GDPR Policy

Effective Date: 01/01/2025
‍
Last Updated: 01/0/2025

Werneth Low Golf Club (“we,” “us,” or “our”) is committed to protecting the privacy and security of personal data. This GDPR policy outlines how we collect, process, store, and protect personal data in compliance with the General Data Protection Regulation (EU Regulation 2016/679) and the UK GDPR.

1. Introduction
‍
This policy explains how Werneth Low Golf Club collects, uses, and protects personal data to ensure transparency and trust in our operations. It applies to all personal data we process, whether from members, guests, employees, or other individuals who interact with us.

2. Definitions
‍
Personal Data: Information relating to an identified or identifiable individual (e.g., name, email, phone number).
Processing: Any operation performed on personal data (e.g., collection, storage, use, transfer, or deletion).
‍
Data Controller: Werneth Low Golf Club, which determines the purposes and means of processing personal data.
‍
Data Subject: Individuals whose personal data is processed by us.
‍
3. Principles for Processing Personal Data
‍
We are committed to processing personal data in line with the following principles:

Lawfulness, Fairness, and Transparency: Processing data legally, fairly, and transparently.
Purpose Limitation: Using data only for specified and legitimate purposes.
Data Minimisation: Collecting only the data necessary for our purposes.
Accuracy: Keeping personal data accurate and up-to-date.
Storage Limitation: Retaining personal data only as long as necessary.
Integrity and Confidentiality: Protecting data against unauthorised access or breaches.
‍
4. Personal Data We Collect
‍
We may collect the following types of personal data:

For Members and Guests: Name, address, email, phone number, date of birth, handicap details, payment information, and any preferences or consents.
‍
For Website Visitors: Technical data such as IP addresses, cookies, and browser types.
‍
For Employees and Contractors: Employment records, bank details, identification documents, and emergency contact details.
‍
For Event Participants: Name, contact details, and dietary or accessibility requirements.
‍
5. Lawful Basis for Processing
‍
We process personal data based on one or more of the following legal grounds:

Consent: You have given clear consent for us to process your personal data for a specific purpose.
Contractual Necessity: Processing is required for the performance of a contract (e.g., membership agreements).
Legal Obligation: To comply with legal and regulatory obligations (e.g., health and safety laws).
Legitimate Interests: To support our operations, such as managing bookings, providing member services, or improving our website, provided your rights do not override these interests.
‍
6. Data Subject Rights
‍
Under GDPR, individuals have the following rights regarding their personal data:

Right to Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure: Request deletion of your personal data (“Right to be Forgotten”).
Right to Restrict Processing: Request limitations on how we process your data.
Right to Data Portability: Request transfer of your data to another organization.
Right to Object: Object to processing based on legitimate interests or direct marketing.
Right to Withdraw Consent: Withdraw consent for data processing at any time.
Right to Lodge a Complaint: File a complaint with the UK Information Commissioner’s Office (ICO).
‍
7. Data Retention
‍
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. For example:

Member data: Retained during active membership and for up to 7 years after to comply with financial or legal obligations.
Guest booking data: Retained for up to 12 months for follow-up or marketing purposes with consent.
Employment records: Retained as required by employment law.
‍
After the retention period, data is securely deleted or anonymised.

8. Data Security
‍
We employ robust security measures to safeguard personal data, including:

Secure storage of data in locked systems or password-protected databases.
Encryption of sensitive information.
Regular audits of our data protection measures.
Limiting access to personal data to authorised personnel only.
‍
9. Data Sharing
‍
We may share personal data with:

Third-Party Service Providers: Such as payment processors, IT service providers, or event management platforms, who process data on our behalf.
Regulatory or Legal Authorities: When required to comply with applicable laws.
Affiliated Golf Clubs and Associations: For purposes such as handicap verification or competition registration.
‍
We ensure that all data shared is processed in compliance with GDPR through agreements with third parties.

10. International Data Transfers
‍
If personal data is transferred outside the UK or EEA, we ensure that adequate safeguards are in place, such as:

Binding Corporate Rules (BCRs)
Standard Contractual Clauses (SCCs)
Transfers to countries with adequacy decisions by the European Commission
‍
11. Cookies and Tracking
‍
We use cookies on our website to enhance user experience and analyse traffic. By continuing to use our website, you consent to the use of cookies. Please refer to our Cookie Policy for more details.

12. Breach Notification
‍
In the event of a data breach:

We will notify the UK ICO within 72 hours, if required.
If the breach poses a high risk to individuals, we will inform the affected data subjects promptly.
‍
13. Updates to This Policy
‍
This GDPR policy is reviewed and updated periodically to reflect changes in our practices or legal obligations. The latest version is always available on our website.

14. Contact Us
‍
If you have questions about this GDPR policy, or if you wish to exercise any of your rights, please contact us:

Data Protection Officer (DPO)
Werneth Low Golf Club
‍
Email: secretary@wernethlowgolf.co.uk
Phone: 0161 368 2503
‍
Address: Werneth Low Road, Gee Cross, Hyde, SK14 3AF

For further information or to lodge a complaint, you can also contact the UK Information Commissioner’s Office (ICO) at www.ico.org.uk.