CUYC Privacy Notice, Revision 2, last amended by the CUYC Committee 18th April 2024.
Data Sharing Agreement – Cambridge University Yacht Club
This statement explains how Cambridge University Yacht Club ("CUYC", "the Club", "we", "us" and "our") handles and uses the personal information we collect about our members for processes relating to our operations and activities.
"Personal Information" is collected through voluntary completion of club membership and event registration.
Data Categories:
● Name and contact details.
● Unique personal identifier and biographical information (e.g.: date of birth).
● Education information.
● Financial information.
● Visual images.
● Special categories of personal data, including data concerning health , biometric data (where used for identification purposes), and personal data revealing racial or ethnic origin.
When changes are made to this statement, we will publish the updated version on this website.
The controller for your personal information is Cambridge University Yacht Club. The person responsible for data protection within CUYC is the Website Admin, who can be contacted at webmaster@cuyc.org.uk.
How we use your personal information
We collect and process your personal information for purposes, including:
● Maintaining your personal details (such as your name and preferred contact details) in order to ensure effective communications with you. For example, to keep you informed about the time and location of CUYC events.
● Maintaining a record of your sailing experience and qualifications for training development, and so that trip organisers are aware of a crew’s individual and collective experience.
● Keeping financial records, such as payment of membership fees, trip fees, and trip expenses.
● Keeping a record of your activities with us.
● Alumni relations and fundraising purposes specifically related to CUYC.
● Complaints procedures.
● Keeping you up to date with information because you hold a particular qualification. For example, a reminder about a qualification’s expiry date.
● In relation to DBS check applications and certificates for CUYC Skippers, Instructors, and Welfare Officers.
● Effectively and lawfully carrying out CUYC events, such as cruising trips, training, and racing.
● Administering your membership, and to provide you with membership benefits.
● Ensuring the safety of yourself and the rest of the crew during CUYC events, such as cruising trips, training, and racing.
● Ensuring that your participation in the sport is as safe as possible. For example, CUYC collects relevant medical information in order to enable CUYC to adequately respond to potential injuries, and to provide reasonable adjustments.
● Organising insurance cover via both Cambridge University and external insurance companies.
● Promoting CUYC events, such as publishing race results, lists of squads/teams, training and racing achievements, newsletters, cruising trips, training programmes, racing programmes, and social events.
● Publishing lists of past, current, and future Committee Members, Skippers, Instructors, and Trustees.
The lawful basis for processing your personal data for the interdependent purposes set out above is that it is necessary for the pursuit of our legitimate interests.
Our lawful basis for processing your special category personal data (e.g.: medical information and passports) is your explicit consent when signing up to CUYC trips to the processing of this data for the specified purposes set out above.
We always handle your personal data securely, minimise its use, and ensure there is no overriding prejudice to you by using your personal information for these purposes.
How long we hold your information
We hold your personal information for as long as your CUYC account exists.
We hold your special category personal data (e.g.: medical information and passports) for as long as is necessary for the specified purposes set out above. To determine the appropriate retention period, we will consider the amount, nature and sensitivity of that information; the potential risk of harm from unauthorised use or disclosure; and whether we can achieve the purposes for which we process that personal information through other means.
We will review your personal information regularly to establish whether we are still entitled to process it. If we decide that we are not entitled to do so, we will stop processing your personal information to the extent that it is appropriate to do so, and securely delete or anonymise it.
How we store your personal information
We use Cambridge University IT facilities to store an electronic copy of your personal information provided.
Special categories of personal data are stored securely and confidentially by the Skipper and Shore Contact, as outlined below under ‘how special categories of personal data are used on a typical trip’.
How we share your personal information
Personal information is not normally shared with third parties. However, we may share some of your personal information with third parties in the following situations:
● With the RYA for the purposes of maintaining standards of training, logging course participation, and registering certificates.
● With relevant emergency services, such as HM Coastguard.
● With the University of Cambridge, for example, in dealing with complaints or for fundraising through University platforms (e.g. Dear World...Yours, Cambridge).
● With business partners, suppliers, and sub-contractors for the performance of any contract.
