent

• We regularly review existing consent to check that the relationship the processing and the purposes have not changed.
• We have processes in place to refresh consent at appropriate intervals including any parental consents. We make it easy for individuals to withdraw their consent at any time and publicise how to do so.
• We act on withdrawals of consent as soon as we can.
• We do not penalise individuals who wish to withdraw consent.

What do we mean by ‘Personal Data’?

Personal Data is any information relating to an identifiable person who can be directly or indirectly identified by the data.

Personal identifiers include names, identification numbers, location data, or online identifiers such as IP addresses. It applies to automated personal data as well as manual filing systems where personal data is accessible according to specific criteria; this could include chronologically ordered sets of manual records containing personal data.

Personal data that has been encrypted or pseudonymised– for example, by the use of key-codes– will also fall within the protection scope of the GDPR depending on how difficult it is to attribute the pseudonym to a particular individual.

Rights of Individuals

Individuals (“Data Subjects”) have the right to request the following from B. H. Sports Management Limited: Confirmation that their personal data is being processed

• Access to their personal data
• A description of their personal data, including reasons for the processing and whether their data will be shared with other organisations or people;
• Provided with a copy of the information comprising their data and details of the source of the data where available

How do individuals (“Data Subjects”) submit requests for their information?

Access requests can be submitted by data subjects by contacting Dave Bonwick (General Manager) via clicking here, who is the main contact person for handling queries relating to data protection in our organisation.

Individuals may also request their data is amended, updated and/or deleted at any time, unless B. H. Sports Management Limited is required to retain it for legitimate business or legal purposes, by submitting a request to this email address.

Responding to Subject Data Access Requests

B. H. Sports Management Limited will require the individual to verify their identity before any request is actioned.

B. H. Sports Management Limited reserves the right to request the individual for sufficient information to ascertain whether the person making the request is the individual to whom the personal data relates. This is necessary to avoid personal data about one individual being sent to another either accidentally or because of deception.

B. H. Sports Management Limited has the right to ask for extra details to enable it to locate the personal data covered by request. If no personal information about the individual is stored, they will be informed accordingly.

If the data processing is outsourced to a third-party contractor, subject access requests may be sent to the relevant third party to respond accordingly.

B. H. Sports Management Limited’s Nominated Person will refer to B. H. Sports Management Limited’s Data Register to locate all the information held on the individual and liaise with B. H. Sports Management Limited’s relevant departments and/or third parties concerned, in order to collate all the information.

Information will be provided within at least one month of receiving the request. Where requests are complex or numerous, B. H. Sports Management Limited has the right to extend the deadline for providing the information to three months. However, a response to the request explaining why the extension is necessary will be sent within one month.

Information will be provided free of charge. However, Data Access Requests that are manifestly unfounded, excessive or repetitive can be refused, or a reasonable fee will be charged to reflect the administrative costs involved.

If a request is refused, the individual will be informed as to why and advised that they have the right to complain to the ICO and to a judicial remedy. Any Subject Access refusal will be made without undue delay and, at the latest, within one month.

Company Details

B. H. Sports Management Limited trading as Sport for All Centres
Registered Office: Stockport Sport for All Centre, Reddish Vale High School, Reddish Vale Road, Reddish, Stockport, SK7 7HD
Correspondence: PO Box 664, Stockport, SK5 7WG
Email: info@sportforallcentres.co.uk or contact us by clicking here

Data Protection – Client Personal Data – Privacy Notice

You are required to give certain personal data to us to enable us to provide services to you, both to perform our obligations under our service provision and to meet any legal requirements. The privacy of your personal data is taken seriously and this policy explains how data will be used and protected.

We will act as the Data Controller of your personal data. This notice applies before, during and after the service provision comes to an end.

The types of personal data that is processed by us may include the following:

• Name, residential address and contact details including telephone numbers and email address
• Details of your family and or emergency contact details
• Date of birth
• Ethnicity and disabilities
• Financial details, such as your National Insurance number, bank account, pensions, benefits
• Details about your health and medical care that you have consented to share with us.
• CCTV footage and audio recordings obtained during you period of residence.

We will process and control such data principally for the administrative and performance of the service provision between us.  Data may also be used where we are under a legal obligation to do so or where it is necessary and proportionate to safeguard the interests of you or a third party.

We may receive and share data with the following parties in order to assist them in the management of their duties and fulfil the purpose set out above:

• Accountants
• Governmental bodies
• Family members (with the appropriate consent)
• Sports governing bodies (with the appropriate consent)
• Local authorities and other funders
• Spawtz – league management software
• Associated School sites

All third-parties who have your data with are required to take appropriate security measures to protect your personal information in line with this policy. They are not allowed to use your personal data for their own purposes. Permission has/will only be granted for them to process your personal data for specified purposes and in accordance with our instructions.

Data will be retained for as long as necessary to fulfil the purposes it was collected for in accordance with this policy. Where data is considered sensitive data (such as health records, CCTV footage etc) to determine the appropriate retention period for data consideration will be given to the amount, nature, and sensitivity of the data collected, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which data is processed and whether those purposes can be achieved through other means, and the applicable legal requirements.

Your rights, in certain circumstances, in regards to your personal data include:

• Request access – there is no charge for this request
• Request correction of the personal information
• Request erasure of your personal information.
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent please notify us.

We reserve the right to update this privacy notice at any time, and will provide you with a new privacy notice when substantial updates are made. From time to time you may also receive notification in other ways about the processing of your personal information.

Date last reviewed:        12/10/2024