Privacy Policy

Who we are

Academy Swim Team Burnham-on-Sea Club, charity 1211831, is the controller of the personal information it uses to run the club. Contact [email protected]; billing enquiries go to [email protected] and safeguarding concerns to [email protected]. This notice covers swimmers, parents/carers, volunteers, coaches, officials, visiting clubs and website users. The current public notice is at https://astbos.co.uk/privacy-policy.

Information and sources

We obtain information from you, parents/carers, club staff, membership and competition bodies, visiting clubs and the systems that support club activity. Records may include identity and contact details, dates of birth, emergency contacts, attendance, squads, entries/results, health/access needs, photo choices, applications, correspondence, payments, volunteer qualifications and role checks, account/security logs and necessary welfare/incident records. Optional diversity information is collected only for a defined purpose. We do not routinely collect fingerprints, retina scans or unrelated commercial-partner data.

Purposes and lawful bases

Purpose	Normal lawful basis and limits
Membership, training, entries and family portal	Contract for agreed services; legitimate interests for proportionate administration and safe organisation.
Accounts, payments and record keeping	Contract and applicable legal obligations; legitimate interests for reconciliation, disputes and protecting club funds.
Safety, welfare and safeguarding	The relevant Article 6 lawful basis depends on the actual purpose. Health and other special category data also require an applicable Article 9 condition. Routine optional health/access disclosure may rely on explicit consent; safeguarding may use a specific statutory condition where its requirements are met. Vital interests applies only within its legal limits, not as a routine catch-all.
Qualifications and criminal-record checks	Role requirements and the lawful basis and authorisation for criminal-offence data are assessed separately. Access is limited and unnecessary retention of certificate details is avoided.
News, photos and optional marketing	Use recorded permissions and an appropriate lawful basis; respect withdrawal and objections. A family may decline optional publicity without losing ordinary membership.
Website security and optional analytics	Legitimate interests for proportionate account/site protection; optional analytics requires the site consent choice. Essential sessions and security storage support the service.

Why information is needed

Contact, emergency and participation information is needed to administer membership and safe activity. Payment information is needed for the chosen payment method. If required information is missing, we may be unable to provide the relevant service safely. Optional publicity, marketing and diversity choices can be declined. Ask the Secretary if you are unsure which fields are required.

Systems sharing and transfers

Authorised club personnel receive access according to their role. Systems include the AST website and Members Portal supported by SwimClubOS, Microsoft 365/SharePoint, GoCardless, SumUp and governing-body/competition systems where relevant. We share necessary information for entries, membership, payments, safety, insurance and lawful referrals. Providers may act as processors or independent controllers for their own services. We do not sell personal information.

Some providers may process data outside the UK. International transfers require the relevant contractual terms and applicable UK transfer safeguards; contact the Secretary for details or copies of relevant safeguards.

Retention and protection

We retain records according to their purpose, legal requirements, safeguarding/insurance needs and justified sporting history. Active membership/portal records are retained while relevant and reviewed afterwards. Financial records are normally retained for at least six years where accounting or dispute needs require it. Welfare/incident records may need longer retention under governing-body, insurance or legal requirements; current health/contact information should be reviewed and superseded details minimised. Results and club records may be retained as sporting history. Form submissions, role records and security/email logs are reviewed according to operational need and configured retention. Retention periods vary by the type and purpose of the record.

Access is restricted by role, and records should be accurate, necessary and secure. Historic safeguarding records and legal holds must not be deleted simply because membership ends. The Secretary maintains the purpose/basis/retention register and records decisions; deletion is subject to these retention decisions and is not necessarily automatic in every system.

Photos and online activity

We respect recorded photo permissions and safeguarding requirements. Contact us about inappropriate publication. Essential website cookies/storage support sessions, security and choices. Public-site Google Analytics loads only after acceptance; it is excluded from authenticated and sensitive flows according to site controls. Advertising signals remain disabled. Cookie settings in the footer allow a later change. Third-party technical assets may receive technical visit information.

Your rights and choices

You may ask for access, correction, erasure, restriction or portability where applicable. You can object to processing based on legitimate interests and to direct marketing. Withdraw consent at any time by contacting the Secretary; previous lawful processing is unaffected. Some records must be retained for another lawful reason. We will explain restrictions when responding. We do not use solely automated decisions with legal or similarly significant effects; important club decisions require human review.

Contact [email protected] to exercise rights or raise a concern. You may also complain to the Information Commissioner at ICO complaints. Children can ask for a simpler explanation and suitable support; a parent does not automatically have unrestricted access to all of a child’s confidential information.

Policy review

Version 2.0. Updated 6 October 2026. Next review: 6 October 2027, or earlier following a material change, incident, concern or change in guidance.