LIPHOOK TENNIS CLUB

GENERAL DATA PROTECTION REGULATIONS 2018 (DPA 18) – DATA PROTECTION PROCEDURE

The Purpose of this Procedure

This document describes the rights of the members and those non-members who have access to any of the facilities of Liphook Tennis Club (the “Club”), also the obligations of the volunteers who manage the activities of the Club (the “Officers”) and such others whose personal data as may be collected and stored by the Club as described in the provisions of the General Data Protection Regulations (“GDPR”).

The procedure explains:

 what data are collected,

how data are stored securely,

the right of access and to review personal data held by the Club,

the right of rectification to change or remove data,

the obligations of the Club to destroy data when it is no longer relevant, and

 to ensure that the Officers of the Club understand the obligations placed upon then by GDPR.

Data Controller

For the purposes of the General Data Protection Regulation ("GDPR") and UK data protection laws, the Data Controller is Liphook Tennis Club, Memorial Recreation Ground, London Road, Liphook, Hampshire, UK, GU30 7AN.  Any issues for the Data Controller may be raised with an Officer of the Club.

The Data Controller may only collect personal data relevant for lawful purposes of the Club’s affairs and, where the data are sufficient and adequate, is not excessive and is kept accurate and up to date.

The Club collects personal data for use by the Data Controller and by the Officers of the Club for the purposes of managing the affairs of the Club.

The duties of the Data Controller will be addressed at each Committee Meeting of the Club Officers to monitor adherence to this procedure.  Without limiting the scope of such reviews the Club will review the security of data handled on ClubSpark, a web-based platform recommended by the Lawn Tennis Association, including personal data supplied by those who have Registered to access ClubSpark and those who have not chosen to register. The Data Controller will check that users understand their rights, monitor any requests for corrections or erasure and remove records of non-active members.

If you require at any time that your records are removed completely, you have a legal right of erasure. Please contact the Data Controller via an Officer of the Club who will make the necessary arrangements.

What Data are Collected and How it Used?

Your data will be collected when you apply to join the Club (yourself, or on behalf of someone else, e.g. as a parent of a younger member or vulnerable young adult) or will be recorded when you apply to access any of the facilities of the Club. Data may also be received from an external source (itself compliant with GDPR) such as the Lawn Tennis Association, other tennis providers, or the services of the Club’s secure, on-line data platform, ClubSpark.

We collect your information, including your name, address, telephone number and e-mail address to enable the Officers to manage the services provided by the Club and to keep you informed regarding activities that we think may be of interest to you.

By providing the Club with personal data you are giving consent for it to be stored and processed as described herein.  If you wish to limit the storage or use of information that you has provided you are required to make that known to the Data Controller. You are not obliged to answer all questions when registering with ClubSpark, or when providing the Club with personal data, but a lack of correct contact information may limit your access to Club facilities.

For younger users of the Club’s facilities and vulnerable young adults it is necessary to collect additional information including age and relevant personal data of your parent or guardian. This information must be held by the Club and is a condition of membership.

Where you opt to use the facilities provided by ClubSpark for on-line payment, your financial details will be secured by the procedures put in place by ClubSpark.  If you opt to pay the Club by other means you may choose to provide the Club with information such as Direct Debit data that will enable payment to be taken.

Certain other information which you volunteer when joining the club or when applying to use the facilities is also stored (for example, contact data when making a court booking, or paying for play and pay access).  We may collect data about your health or medical conditions, where appropriate to a Club activity if you choose to volunteer such information.

The Club collects data on payments of fees, court bookings and eligibility for the Wimbledon Ballot.  The personal date of Officers of the Club and those who have been successful in securing tickets in the Wimbledon Ballot are provide to the Lawn Tennis Association.

Personal data necessary for the proper management of the Club is made available to the Lawn Tennis Association, other tennis organisations with whom the Club may interact, media outlets and ClubSpark, the Club’s on-line data platform.

No personal data are made available to any organisation for the purposes of selling or marketing any product. The Club may use your data to promoting goods and services of third parties (for example, the Lawn Tennis Association, equipment suppliers, operators of coaching courses, and organisers of tennis events) where we think this will be of interest to you.

