Privacy Policy for Ilfracombe Yacht Club including Y-Sail.

Effective Date: 20 August 2026

Ilfracombe Yacht Club including Y-Sail ("we", "us", "our") is committed to protecting and respecting your personal data. As a UK-based non-profit sports club, we collect and process personal information to manage memberships, facilitate sports activities, and run the club efficiently.

This Privacy Policy explains how we collect, use, store, and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

 

1. The Data Controller

Ilfracombe Yacht Club including Y-Sail is the data controller for the personal information you provide to us.

  • Data Protection Contact: Ilfracombe Yacht Club including Y-Sail Secretary.

  • Email: IYC@BTinternet.com

  • Address: Ilfracombe Yacht Club, The Quay, Ilfracombe, EX34 9EQ

 

2. Information We Collect

We collect and process the following categories of personal data from our members, volunteers, and participants:

  • Identity Data: First name, last name, date of birth, and gender (often required for sporting categories and safeguarding).

  • Contact Data: Postal address, email address, and telephone numbers.

  • Emergency Contact Data: Name, relationship, and contact number of a designated next of kin or emergency contact.

  • Financial and Payment Data: Records of subscription and fee payments. Depending on your chosen payment method, this includes:

 

    • BACS Transfers: Bank account name, partial account details visible on our bank statements, and payment references.

    • Card Payments: Records of card transactions. (Note: We do not store full credit/debit card numbers; these are processed securely by our third-party card terminal/payment provider).

    • Cash Payments: Names recorded against cash receipts for accounting purposes.

 

  • Health and Medical Data (Special Category Data): Details of any medical conditions, allergies, or injuries that our coaches and staff need to know to ensure your safe participation. We only collect this with your explicit consent.

 

3. How We Collect Your Data

We collect your data when you:

  • Complete a membership or registration form (online or on paper).

  • Pay for membership or club events via cash, card, or BACS.

  • Update your details with the club committee.

  • Communicate with us via email, social media, or phone.

 

4. How We Use Your Data and Our Lawful Basis

Under UK GDPR, we must have a lawful basis to process your personal data. We use your data for the following purposes:

 

Purpose/Activity

Type of Data

Lawful Basis for Processing

Membership Administration: Registering you as a member, managing renewals, and keeping you informed about club events, AGMs, and events.

Identity, Contact

Performance of a Contract: Necessary to fulfil our membership agreement with you.

Health and Safety: Ensuring you can participate safely in sports and contacting your next of kin in an emergency.

Emergency Contact, Health/Medical

Explicit Consent: For medical data.

Vital Interests: For emergency contact usage.

Financial Management: Processing subscriptions, tracking fee payments (Cash, Card, BACS), and maintaining club accounts.

Identity, Financial

Performance of a Contract: To process your fees.

Legal Obligation: To maintain accurate financial records for tax and accounting purposes.

Affiliation and Leagues: Registering participants with regional or national sporting governing bodies or leagues.

Identity, Contact

Legitimate Interests: Necessary for the club to participate in competitive leagues and associations.

 

5. Who We Share Your Data With

We do not sell your personal data to third parties. We may share your data with strictly necessary third parties, including:

 

  • Club Officials and Coaches: Committee members and coaching staff will have access to your data on a need-to-know basis (e.g., a coach needing to know about a medical condition or emergency contact).

  • Governing Bodies: Our club is affiliated with the RYA and may form relationships with other national or regional sports governing bodies; we may be required to share basic identity data for participant registration and insurance purposes.

  • Service Providers: Third-party platforms used to run the club, such as payment processors (for card transactions) and secure cloud storage providers where membership lists are held.

  • Legal and Regulatory Authorities: HMRC or law enforcement if required by law.

 

6. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, accessed in an unauthorised way, altered, or disclosed. Physical forms are stored in locked cabinets, and digital data is stored on secure, password-protected devices or encrypted cloud platforms accessible only by authorised committee members.

7. Data Retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for.

 

  • Membership Data: Held for the duration of your membership, plus a grace period of [e.g., 1 year] after you leave, in case of returning members or outstanding queries.

  • Financial Records: Information relating to payments (BACS, card receipts, cash ledgers) is kept for up to 7 years to comply with UK tax and accounting laws.

  • Health Data: Deleted immediately upon the termination of your membership or when you withdraw consent.

 

8. Your Legal Rights

Under the UK GDPR, you have the following rights regarding your personal data:

 

  • Request access: You can ask for a copy of the personal data we hold about you.

  • Request correction: You can ask us to correct incomplete or inaccurate data.

  • Request erasure: You can ask us to delete your personal data when there is no good reason for us to continue processing it.

  • Object to processing: You can object to us processing your data based on legitimate interests.

  • Withdraw consent: If we rely on your consent to process specific data (such as medical information), you can withdraw this consent at any time.

 

To exercise any of these rights, please contact our Data Protection Contact at IYC@BTinternet.com. We will respond to all legitimate requests within one month.

 

9. Complaints

If you have any concerns about how we handle your data, please contact us first so we can try to resolve the issue. You also have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection (www.ico.org.uk).