Last updated: 19/11/2025

Miss Poppy's Gymnastics ("we", "us", "our") is committed to protecting the personal data of our gymnasts and their families. This policy explains what information we collect, how we use it, and your rights under UK data protection law (UK GDPR and Data Protection Act 2018).

1. Data Controller Details

Data Controller: Miss Poppy's Gymnastics

Email: poppy@misspoppysgymnastics.co.uk

Phone: 07875222918

Address: "available on request"

2. Data Protection Principles

We follow the UK GDPR principles. Personal data must be:

  1. Used lawfully, fairly and transparently
  2. Collected for specific, explicit and legitimate purposes
  3. Adequate, relevant and limited to what is necessary
  4. Accurate and kept up to date
  5. Retained only for as long as necessary
  6. Kept securely with appropriate technical and organisational measures

3. What Personal Data We Collect

We may collect:

For children / gymnasts:

  • Name, date of birth, contact details
  • Medical information, allergies, injuries (special category data)
  • Behavioural/welfare information where relevant to safety
  • Attendance, progress and performance records
  • Photographs or videos for marketing or club promotion
  • Competition entry details

For parents/guardians:

  • Name and contact information
  • Emergency contact details
  • Address
  • Billing and payment information
  • Communications sent to or received from you

4. Lawful Bases for Processing

We rely on the following lawful bases:

a. Performance of a Contract

To provide gymnastics training and manage membership, including:

  • Enrolment
  • Class administration
  • Communication about sessions, changes, and fees
  • Processing payments

b. Legal Obligation

To meet regulatory and safeguarding duties, including:

  • Safeguarding children
  • Responding to legal or official requests
  • Maintaining financial records

c. Legitimate Interests

To operate and improve our club, such as:

  • Managing records and administration
  • Promoting the club using images and videos
  • Ensuring safety and security
  • Communicating general club updates

We balance these interests against your rights and will stop processing if you object and no overriding reason exists.

d. Vital Interests / Safeguarding

To protect a child or individual from serious harm. This includes processing health information or sharing details with authorities where necessary.

e. Special Category Data

Where we process health information, we do so under:

  • Article 9(2)(c) - Vital Interests, or
  • Article 9(2)(g) - Substantial Public Interest (Safeguarding)

5. How We Use Personal Data

We use data to:

  • Deliver safe gymnastics coaching
  • Maintain accurate attendance and health records
  • Contact you about classes, cancellations, updates and events
  • Enter gymnasts into competitions and events
  • Process payments
  • Respond to queries or complaints
  • Promote the club (photography/video - you have the right to object)
  • Ensure welfare and safeguarding

6. Photography, Videos and Media

We may take photos/videos during classes, displays, events or competitions for:

  • Club promotion
  • Website and social media
  • Marketing materials
  • Demonstration of techniques

If you do not want your child's image used, you may object at any time, and we will ensure they are excluded from marketing media.

Images may continue to be used after a child leaves unless you withdraw your permission or object.

7. Sharing Personal Data

We only share information when necessary and lawful. This may include:

  • Gymnastics organisations - for competition entries
  • Local authorities - for safeguarding or legal obligations
  • Police - where required
  • Legal advisers - for legal advice or in case of disputes
  • Insurance providers - in the event of incidents or claims
  • Courts/solicitors - for recovery of unpaid fees

We do not transfer personal data outside the UK.

8. Data Security

We use appropriate security measures, including:

  • Password-protected systems
  • Restricted access to child data
  • Secure storage of paper documents
  • Staff awareness and training on data handling

9. Data Retention

We keep personal data only as long as necessary.

  • Member records: 3 years after leaving
  • Accident/safeguarding records: as required by law (typically 5-25 years, depending on age and nature of incident)
  • Financial records: 6 years (legal requirement)
  • Photos/videos: Until you withdraw objection or for up to 5 years, unless removed earlier upon request

10. Your Rights

You have the right to:

  • Access your data
  • Request correction
  • Request deletion (where lawful)
  • Restrict processing
  • Object to processing (including marketing and photography)
  • Request data portability
  • Be informed about data usage

We will respond within one month.

11. Complaints

If you are unhappy with how we use your data, please contact us first.

If unresolved, you can contact the ICO:

Information Commissioner's Office
www.ico.org.uk
0303 123 1113

12. Changes to This Policy

We review this policy regularly.

This notice was last updated on: 19/11/2025