Data Protection Policy
County Antrim Harriers – Data Protection Policy
Oct 30, 2026 · @Brian
1. Purpose and scope
County Antrim Harriers is a not-for-profit running club, run by its members, which raises money for charity. This policy sets out how the club looks after the personal data of its members, prospective members, volunteers, race entrants and website visitors.
It applies to everyone who handles personal data on the club's behalf: committee members, office bearers, coaches, site admins and any member helping with an event. It covers data held in any form, including the website, email, spreadsheets, messaging apps, paper forms and the accident log book.
This policy is for the club's own volunteers. Our public Privacy Policy and Cookie Policy explain to members and visitors what we collect and why.
Legal framework
The club must comply with:
- the UK General Data Protection Regulation (UK GDPR);
- the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025;
- the Privacy and Electronic Communications Regulations 2003 (PECR), for cookies and electronic marketing.
The regulator is the Information Commissioner's Office (ICO).
ICO registration
Not-for-profit organisations are often exempt from paying the ICO data protection fee, provided they only process data to run the club and serve their members. The committee should confirm this each year using the ICO's online fee self-assessment, and record the result in the committee minutes. [Record outcome and date here.]
2. Data protection principles
The club follows the seven principles in Article 5 of UK GDPR. In club terms:
| Principle | What it means for us |
|---|---|
| Lawful, fair and transparent | We have a lawful reason for everything we do with data, and our Privacy Policy tells people about it |
| Purpose limitation | Data collected for membership is used for running the club, not for unrelated purposes |
| Data minimisation | We collect only what we need, e.g. no medical history unless it matters for safety |
| Accuracy | Members can update their details at any time; we correct errors promptly |
| Storage limitation | We delete data when the retention period ends (section 8) |
| Integrity and confidentiality | Data is kept secure and shared only with people who need it (section 5) |
| Accountability | The committee can show how it complies, through this policy, minutes and records |
Last updated