Members Privacy Policy

About this document
This privacy policy sets out the way CLTC holds and processes your personal data as a member of our Club. It outlines what data we hold, where it came from, how it is used, the lawful basis upon which it is processed, with whom it will be shared, how long we will hold it for and your rights as a data subject.

The Club has also appointed a Data Protection Office (DPO) to manage its obligations under data protection law and this person should be contacted with any questions or concerns you may have. Contact details for the DPO can be found below.

The types of information we collect
We may collect the following types of personal data about you:

• Contact and communications information, including email address(es), telephone number(s) and postal address(es), along with records of correspondences and interactions we have had with you;
• Gender and date of birth, often linked to your category of membership;
• Financial information, including Direct Debit details where given;
• Certain other information which you volunteer when making use of your membership benefits (for example, when making court bookings or entering competitions etc).

We may also request you to provide us with data about your health or medical conditions, so that we can, for example, cater for you when you attend a social event or course/camp, or help you to exercise safely when you join the gym.

How we collect your information
We collect your personal data in a few limited ways, namely:

• Directly from you, when you fill in an application for membership, when you make enquiries on our website, when you provide information via the Club’s booking systems, or when you interact with us during your time as a member in various other ways (for example, when you provide us with updates, enter a competition, renew your membership, sign up for a course or lessons, complete a health questionnaire, top up or redeem your Membership Card or booking system balances, pay your fees, enter an area covered by CCTV etc);
• From someone else who has applied for membership on your behalf (for example a family member who has provided us with your contact and communications details for that purpose);
• From the governing bodies associated with the Club’s activities (for example, where the LTA or England Squash has passed on your details to us in connection with a complaint or query you have raised about our Venue, or when the LTA or England Squash provide us with details of all players who have registered with them citing CLTC as their place to play (possibly in connection with British Tennis Membership and entry to the Wimbledon ballot, or England Squash player membership).

How we use personal data
Personal data provided to us will be used for the purposes set out at the time of collection and, where relevant, in accordance with any preferences you express.

GDPR requires a lawful basis for the processing of personal data to be identified. To follow is a summary of the bases identified by the regulation and how they are relevant to the data processed by CLTC.

Consent of the data subject
Member contact details added to Mailchimp for the purpose of receiving general newsletters, contact details added to the online Club Directory (accessed through the password protected Members’ Area) to be shared with other Members, contact details included in the hard copy Club Directory displayed in Clubhouse to be shared with other Members, contact details processed by sports coaches for sports specific purposes, administration of the Wimbledon ballot (annually).

Processing is necessary for the performance of a contract
To ensure Members abide by Club Rules.

Processing is necessary for compliance with a legal obligation
Any assistance given to the police to help with their investigations.

Processing is necessary to protect the vital interests of a data subject or another person
CCTV image capture to help prevent or confirm a health and safety or security incident, Accident Form completion and retention.

Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
CCTV image capture shared with the police to help them with an ongoing investigation or potential crime.

Necessary for the purposes of legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests, rights or freedoms of the data subject
Membership processing (including storing details on third party software platforms), communicating with you regarding matters essential to your membership (opening times, renewals information, General Meetings etc), contact details added to the Club’s website to enable access to the Members’ Area (contact details not visible to other Members), details added to the squash court booking system (Full and Squash Members only) to enable access, details processed in relation to coaching course registration and league and tournament entries, research and statistical analysis about who is playing at our Club (including coaching), bank details held for direct debit subscribers, payment and transaction details recorded for subscription and other purchases, CCTV image capture to help with security and heath and safety, Committee Member details (including photo) displayed on the website and in the Clubhouse, retention of health and fitness and known allergy details to assist with safe exercise and diet (for social functions) The relevance to CLTC as outlined above is not exhaustive but is indicative of the kind of personal data we process and why, and under which lawful basis this is done.

Your marketing preferences
We will always respect your wishes in respect of what type of communications you want to receive from us and how you want to receive them. There are some communications, however, that we need to send you regardless of your marketing preferences in order for us to fulfil our contractual obligations to you as a member of our Club. Examples of these essential communications can be found above under the lawful basis of legitimate interest.

For all optional communications, however, you are in control of how we communicate with you. Regarding the Club’s general E-news newsletter, you can unsubscribe at any time using the embedded link in the email, or you can update your choices and/or your contact details by contacting us at:

Telephone: 0207 4356022
Email: click here to email
Post: 25 Alvanley Gardens, London NW6 1JD

Sharing your information with others
We do not sell your personal data to third parties.

Where necessary, however, we do share your information with third parties as set out below:

• Our employees and volunteers, for the purposes of administering your membership and giving you access to the membership benefits to which you are entitled
• Select contractors and suppliers, including our Club coaches, who may provide and administer activities on your behalf (coaching services, league and tournament organisation etc)
• Providers of our membership management services, including database and booking system hosts (for example, ClubV1 and Payne Automation)
• Our website and E-News service providers (for example, Startadesign and MailChimp)

For all shared uses of personal data, the third parties are classed as Data Processors, with CLTC remaining the Data Controller.