We may also be subject to a legal requirement (with or without your consent) to share your personal information with the University of Cambridge or a government agency (e.g.: the police, security services, or other statutory authorities with investigatory powers) under special circumstances, such as matters relating to tax, crime, or health and safety. Where feasible and appropriate, we will notify you of our intention to share such information in advance.
How special categories of personal data are used on a typical trip
Medical information (i.e.: data concerning health):
● When signing-up to a trip, members inform the trip organiser (typically the Skipper) via email of any medical condition(s), and/or dietary requirement(s), and/or prescription medication(s) (“the member’s health data”).
● The Skipper shall use the member’s health data to ensure that each member’s participation in the trip is as safe as possible. For example, the Skipper requires medical information to ensure that meals are in accordance with all members’ allergies/dietary requirements, and that first aid is administered safely.
● In accordance with the CUYC Equal Opportunities Policy, the Skipper shall not use the member’s health data to influence selection for trips, except on the rare occasion that a member’s medical condition(s) and/or prescription medication(s) would create a serious risk to self/others during the trip. If such a risk exists, the Skipper shall contact that member for clarification of their particular circumstances, and to explain their reasoning.
● The Skipper shall securely store the member’s health data in a password protected word document. If this password protected word document is kept in the Skipper’s email account, it shall be stored in a separate subfolder in their inbox in order to mitigate the risk of accidentally emailing the member’s health data to another party.
● The Skipper shall share the member’s health data with the Shore Contact before the trip commences, who will store it in the same manner as the Skipper.
● The Skipper and Shore Contact shall only share the member’s health data with parties other than themselves on a genuine “need to know” basis. This includes, but is not limited to, a serious issue of risk to self/other, accidents requiring emergency services, serious concerns warranting CUYC policy change, and addressing complaints. In such circumstances, the Skipper and/or Shore Contact may have to disclose to the College/University, the authorities, the emergency services, and/or the CUYC Committee. Where feasible and appropriate, the Skipper and/or Shore Contact will notify the member of its intention to share such information in advance.
● At the end of the trip, the Skipper and Shore Contact will immediately delete all copies of the member’s health data. This includes, but is not limited to, the password-protected document itself; any documents relating to the member’s health data in their computer’s download folder; and any emails relating to the member’s health data in the inbox, sent folder, and deleted folder on their email account.
● In the rare event that the member’s health data is shared with someone other than the Skipper and/or Shore Contact, that party/those parties will also delete all copies of the member’s health data as soon as the trip ends.
● The Skipper and/or Shore Contact may decide to extend the retention period for some or all of the member’s health data in circumstances including, but not limited to, serious risk to self/others, serious concerns warranting CUYC policy change, addressing complaints, and taking disciplinary action. The extended retention period will be determined by considering the amount, nature, and sensitivity of that information; the potential risk of harm from unauthorised use or disclosure; and whether the Skipper and/or Shore Contact can achieve the purposes for processing that personal information through other means. The extended retention period and reasoning will be communicated to the member.
Passports (i.e.: biometric data, and personal data revealing racial or ethnic origin):
● If a marina requires the crew’s passports, they will be used by the Skipper solely for that purpose.
● The Skipper shall place all the crew members’ passports into one waterproof enclosed envelope or folder, such as a zip-lock bag or waterproof wallet.
● The Skipper shall hand the passports to the marina upon arrival.
● When the boat departs the marina, the Skipper shall collect the passports from the marina, and return the passports immediately to each crew member.
Your Rights
You have the following rights in relation to the personal information we hold about you:
● To access your personal information, and for CUYC to respond to reasonable information requests within one month.
● To have your personal information corrected, and for CUYC to respond to rectification requests within one month.
● To have your personal information erased (subject to exceptions), and for CUYC to respond to any valid requests within one month.
● To object to, or restrict, how your personal information is processed (subject to exceptions).
● To receive an electronic copy of your personal information.
Please note that erasing your personal information, or restricting how your personal information is processed, may prevent CUYC from continuing to provide services to you.
If you have questions or concerns about how your personal information is used, please contact CUYC’s Website Admin at webmaster@cuyc.org.uk.
If you remain unhappy with the way your information is being handled, or with the response received from us, you have the right to lodge a complaint with the Information Commissioner’s Office at Wycliffe House, Water Lane, Wilmslow, SK9 5AF (https://ico.org.uk/).