This Privacy Policy was updated on 14th March 2021 with the Charity’s new office address:
General
We (Challenge Wales, Charity No: 1111859) are committed to protecting and respecting your privacy and take this very seriously.
The purpose of this Privacy Policy is to inform you what kind of information we may gather about you when you visit our website, contact us by phone, personally or in writing or provide us with paperwork relating to a trip, how we may use that information, whether we disclose it to anyone, the choices you have regarding our use of that information, and how you can correct that information. We may change this Privacy Policy at any time, and using or accessing a website to which it relates indicates your acceptance of this Privacy Policy and of any changes to it.
Who we are
We are the charity Challenge Wales. Our registered office is: Crown House, Windsor Road, Penarth, Vale of Glamorgan, CF64 1JG and our company number is 05342397.
What is personal data?
Personal data is defined by the General Data Protection Regulation (EU Regulation 2016/679) (the ‘GDPR’) as ‘any information relation to an identifiable person who can be directly or indirectly identified.’
Personal data is information that enables you to be identified. This covers information such as your name and address but also other information such as identification numbers, electronic location data and other online identifiers.
Data protection principles
We will comply with data protection law including the 6 principles of GDPR which are:
- To process your personal data lawfully, fairly and in a transparent way.
- To collect your personal data only for valid purposes that we have advised you about and to not use your personal data in any way that is incompatible with those purposes (unless we have notified you and explained the lawful ground that allows us to do so).
- To only process your personal data to the extent necessary for the purposes we have advised you about.
- To keep your personal data accurate and kept up to date.
- To keep your personal data only as long as necessary for the purposes we have told you about.
- To keep your personal data secure.
What we collect
Most of the personal data we collect is provided freely by you when filling in sign up forms on our website, paper forms or verbally asking us to put you on our mailing list.
If you subscribe to join our mailing list we will ask for information that may include your name, address, email address, telephone number, age, gender, occupation, credit card details, details of sailing experience /hobbies and details you are interested in receiving further information on.
Occasionally, we may offer visitors to our website an opportunity to participate in a survey or competition. We may also run competitions and surveys in magazines, newspapers, radio, television, by direct mail, with third parties including on their websites and on other similar media. Information collected by Challenge Wales when you participate may include your full name, age, postal address, email address and telephone number. This will only be used for the purpose of the survey and competition and will not be used for marketing purposes unless you have consented.
If you sail with Challenge Wales we will require a booking form and medical declaration form to be completed. Other forms that you may complete for Challenge Wales’ purposes include a bursary form, volunteer form, consent form, crew list form and any other forms deemed required at the time. These forms may ask for information that will include your name, address, email address, telephone number, next of kin details, date of birth, age, gender and medical information. This information is only required for the purposes of the voyage and forms the contract for your booking and is the legal basis of processing.
We may also collect details of ethnicity, racial origin, disability and religion. When this is collected this is used anonymously.
For employees we will retain HR records, National Insurance details, bank details, pay slips, performance information and other personal information solely relevant to being an employee. The legal basis for processing is this forms part of a contract.
Anyone wanting to be a volunteer or is offered a salaried or freelance position will need to be DBS checked in line with our child protection policy. The Challenge Wales office do not retain DBS certificates and we will request signed consent from you before undertaking a DBS check.
What we do with your personal information
Under the GDPR, we must always have a lawful basis for using personal data. This may be because the data is necessary for our performance of a contract with you, you have consented to us using your personal data or because it is in our legitimate business interests to use it.
By becoming a subscriber (giving your consent) either on this website or through the Challenge Wales office, or by signing up to our newsletter you consent to receive from us our e-newsletters/marketing or details of special offers or products which we may think may be of interest to you.
By making a booking through Challenge Wales office you consent to receive from us our e-newsletters/marketing or details of special offers of products which we may think may be of interest to you only if you have opted in and giving your consent for this information.
If you are taking part in a Race or Regatta we will require the names, dates of birth, gender of those taking part to comply with age rules of the event and issue age-related prizes. To do this we require consent for each event. The trainee’s consent can be removed at any time by contacting Challenge Wales who will advise the race organiser.
A designated person ashore / crew emergency contact details are required for everyone sailing on a Challenge Wales vessel. The purposes for this is to enable the charity to contact the next of kin in the event of an emergency. The legal basis for processing this data is to protect the crew’s vital interest. This information is destroyed after the voyage has finished.
Your information will be held for our internal use to allow us to improve the services and products we offer, your customer experience, and to enable us to comply with our contractual obligations. Information provided for voyages will be destroyed within two months of the end of your voyage.
Your information and next of kin information will be held for our use and used in relation to a booking/sailing trip. Next of kin information will only be used should an emergency situation take place and if it is deemed necessary to contact the next of kin as part of the Emergency Management Response Plan. This information will be destroyed within four weeks of the end of a voyage or within four weeks after you have stopped volunteering with us.
By becoming a volunteer, which is only on completion of a volunteer form, you consent to receiving Challenge Wales communications relating to volunteering opportunities and Skipper updates. This may be by email, phone or in writing. If you are a volunteer you can opt-out of this but this will mean Challenge Wales will not be able to communicate to you about volunteering opportunities.
If you telephone us, calls may be recorded for training and quality purposes.
We will only share your personal information with our authorised travel service providers, and only as necessary in order to complete a transaction that you have specifically requested.