How long your information is kept
We keep your personal data only for as long as necessary for each purpose we use it.

For most membership data, this means we retain it for so long as you have a valid membership and for a minimum period of six years after your last interaction with us (for accounting, tax reporting and record-keeping purposes). For historical statistical archiving and research purposes we will, however, retain this data beyond this six year period, but you are able to request its processing be erased or restricted in accordance with your rights as outlined below. All such requests will be dealt with on an individual basis and in accordance with this Privacy Policy.

Your rights
By law, data subjects have various rights.

To follow is a summary of these rights as identified by the regulation and how CLTC will respect them.

The right to be informed
Usage of personal data needs to be transparent and readily available for inspection by data subjects. This privacy policy outlines the relevant details.

The right of access
Commonly known as a “data subject access request”, individuals are able to request confirmation of what data we have on them, how it is being used and under which lawful basis it is being processed. All such requests should be directed to the Club’s DPO and we will comply with all requests within a month of receipt. The Club will, however, retain the right to refuse, but will only exercise this right if we consider the request to be unfounded or excessive. In such cases, individuals will be able to complain to the Main Committee or to the ICO, details of whom are provided below.

The right to rectification
Individuals can request that incomplete or incorrect data be completed or corrected. All such corrections should be provided to the Club Office in writing, by email, on the phone or in person, at any time. Updates to the Club’s records will be made as soon as possible, but no later than a month after receipt.

The right to erasure
Individuals have “the right to be forgotten” and request all data relating to them be erased from Club records if they feel the original processing purpose is no longer necessary, if they withdraw consent from any consensual processing, if they object on the basis of their believing there to be no overriding legitimate interest, the legal basis used was incorrect or if dictated by a legal obligation. All such requests should be directed to the Club’s DPO and we will comply with all requests within a month of receipt. The Club will, however, retain the right to refuse, but will only exercise this right in order to comply with a legal obligation, if it relates to a public interest or official authority task, for historical statistical archiving or research purposes, or to help defend a legal claim.

The right to restrict processing
Individuals can block or suppress processing of their data (but allow the Club to retain it) should they contest the accuracy of the data held on them, where they have objected to the processing (see below), where they allege the legal basis upon which it is being used is incorrect, or should they require the data regarding a legal claim, even if we no longer need or require it. All such requests should be directed to the Club’s DPO in writing and we will comply with all requests immediately upon receipt. This compliance will either last forever or until such time as the reason given is disproved or a period of six years passes after the individual’s membership ceases (see above). You can also withdraw your consent where this is the basis for our processing of your data (without affecting the lawfulness of our previous processing based on consent).

The right to data portability
Individuals can request personal data held by one organisation be transported to another, although CLTC does not currently transport data to other companies, other than to third parties as outlined above.

The right to object
Individuals can object to their data being processed and challenge the use of their data as a legitimate interest or if they disagree with our assertion that we are processing in the public interest, in the exercise of official authority or for historical statistical archiving or research purposes. Individuals can also object if they believe they are being unlawfully directly marketed to. All objections should be directed to the Club’s DPO in writing and we will comply with all requests immediately upon receipt. All further processing will be restricted until such time as the objection has been investigated and either compelling evidence contrary to the objection can be demonstrated (such as the legitimacy of a legitimate interest) or the objection upheld. This process will be completed within a month.

Rights related to automated decision making and profiling
Individuals have a right to not be subject to a decision that is processed solely by automated means (i.e. without any human involvement) and which has a significant effect upon them, unless necessary for contractual purposes, is authorised by law or based on explicit consent. Any profiling (i.e. automated processing of personal data to evaluate certain things about an individual) must have appropriate safeguards in place. If Members believe they are being subject to unlawful automated decision making or profiling, they should contact the Club’s DPO in writing and we will investigate the matter immediately. If it is determined that automated processing is taking place, Members will be allowed to obtain human intervention, express their point of view, obtain an explanation and challenge it.

Please note that the above rights are not absolute and we may be entitled to further refuse requests where exceptions apply.

Children
Child Members of the Club are classed as Members aged under 16 on the first day of each membership year. In accordance with Club Rules, all Child Members must have at least one parent or guardian as a Member of the Club and all processing of children’s data is therefore done with parent or guardian knowledge and consent.

Contact and complaints
If you have any queries about this privacy policy or how we process your personal data, or if you wish to exercise any of your legal rights, you may contact the Club’s DPO (the General Manager) using the following details:

Telephone: 0207 4356022
Email: click here to email
Post: 25 Alvanley Gardens, London NW6 1JD

If you are not satisfied with how we are processing your personal data, you can make a complaint to the Club’s Main Committee or to the Information Commissioner. Main Committee Member details can be found on the Club’s website or displayed on the Club noticeboard in the clubhouse and you can find out more about your rights under applicable data protection laws from the Information Commissioner’s Office at www.ico.org.uk.

If you have not previously signed our consent form please do so below