Privacy Policy

Last updated: 28 September 2026

Who we are

We are Vale of York Athletic Community (Vale of York), a charitable incorporated organisation registered in England and Wales, charity no. 1197044. Our postal address is c/o Selby Leisure Centre, YO8 4BL. Our website addresses are https://valeofyork.org and https://valeofyork.com.

Vale of York is committed to protecting and respecting your privacy. For the personal data we collect about members, parents and guardians, volunteers, enquirers and website visitors, Vale of York is the data controller. This means we are responsible for processing that data fairly, lawfully, securely and transparently, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about this policy or how we use your personal data, please email ian@valeofyork.org or write to us at the address above.

What personal data we hold

You may give us personal data by filling in forms online or at an event, by registering with us on Teamo, by subscribing to our newsletter, or by contacting us by phone, email or a website form. This may include:

  • your name, date of birth, gender, address, email address and phone number;
  • the England Athletics affiliated clubs you are registered with, your England Athletics registration details, and your performances and results (together, your “Athletics Data”);
  • emergency contact details and, for junior members, parent or guardian details;
  • relevant health, medical or disability information, which is special category data;
  • whether you consent to photos and video of you, or your child, being used by the club;
  • photos and video taken at club sessions and events.

How we use your personal data and our lawful bases

Under UK GDPR we must have a lawful basis for each way we use your data.

Membership, training and competition (contract). We need your Athletics Data to process your registration and payments, run training sessions and provide the services you sign up for. This includes:

  • sharing personal data with our coaches and officials to run training sessions;
  • sharing personal data with team managers to enter events;
  • sharing personal data with facility providers to manage access to the track or check delivery standards;
  • sharing personal data with leagues, county associations (including county schools’ associations) and other competition providers to enter you in events;
  • registering competitive members with England Athletics (see below).

Running the club (legitimate interests). We use your data where it is necessary for the club’s legitimate interests and does not override your rights. This includes:

  • sending members our newsletter and information about club activities, renewals and social events (you can opt out at any time);
  • publishing race and competition results and club records;
  • sharing information with our trustees to manage the charity;
  • analysing anonymised data to monitor trends and meet the conditions of grant funding;
  • sending an annual survey to improve your experience as a member.

Safeguarding (legal obligation, legitimate interests and substantial public interest). We keep and share information where needed to protect children and adults at risk, following the UK Athletics safeguarding policies and procedures. Where this involves special category data, we rely on the safeguarding of children and individuals at risk condition in Schedule 1 of the Data Protection Act 2018.

Health information (explicit consent). Any health information we hold is only used for fitness or health checks, or passed to coaches so that training sessions can run safely. We will ask for your explicit consent when we collect it.

Photos and video (consent). Photos and video in which you can be identified are personal data. We only publish images of members on our website, newsletters, social media and publicity materials where consent has been given. Consent is collected at registration and renewal on Teamo, from a parent or guardian for anyone under 18. For non-members at fun days, taster sessions and camps, it is collected on the sign-up form. How we take, publish and store images is set out in our Photography and Video Policy, which includes these safeguards for under 18s:

  • we never publish a child’s surname alongside their photo, including in captions, image filenames, alt text and web addresses;
  • we do not publish details that could identify where a child goes to school or can regularly be found;
  • we remove hidden location data from images uploaded to our website.

Marketing (consent). Where you have given separate consent, we may send you information about offers from sponsors, club kit, merchandise or fundraising.

Non-members (consent). We may collect personal data from people who are not registered with us, for example a health disclaimer or form at a taster session, fun day or summer camp. We will ask for explicit consent when we collect it. This information is securely destroyed 28 days after the event.

Where we rely on consent, you can withdraw it at any time by emailing ian@valeofyork.org, or for photos and video welfare@valeofyork.org. Withdrawing consent does not affect anything we did before you withdrew it. For photos, we will stop using the images and remove published ones from our website and social media accounts.

We do not make any decisions about you based solely on automated processing, and we do not sell your personal data.