We do not sell, rent, pass on or trade your personal information (including next of kin) to third parties without your express consent unless required by law to do so.
Your details may be provided to security or credit checking companies, public authorities such as customs/immigration if necessary, or to others as required by law.
We may also pass your details to any successor to our business (or any relevant part of it).
We may anonymise your personal data (so that you can no longer be identified from such data) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.
Bursary Forms may be required to be passed onto the funder for reasons of issuing payment to either the individual, organisation or Challenge Wales. These forms may / will contain personal information. This information will not be used for marketing purposes but only to enable distribution of funding and for monitoring purposes. Challenge Wales does not accept responsibility for how the personal data is handled after it has been passed to the funder however, we make it clear to the funder the sensitivities of the data.
Information you provide may also be used for statistical purposes. For further details please refer to the section ‘IP addresses and Cookies’.
Consent
By disclosing your personal information to us on our website, by email, through a donation/fundraising form or over the telephone, you consent to the collection, storage, processing and other use of your personal information by us in the manner set out in this Privacy Policy. Some information and emails sent to us or appearing on the Challenge Wales Facebook page (or similar media) may be used as testimonials or case studies but no email address or contact details will be displayed.
How to unsubscribe
If you subscribe to receive email, direct mail or other marketing communication from us, you can unsubscribe at any time by clicking on an unsubscribe link on the email or by contacting us at:
Data Controller, Challenge Wales, 20 Glebe Street, Penarth. Vale of Glamorgan. CF64 1EE or email: datacontroller@challengewales.org
If you do not want your details used for marketing purposes please advise us at the above address.
How we protect your information
Protecting your data is important to us and we have put in place security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We also limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know such data. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
The personal information we collect may be transferred to and stored in countries outside of the UK and the European Union. By submitting your personal data you agree to the storing and processing of this data. We will take all reasonable steps to ensure that your data is treated securely and in accordance with this privacy policy. Some of the data processors we use are:
1) Mailchimp (for our e-newsletters) – Mailchimp are signed up to the “Privacy Shield” “Privacy Shield” means the EU-US Privacy Shield and Swiss-US Privacy Shield Framework self certification program operated by the US Department of Commerce and approved by the European Commission pursuant to Decision C(2016)4176 or 12 July 2016 and Swiss Federal Council on January 11 2017 respectively.
2) Salesforce (as our database) – Salesforce certify compliance with the EU-US Privacy Shield Framework
We have put in place procedures to deal with any suspected personal data breaches and will notify you and any applicable regulator of a breach where we are legally required to do so.
We may send your details outside the European Economic Area (EEA), e.g. if a sailing trip takes you outside the EEA and a hotel/travel service provider needs to be advised of your details. Due to the global nature of the infrastructure of the internet please be aware that controls on data protection outside the EEA may not be as strict as in the UK.
We may send your details to funders (if you have applied or received a bursary). The funder will be responsible for managing this data in line with UK data protection regulations.
IP addresses and Cookies
A cookie is a small file that a website transfers to the cookie file of the browser on your computer’s hard disk so that the website can remember who you are. Cookies identify the computer you are using, not you personally. You can find out more about cookies on www.allaboutcookies.org
On www.challengewales.org we use analytics to understand which website pages you are visiting and to help improve the customer journey through the website and site effectiveness. This data allows us to improve the quality of your visit and develop programs, navigation and content that will be of interest to you. Analytics leaves cookies on your browser but this does not identify you personally.
We collect information about your computer (not your name, address, email address or telephone number) through your permanent cookie file for the purpose of assessing the effectiveness of site content and traffic. This data allows us to improve the quality of your visit.
A cookie statement is on the bottom of our website. Most browsers will allow you to turn off cookies. If you want to do this please look at the menu on your browser, or look at the instruction on www.allaboutcookies.org. Turning off cookies may restrict your use of our website.
Links to third party sites
Our websites may contain hyperlinks to websites operated by parties other than us. Such hyperlinks are provided for your reference only. We do not control websites which we do not operate, and are not responsible for their contents or your use of them. Inclusion of these links to such websites does not imply any endorsement of the material on such websites or any association with their operators.
Access to information and your rights
You have the right of access and to ask us in writing for a copy of the information which we hold about you. Any request should be addressed to: Data Controller, Challenge Wales, Crown House, Windsor Road, Penarth, Vale of Glamorgan, CF64 1JG.
You have the right to rectification if you believe that any of your personal information that is held or being processed is incorrect then please contact us immediately at the postal address or email address below. Any information found to be incorrect will be corrected as soon as possible.
You have the right to withdraw consent to the process of your personal data at any time by emailing datacontroller@challengewales.org. You can also unsubscribe to our marketing emails at any time by using the unsubscribe link.
You have the right to request the deletion of your data. We will follow a formal process and respond within 5 working days to acknowledge we have received the request. Once the request has been received it will take no more than 7 business days for it to be completed. Please email datacontroller@challengewales.org or our general email address via our website to request deletion of your data.
If at any time you believe that we have not adhered to these principles, please notify us by email at datacontroller@challengewales.org or write to us at Data Controller, Challenge Wales, Crown House, Windsor Road, Penarth, Vale of Glamorgan, CF64 1JG.
Updating this Privacy Policy
We may update or amend this Privacy Policy from time to time, to comply with law or to meet our changing business requirements. When we do we will take appropriate measures to inform you, consistent with the significance of the changes we make. Any updates or amendments will be posted on the Website.