2.Purpose
The Club respects members’ privacy and will collect and use personal information only when it is lawful, fair, transparent and necessary for legitimate club activities. The Club will keep personal information secure and will not keep it for longer than necessary.
3. What information we may collect
Name and preferred contact details (email, telephone and/or postal address).
Membership details, such as membership date and subscription/payment records.
Photography-related information voluntarily provided by members, such as competition entries or workshop preferences.
Emergency/contact information only where genuinely necessary and with appropriate safeguards.
Photographs or video in which a member or guest may be identifiable, where applicable.
4. Why we use personal information
To administer club membership and communicate about meetings, activities and events.
To organise workshops, photo walks, competitions, exhibitions and similar activities.
To maintain appropriate financial and administrative records.
To manage safeguarding, health-and-safety or emergency arrangements where necessary.
To publish club news or photographs where the relevant lawful basis and permissions apply.
5. Lawful basis
For each processing activity, the Club will identify an appropriate UK GDPR lawful basis. Depending on the activity, this may include contract, legitimate interests, legal obligation, or consent. Consent will be used where appropriate, particularly where publication or other use is optional and not necessary for membership.
6. Photography and images
An identifiable photograph can constitute personal data. The Club will explain how event photographs may be used. Where consent is the chosen lawful basis, members/guests can withdraw consent for future use. The Club will take reasonable steps to respect objections and will not assume that permission for one purpose automatically covers another.
Photography/publication preference (complete as appropriate):
? I am happy for photographs of me taken at Club activities to be used in Club communications/social media/website.
? Please do not use identifiable photographs of me for public-facing promotion.
? Other agreed restriction: __________________________________________
7. Sharing information
Personal information will only be shared where there is a lawful reason to do so. It may be shared with committee members, event organisers, venues, service providers or relevant authorities where necessary. The Club will not sell members’ personal data.
8. Mailing lists and group communications
Club emails should use Bcc where recipients should not see one another’s email addresses, unless all recipients have knowingly agreed to a visible group mailing arrangement. Messaging groups should be used carefully and members should be told who can see their details. Optional promotional communications should have an appropriate lawful basis and unsubscribe/opt-out mechanism.
9. Storage and security
Digital records should be protected by strong passwords and, where available, multi-factor authentication.
Access should be limited to committee members/volunteers who need the information for their role.
Paper records should be stored securely and not left in public view.
Personal data should not be stored on shared/public computers or removable media without suitable protection.
Lost devices, misdirected emails or other suspected data breaches must be reported promptly to the Data Protection Lead.
10. Retention
The Club will keep information only for as long as necessary for the purpose for which it was collected, taking account of legal, accounting and safeguarding requirements.

11. Members’ data protection rights
Depending on the circumstances and lawful basis, individuals may have rights including access to their personal data, correction, erasure, restriction, objection and data portability. The Club will respond to valid requests within the applicable legal timescales.
12. Data breaches
A suspected breach includes loss or theft of a device or paper record, sending personal information to the wrong person, unauthorised access, or accidental disclosure. Report it immediately to the Data Protection Lead. The Club will assess the breach and take any required action, including notifying the ICO or affected individuals where legally required.
13. Children and vulnerable people
If the Club works with children or vulnerable people, it will use age-appropriate privacy information and obtain any permissions required for the particular activity. Photography and publication arrangements should be agreed with the appropriate parent/guardian or individual as applicable.
14. Complaints
Members should first contact the Club’s Data Protection Lead using the details above. If they remain dissatisfied, they may complain to the Information Commissioner’s Office (ICO).
15. Review
This policy and the Club’s privacy notice will be reviewed at least annually and whenever there is a significant change to how personal information is collected, used, stored or shared.
Member acknowledgement
Name: ______________________________________________
Signature: ___________________________________________ Date: ______________
I have been given access to the Club’s privacy notice and understand how my personal information is used.

Useful official guidance: Information Commissioner’s Office (ICO) – small organisations, privacy notices and data protection.