ClubSpark and Data Security

The Club keeps records of personal data on the system known as ClubSpark, a web-based platform recommended by the Lawn Tennis Association.  ClubSpark is responsible for compliance with GDPR for the data that it holds.  Its role is to act as a Data Processor on behalf of the Club’s Data Controller. It has introduced procedures that:

• manage consents when registering for a ClubSpark account which mean that users opt-in to the storage of their data,
• give users the ability to update their consents from their account area,
• permit records to be deleted if requested by any user
• prevent any user creating an account if they are under the age of 13
• make it easier to identify junior records within the system
• ensure that any junior product being purchased on the system is only done so by the player’s parent or guardian.

Access to the ClubSpark data is limited to Officers of the Club who have been designated as “Administrators” with access to personal data that is appropriate for their role in the management of the Club. 

The Data Controller has a duty to ensure that each officer of the Club is aware of a duty of care to keep data secure when corresponding with users of the Club’s facilities. The preferred means of communication is ClubSpark, which is designed to restrict communications to access by each user.  If methods other than ClubSpark are used those responsible must take steps to ensure that only the intended recipient receives a communication that might show the data of others users, e.g. use “BCC” rather than “Copy”  when sending round robin e-mails and similar restrictions shall apply to any Officer who sends text messages.

The Data Controller has a duty to ensure that Club Officers keep any personal date of a domestic nature separate from the personal data held by the Club.

ClubSpark security statement.

The security of your data is of the upmost importance to us. Our platform is hosted on Microsoft Azure, which runs in geographically dispersed datacenters that comply with key industry standards, such as ISO/IEC 27001:2005, for security and reliability. They are managed, monitored, and administered by Microsoft operations staff that have years of experience in delivering the world’s largest online services with 24 x 7 continuity.

In addition to datacenter, network, and personnel security practices, Microsoft Azure incorporates security practices at the application and platform layers to enhance security for application developers and service administrator.

The Microsoft Azure platform environment is composed of computers, operating systems, applications and services, networks, operations and monitoring equipment, and specialized hardware, along with the administrative and operations staff required to run and maintain the services. The environment also includes the physical operations centres that house the services and which themselves must be secured against malicious and accidental damage.

How Your Personal Data are Processed.

To obtain the benefits offered by ClubSpark you should “Register” as a user. When you Register to use ClubSpark you will be asked to provide personal data that will permit the Club to provide you with the benefits of membership and access to the Club’s facilities.

 Without such registration your use of Club’s facilities will be limited, e.g. you will not have access to book courts, you will not be able to pay fees on-line and you may not receive information from the Club on activities, including court availability and access codes. 

If you have Registered you will have access to your personal data and can at any time check it is correct, you may edit the information held on ClubSpark and remove any data that is no longer appropriate.

If you choose not to Register with ClubSpark you may provide your personal data to the Club’s Membership Secretary, who will add your details to the ClubSpark data base.  If you need to check that the information held by the Club is correct, wish to edit the information held by the Club or require the Club to remove any data that is no longer appropriate please contact the Club’s Membership Secretary.

You have the right for any personal data that are stored on ClubSpark that identifies you as a “Contact” of the Club (not necessarily being an active member of the Club) to be removed from the data base.  More generally, you have a right to require the complete erasure of any personal data that is held by the Cub. The data of lapsed and non-members will be removed periodically at the discretion of the Data Controller.

If you have reason to believe a breach of personal data has occurred, please report in the first instance to the Data Controller.

Web Site

The contact details of Officers of the Club are provided on the Web-Site to facilitate the management of the services which the Club provides.

Children and Vulnerable Young Adults

The Club follows the procedures for the protection of children and vulnerable young adults that are recommended by the Lawn Tennis Association and have adopt new measures introduced by ClubSpark to strengthen those procedures.

Further Assistance

For help in dealing with data protection issues please contact an Officer of the Club (Committee Member).

Assistance in registering to use ClubSpark is available. If you experience any problem contact the Club’s Secretary or Membership Secretary.