Privacy Policy
Privacy Policy
County Antrim Harriers – Privacy Policy
Oct 30, 2026 · @Brian
1. Who we are
County Antrim Harriers ("CAH", "the club", "we") is the data controller for personal data collected through this website. This policy explains what we collect, why, how long we keep it, and your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
We are a volunteer-run amateur athletics club, founded in 1895. Our committee appoints a Data Protection Lead who is responsible for this policy.
| Contact | Details |
|---|---|
| Data Protection Lead | [Name / role, e.g. Club Secretary] |
| [privacy@cah-example.org] | |
| Post | [Club postal address] |
If you have any question about your data, contact the Data Protection Lead first. We aim to reply within one month.
The club is not required to appoint a formal Data Protection Officer because we do not process personal data on a large scale.
2. What personal data we collect
What we hold depends on how you use the website. Visitors who only browse public pages give us very little; members who log in give us more.
| Who you are | Data we collect | How we get it |
|---|---|---|
| Member of the public | IP address, browser type, pages visited (only if you accept analytics cookies); anything you send us through a contact form or email | Automatically, or from you |
| Runner interested in joining | Name, email, phone, date of birth, running ability or goals, emergency contact | From you, via enquiry or membership forms |
| Club member | Name, email, SSO account identifier, membership number, date of birth, address, phone, emergency contact, race entries and results, race reports and photos you post, accident reports | From you, the SSO provider, race organisers, and club officers |
| Site admin | All member data above, plus a record of admin actions (who changed what, and when) | Automatically when you use admin tools |
We do not knowingly collect more than we need. We never sell personal data.
3. How we use your data and our lawful basis
UK GDPR requires a lawful basis for every use of personal data. Ours are set out below.
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Managing your membership, renewals and subscriptions | Contract |
| Registering you with Athletics Northern Ireland for affiliation and insurance | Contract and legal obligation |
| Giving members access to member-only pages via SSO | Contract |
| Sharing weekly session details, coach contacts and running routes | Contract |
| Recording accidents and incidents | Legal obligation and legitimate interests (member safety, insurance) |
| Publishing race results and club records | Legitimate interests (reporting club achievements) |
| Publishing race reports, news and photos | Legitimate interests, or consent where you are the main subject of a photo |
| Answering enquiries from prospective members | Legitimate interests |
| Keeping the site secure, including admin activity logs | Legitimate interests (security) |
| Analytics cookies | Consent |
| Club newsletter (future feature) | Consent |
Where we rely on legitimate interests, we have weighed our interests against your rights. You can object at any time (see section 10).
Where we rely on consent, you can withdraw it at any time. Withdrawing does not affect anything we did before you withdrew.
4. Health information and the accident log book
Accident reports and emergency medical details are health data, a "special category" under UK GDPR. We handle them with extra care.
- Why we hold it: to help you in an emergency, to meet health and safety duties, and to support insurance claims.
- Our conditions (Article 9): your explicit consent for medical information you give us; vital interests where you cannot consent in an emergency; and establishing or defending legal claims.
- Who can see it: only site admins and the club officers named in the Emergency Action Plan. Ordinary members can add an entry but cannot read other people's entries.
- Keep it minimal: please record only what is needed to describe the incident and the first aid given.
5. Children and junior members
The member area is for adult members. If the club admits junior members, a parent or guardian completes the membership form and gives any consent on the child's behalf.
We do not publish full names alongside photos of under-18s without written consent from a parent or guardian. Online, a child under 13 cannot give their own consent to analytics cookies or newsletters.
6. Who we share your data with
We share personal data only where needed, and never for marketing by others.
| Recipient | What and why |
|---|---|
| Athletics Northern Ireland | Membership details for affiliation, competition licences and insurance |
| Race organisers and timing companies | Entry details when you enter a race through the club |
| Website hosting provider [name] | Stores the website and its database (processor) |
| SSO / login provider [name] | Verifies your identity when you log in (processor) |
| Analytics provider [name] | Anonymised usage statistics, only with your consent (processor) |
| Emergency services | Health and contact details in an emergency |
| Police, courts or regulators | Only where the law requires it |
Every processor works under a written contract that limits use of your data to our instructions.
International transfers: some providers may store data outside the UK. When they do, we make sure the country has a UK "adequacy" decision or that approved safeguards are in place, such as the UK International Data Transfer Agreement.
7. Cookies, photos and race results
Cookies. We only set non-essential cookies if you opt in through the cookie banner. You can change your choice at any time using the "Cookie settings" link in the site footer.
| Cookie type | Purpose | Needs consent? |
|---|---|---|
| Strictly necessary | Keeps you logged in via SSO, protects forms, remembers your cookie choice | No |
| Analytics | Counts visits and popular pages so we can improve the site | Yes, opt-in |
| Third-party embeds (maps, video) | Shows running routes and videos | Yes, loaded only after opt-in |
Our separate Cookies page lists each cookie by name and lifetime.
Photos. We post photos from races and club events on public and member pages. If you would rather not appear, tell the photographer on the day or contact us and we will remove or crop the photo. Members posting race reports must only upload photos they are entitled to share.
Race results and club records. Results are usually already public through race organisers. We publish name, time, position and age category. You can ask us to show your result with initials only, and we will do so unless it is part of a historic club record.
8. How long we keep your data
| Data | Kept for |
|---|---|
| Membership records | Length of membership plus 2 years |
| Accident log entries | 3 years from the incident (until age 21 for under-18s), longer if a claim is open |
| Enquiries from prospective members | 12 months |
| Race results, club records, history pages | Indefinitely, as part of the club's archive |
| Photos and race reports | Indefinitely, unless you ask us to remove them |
| Admin activity logs | 12 months |
| Analytics data | 14 months |
When data is no longer needed we delete it or anonymise it.
9. How we keep your data secure
- Member and admin areas are behind SSO login; admin rights are given only by existing admins and reviewed each year.
- The website uses HTTPS encryption throughout.
- Member documents are view and download only, and health data is restricted to named officers.
- Software is kept up to date by our hosting provider.
- If a breach is likely to put you at risk, we will report it to the ICO within 72 hours and tell you without undue delay.
10. Your rights
Under UK GDPR you have the right to:
- Access a copy of the data we hold about you.
- Rectify data that is wrong or incomplete.
- Erase your data, where we have no lawful reason to keep it.
- Restrict how we use your data while a concern is resolved.
- Object to uses based on legitimate interests, including publication of photos and results.
- Data portability: receive data you gave us in a common electronic format.
- Withdraw consent at any time, where we rely on consent.
To use any of these rights, contact the Data Protection Lead. It is free, and we will respond within one month. We may ask you to confirm your identity.
11. Complaints
Please raise any concern with us first. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, helpline 0303 123 1113.
12. Changes to this policy
We review this policy at least once a year and when the website changes, for example when the online shop or newsletter launch. The date at the top shows when it was last updated. Significant changes will be announced on the News page and emailed to members.
Last updated