To join Penge CC, we require some key information from you that is classified as ‘personal data’ under the current data protection legislation. As the organisation collecting this data, Penge CC has certain obligations as a data ‘controller’ but, ultimately, the data always belongs to you and you have the rights to request that we delete all your data from our systems or to transfer all the data we hold on you to you or another 3rd party at your request.
What information do we request?
When you apply to be a member of Penge CC, there is certain information we must have to manage your membership and allow you to ride safely with our group rides and to keep you informed of club activities. This information may vary from time to time and we will keep you informed if it does change. Currently, we ask for:
- Telephone number (home)
- Telephone number (mobile)
- Email address
- Emergency contact name & relationship
- Emergency contact number
- 3rd party liability insurance provider
- 3rd party insurance membership number and expiry date
- Bank account number
- Bank sort code
- Bank account name
- Membership start and expiry dates
- Any medical information you have told us about
Information in addition for youth riders:
- Parent’s/carer’s names
- Date of birth
- School attended and school year
If you chose to pay via credit or debit card for membership or for other purchases, we request:
- Card number
- Card expiry
- Card CVV
How do we use this data?
There are four key uses we have for the above data:
- Managing your membership. When you join Penge CC, your membership lasts for 1 year. We take payment from your bank account via direct debit or the card provided for the amount of your membership fee. Should you enable the automatic membership renewal function, we will take payment for your renewal at the appropriate time. As part of this joining and renewal process, you will receive a series of automated emails confirming your membership and pre-warning you of its expiry.
- Taking payments for other goods and services. As part of your membership, you are eligible to take part in a number of club activities and to purchase items of kit using the payment methods provided as part of your membership application. For example, if you wish to sign on for a course of Turbobeat sessions, you can apply and pay using the details stored as part of your membership.
- Providing contact and emergency contact details for group rides. Our practice, for safety reasons, is for ride leaders to hold mobile numbers for all riders in their group along with the corresponding emergency contact details. The exact method for achieving this may change, but our guiding principle is that this data is kept as secure as is practical and that it is deleted or destroyed at the end of the ride.
- Communications with members. There are a number of regular and ad hoc communications to members covering all aspects of club activity, from the statutory meetings such as the AGM, to weekly newsletters and one-off communications to promote an event, such as the time trial series. There are also communications from Penge CC regarding services provided by our club sponsors or other carefully selected organisations that are integral to the running of a diverse and active club. Usually, these communications use email to support posts on the club website and social media pages. Such communications will always come from the club, not from the sponsors.
Looking after your data
Penge CC uses the services of a 3rd party to manage membership. Currently, this is Rider HQ. As a sub-contractor (data processor), Rider HQ has an obligation under the terms of our agreement with them to manage our data securely. The following is a summary of their commitment to us:
- We undertake not to export your data outside the European Economic Area.
- We may store your data in several data centres for availability/disaster recovery reasons, but all are located within the EU (currently Ireland, Frankfurt, London and York).We operate strong security controls for RiderHQ personnel accessing customer data and do not allow the use of data other than for the purpose of supporting you or maintaining our service.
- Our organisation is segmented and access to customer data is allowed only if the accessor’s role requires it. (For example sales and managerial roles have no access to customer data unless granted it by the customer).
- Should you wish to export your data from RiderHQ we will provide it to you in a reasonable format (e.g. Spreadsheet / CSV).
- Subject to your instruction, we will remove all your data from RiderHQ.
- We will provide you with the means to manage data which are held in RiderHQ such that you can correct any errors and delete un-needed data from storage.
- We will not share your data with third parties without your explicit permission.
Deleting your data or opting out of communications
Should you decide that you do not want the club to process your data at all, we are unable to manage your membership so will cancel your membership and either permanently delete or transfer your data to you or a 3rd party. In this circumstance, you will not be eligible for a refund on your membership
Should you choose to opt-out of email or phone communication, you can amend your contact preferences and will no longer receive emails regarding special events or other activities. You will continue to receive communications regarding your membership and details of any AGMs or EGMs. Your data will still be used to generate ride lists for ride leaders and for other events you enter. (e.g. Time trial, Turbobeat)
We do not provide your data to 3rd parties
Except when required to do so by law enforcement or government agencies, we will not share personal data with other 3rd parties for any purpose without your express permission. The only exception to this are agencies such as Rider HQ who we engage to manage operations on our behalf.
Our legal obligations
Penge CC is committed to full compliance with the latest data protection legislation, including the General Data Protection Regulation (GDPR), enforceable from 25th May 2018.
A summary of our obligations is as follows:
- Before or at the time of collecting personal information, we will identify the purposes for which information is being collected.
- We will collect and use of personal information solely with the objective of fulfilling those purposes specified by us and for other compatible purposes, unless we obtain the consent of the individual concerned or as required by law.
- We will only retain personal information as long as necessary for the fulfilment of those purposes.
- We will collect personal information by lawful and fair means and, where appropriate, with the knowledge or consent of the individual concerned.
- Personal data should be relevant to the purposes for which it is to be used, and, to the extent necessary for those purposes, should be accurate, complete, and up-to-date.
- We will protect personal information by reasonable security safeguards against loss or theft, as well as unauthorized access, disclosure, copying, use or modification.
- We will make readily available to members information about our policies and practices relating to the management of personal information.
Cookie and tracking technology
Photography and video
The club, and club members and supporters, often take photographs and video of our rides, races and social events. We use these to promote our club and the activities we run. These images are stored on this website, our Flickr gallery and any social media sites, like our Facebook group.
By joining the club you give your permission for us to do this on our own channels. If you leave the club we will still use these images as a historic record and to promote our club.
If we are approached by a partner, supplier, press contact or corporate marketing team, we will always try and get your permission for the specific usage if you are central to the content. If it is a group shot of an event and your face is not the main focus, we will class you as ‘Incidental Inclusion’ and will not seek individual permission. This is done at the discretion and judgement of the club committee member involved at that time.
If at an event you do not wish to be the focus of a photograph or video please let the photographer or videographer know. If later, you want an image or video deleted for a valid reason, we will strive to remove it and delete it where practical and when within our abilities.
If you leave the club, we will still use these images as a historic record and to promote our club to future members.
Please note: As explained on Facebook, any photographs posted on our Penge CC Facebook group may also be used to promote the club on our own website and 3rd parties and may be shared for PR media opportunities.
Images posted to Facebook or other social channels will also fall under specific usage agreements of that platform.
Privacy contact information