DATA PROTECTION Policy

GOODWOOD MARSHALS CLUB Data Protection Policy

Written September 2026. Next review September 2028.

1. Introduction

The Data Protection Act 2018 including the provisions made in the UK General Data Protection Regulations (UK GDPR), governs how organisations must collect, store, process and protect personal data.

In practice, this means that any organisation handling personal data in the UK must follow strict rules about privacy and security. These rules cover when and how data can be collected, how long it can be kept, and the rights individuals have over their data.

While this policy is intended to describe the obligations and responsibilities of the Goodwood Marshals Club (GMC), its officers and Committee members, it should be understood that this policy also applies to any Club Member or third-party acting on behalf of the Club.

2. Statement of intent

As a membership organisation, the GMC obtains and maintains information relating to its past, present and potential Members; this may include data about children, their parents/guardians, vulnerable individuals and their carers. In addition, and, by virtue of the Club’s activities, it may hold information on participants in its events.

The GMC recognises its responsibilities under data protection legislation as outlined in this policy and will ensure appropriate controls are in place to manage any identified data risks.

This policy should be read in conjunction with the IT Acceptable Use Policy.

3. Definition of personal data

Personal data is any information relating to an identified or identifiable living person. If an individual can be distinguished from others, either directly by a name or indirectly by combining multiple pieces of information, the data is considered personal. This includes obvious information such as name, address, email, birth date, and bank details, digital identifiers such as location data, IP address, mobile device IDs and social media handles, and indirect identifiers such as a car registration number.

Information that is highly sensitive and carries a higher risk of discrimination or harm falls under a special category with additional protections. The GMC does not currently record this type of data.

4. Policy aims

To implement this policy appropriately, the GMC will ensure that personal data will be handled in accordance with the principles of GDPR. Information will be:

•  used fairly, lawfully and transparently

•  used for specified, explicit and legitimate purposes

•  used in a way that is adequate, relevant and limited to only what is necessary

•  accurate and, where necessary, kept up to date

•  kept for no longer than is necessary

•  handled in a way that ensures appropriate confidentiality and security, including protection against unlawful or unauthorised processing, access, loss, destruction or damage.

The GMC will demonstrate accountability through the operation and review of this policy and its communication to Members and relevant organisations via the Club’s website. The policy will be reviewed biennially unless required earlier by legislation change or in the event of a data breach.

5. Holding personal data

The Club collects and uses personal data to:

•  maintain a membership register

•  communicate with Members

•  allocate marshalling roles, recognising experience and safety requirements

•  record participation in events, meeting local regulatory requirements

•  manage discipline, safeguarding and compliance matters

•  comply with legal, regulatory and insurance obligations.

To ensure personal data is collected and held in an appropriate manner, the GMC will:

•  undertake a Data Protection Impact Assessment when adopting new systems or technologies that might be involved in collecting, sharing or processing personal data

•  regularly review the extent and nature of information collected and held to ensure it satisfies the principles above (section 4)

•  justify and limit any data sharing, and ensure suitable arrangements are in place if data is shared with external partners

•  provide data subjects (Members and other individuals for which the GMC holds data) with clear guidance on how to exercise their rights.

Club Members, volunteers and committee members must ensure personal data is handled securely and lawfully under GDPR and should never share Member details with others without explicit permission.

GMC cadets are aged 11-16 years and parents must give consent to their membership if under 13 years. While parents may have authorised the initial data collection, cadets have the right to be informed and manage their own data. The rights and freedoms of children are the same as for adults.

6. Responsibilities

The GMC is both a data controller and data processor.

Data may be held and processed by Club Committee members with the following roles: Secretary, Membership Secretary, Safeguarding Officer, Media Officer, Regalia Officer, Social Secretary, Sponsorship Co-ordinator, Track Day Organiser and Training Officer. The Club Secretary is responsible for privacy and data compliance.

All role holders are obliged to:

•  undertake training on data protection and information security when required

•  ensure data they hold is up to date

•  provide information to the Club Secretary in the event of a Subject Access Request (section 7) or any data breach investigation (section 9)

•  recognise that any information linked to an individual can be requested by that individual and, therefore, any notes made on that information should be appropriate, justified and relevant

•  keep any personal data they hold secure and ensure that it is not disclosed to any third-party by accident or otherwise without appropriate authorisation from the Club Secretary.

The Directors will monitor the effectiveness of this policy.

7. Individual rights

Under the UK GDPR, individuals have significant rights regarding their own personal data.

These include the right to:

•  be informed about how their data is being collected and used

•  access personal data (Subject Access Request)

•  rectify incorrect data

•  request erasure of data unnecessarily held

•  stop or restrict the processing of their data

•  data portability, allowing an individual to obtain and reuse their data for other purposes

•  object to how their data is processed in certain circumstances.

There are further rights when an organisation is using personal data for:

•  automated decision-making processes (without human involvement)

•  profiling, for example to predict an individual’s behaviour or interests.

To ensure a timely response, a Subject Access Request should be made in writing to the Club Secretary; the GMC will reply within one calendar month.

8. Raising a complaint

An individual may make a complaint to the Club Secretary if that individual considers that, in connection with their personal data or that of someone they are acting on behalf of, there has been an infringement of the UK GDPR.

By way of example, data protection complaints may include:

•  concern over how the Club has responded to their subject access request

•  the security measures used to store their information, for instance if someone has been impacted by a data breach

•  how someone’s personal information has been collected or used, for instance where it has been stored, how long it has been kept or its accuracy.

9. Retention and security of data

All records (including electronic, printed and handwritten) must be held securely to prevent unauthorised or unlawful processing or disclosure of information. To ensure security, hard copy data must be locked away, information being processed must not be visible to anyone not authorised to see it, and data should be stored only on GMC systems, with password protection if necessary. Role holders should not store Club data on mobile phones or save directly onto personal portable storage media. Such data should not be emailed without appropriate password protection or encryption.

Records will be retained only for as long as necessary; in the case of specific documentation, e.g. safeguarding incidents, advice will be taken on the appropriate duration.

To accord with GMC Rules, Member records will be held for the period of membership and for 5 years following.

10. Reporting of a data breach

A GDPR breach is any security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data. These incidents generally fall into the following main categories:

•  Human error and administrative mistakes such as misdirected communications and accidental permanent deletion of records

•  Cybersecurity and hacking incidents, including malicious links to gain access to databases (phishing) and infiltration and encryption of an organisation’s database (ransomware attacks)

•  Insufficient access controls allowing unauthorised third-party use or access to held data

•  Loss or theft of, or damage to, equipment, files or storage devices

•  The misuse of access rights by representatives of an organisation.

If a data breach occurs, the GMC must immediately assess the extent of the breach and, if it meets the qualifying threshold, inform the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the incident. If the breach poses a "high risk" to the rights and freedoms of individuals, those affected must also be notified without undue delay. Any breach will require an internal investigation and effective mitigating action.

Regardless of whether a breach meets the threshold for reporting to the ICO or informing individuals, the GMC will maintain a comprehensive internal log of all data breaches. This documentation must include the facts surrounding the breach, its effects, and the remedial action taken.

11. Non-compliance with policy

The data protection legislation is overseen and enforced by the ICO. This Office has the power to conduct investigations in the event of a data breach and to impose significant fines on the GMC for non-compliance.