Children’s data

Many of our members are children. We take particular care with their data. Registration for anyone under 18 is completed by a parent or guardian, who also gives or withholds consent for photos and video. Young people aged 12 and over are asked for their views on photos, and their wishes are respected. A parent or guardian can exercise their child’s data protection rights on their behalf, and young people can exercise their own rights where they understand what that means.

Who we share your personal data with

When you choose to represent Vale of York as a competitor, or renew your competitor registration, you will automatically be registered as a member of England Athletics Limited. We provide England Athletics with your Athletics Data, which they use to give you access to the MyAthletics portal. England Athletics will invite you to sign in and update your details, and you can set your privacy settings in the portal. For questions about how England Athletics uses your data, please contact dataprotection@englandathletics.org.

We also use trusted service providers to process data on our behalf, including Teamo for membership and payments, Google for email and file storage, and our website hosting provider. They may only use your data on our instructions.

Other than as described in this policy, we do not share your personal data with any third party unless the law requires us to.

Some of these providers store data outside the UK. Where your data is transferred overseas, we make sure appropriate safeguards are in place, such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.

We use Facebook, Instagram and Threads pages and groups. These platforms have their own privacy policies, which apply to any personal data you share on them.

How long we keep your personal data

  • Members: for as long as you are registered with us. Athlete data is updated every year through our annual registration process, and is securely destroyed after four years of inactivity, in line with England Athletics’ retention policy.
  • Non-members at events: securely destroyed 28 days after the event.
  • Enquiries and website forms: kept only as long as needed to deal with your enquiry or free trial, and deleted within 12 months.
  • Photos and video: unpublished images are deleted after 2 years unless kept for a clear reason, such as the club’s history. Published images stay online unless you ask us to remove them.
  • Results and club records: kept permanently, as part of the sport’s historical record.

Keeping your data secure

We limit access to personal data to the coaches, volunteers and trustees who need it, and use secure, password-protected systems. If a data breach occurs that puts your rights at risk, we will tell you and, where required, the Information Commissioner’s Office.

Your rights

Under UK GDPR you have the right to:

  • be told how we use your personal data (this policy);
  • access a copy of the personal data we hold about you;
  • ask us to correct data that is wrong or incomplete;
  • ask us to erase your data;
  • ask us to restrict how we use your data;
  • object to us using your data, including for direct marketing;
  • data portability;
  • withdraw consent at any time, where we rely on consent.

Some of these rights only apply in certain circumstances. To make a request, email ian@valeofyork.org. We will respond within one month.

You are not obliged to give us your personal data, but if you choose not to, we may not be able to register you or provide our services.

If you are unhappy with how we have used your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Our website

Contact and free trial forms

When you use a form on our website, we collect the details you enter so we can reply. Form submissions are stored securely in our website and sent to us by email.

Images on our website

Hidden data, including GPS location, is automatically removed from images uploaded to our website.

Cookies

We do not use analytics, advertising or tracking cookies on our website. We use Google Search Console to see how people find our website through Google search, which does not place cookies on your device.

The only cookies we set are strictly necessary ones for website editors. If you visit our login page, a temporary cookie checks that your browser accepts cookies, and when editors log in, further cookies save their login and screen choices. These are not used for ordinary visitors. Embedded content from other websites may set its own cookies (see below).

Embedded content from other websites

Pages on this site may include embedded content from other websites, such as our Instagram feed, Google reviews, maps and videos. Embedded content behaves in the same way as if you had visited the other website. Those websites may collect data about you, use cookies and track your interaction with the content, especially if you are logged in to them.

Comments

Comments are currently switched off on our website. If they are switched on in future, we will collect the details in the comment form, your IP address and browser details to help detect spam. An anonymised string created from your email address may be sent to the Gravatar service to check whether you use it (Gravatar privacy policy: https://automattic.com/privacy/).

Changes to this policy

We review this policy regularly and will post any changes on this page, with the date it was last updated.