Privacy Notice

Version history

This notice is versioned. Every material change is recorded below. The current version is 1.2, last updated October 2026.

1. Who we are

UK Polocrosse Association (“we”, “us”, “our”) is the organisation responsible for the personal data described in this notice.

For the purposes of UK data protection law, UK Polocrosse Association is the data controller responsible for the personal data described in this notice.

2. Scope of this notice

This notice applies to all personal data we collect and process about:

• Members (adults and juniors)
• Guardians and parents who manage junior members’ accounts
• Club officials, administrators and event officials
• Guests booked for events by members
• Visitors to this website, including those who contact us via the contact form

It does not cover data processed by third-party websites we may link to. We encourage you to read the privacy notices of any external sites you visit.

3. The personal data we collect

We collect the minimum personal data necessary for each purpose. The categories below set out what we hold.

3.1 Account data

When you create an online account with the member portal, we collect:

• Email address, and any additional email addresses you add to your account
• Password (stored as a one-way cryptographic hash; we cannot read your password)
• Account role (standard member, club administrator, administrator)
• Date and time of account creation and last login
• Two-step sign-in settings: codes sent to you by email and backup codes (stored as hashes), whether an authenticator app is enrolled (its secret is stored encrypted), any passkeys you register, and any devices you choose to have remembered (device name, browser type and IP address)
• IP address and browser/device information recorded at login and when accepting our Terms of Service

3.2 Member registration data

When registering a membership (for yourself or a junior you are responsible for), we collect:

• First name and last name
• Date of birth
• Phone number
• Postal address (address lines, city, county, postcode, country)
• Emergency contact name and phone number
• Membership number (assigned by us)
• Your age category, which is calculated from your date of birth

3.3 Guardian consent records

For junior members, we record which guardian accounts manage the junior, which guardian is the primary contact, and the date on which consent was given for membership and data processing.

3.4 Membership and competition records

We hold the following records relating to your participation:

• Membership history (product, valid dates, status, payment reference)
• Club membership history (club name, valid dates)
• Club transfer history (clubs involved, dates, status)
• Playing grade (a number) and umpire grade (a letter), with a history of each change and its date
• Coach status (if applicable)
• Official roles held at organisation or club level (role title, dates, role contact email and phone, and any photograph and biography you provide)
• Event entry history (event, entry date, class entered, entry status, eligibility snapshot at time of entry)
• Team event entries (team name, slot position, players assigned by the entering club, horses, guests, and, for cross-club loan players, the home club’s identity and the date the loan was recorded)
• Event scheduling: umpire and official availability and assignments, and the results of matches
• Rules test attempts and results, where rules tests are used
• Acceptance records confirming you (or, for junior members, your guardian) have read and accepted the current Terms of Service and the current edition of the Handbook (date and IP address of acceptance, plus browser/device information)

Event guests. When you book a guest who is not a member for an event (for example, for a meal), we record their name and any notes you give, such as dietary requirements or allergies. Please share only what is needed and make sure your guest knows. Allergy and medical information is used, with your consent, only to cater for the event, and notes are deleted 30 days after the event.

3.5 Safeguarding and compliance records

For members holding safeguarding-relevant roles (officials, coaches, club administrators, and any role flagged as requiring compliance), we record the expiry date of relevant certifications:

• DBS (Disclosure and Barring Service) check expiry date
• First aid certificate expiry date
• Safeguarding training certificate expiry date

We do not store the underlying DBS certificate, criminal record information, or any details of training providers or scores. Only the expiry date is held, used to flag when a renewal is due.

3.6 Diversity & inclusion data (equality monitoring)

To support equality of opportunity in the sport and to report aggregate diversity information to funding bodies (such as Sport England), we offer adult members the opportunity to provide:

• Sex registered at birth
• Ethnicity (using the GOV.UK harmonised ethnicity classification)
• Whether you have a physical or mental health condition expected to last 12 months or more (the Equality Act 2010 disability question; we do not ask about the nature of the condition)

These questions are strictly optional. “Prefer not to say” is a valid answer for every question, and you may update or clear your answers at any time from your profile. Where an adult member is managed by a household head (for example, an adult member who does not log in themselves), the household head may record these answers on that member’s behalf.

Your individual answers are not visible to administrators, club administrators or other members. They can be seen only by you or, for an adult member without their own login, by the household member who manages that member’s account. They are used only in aggregate, anonymised reporting with a minimum cell size of 10 enforced (any group smaller than 10 is suppressed in the report so individuals cannot be re-identified).

Ethnicity and disability information is special-category data under UK GDPR. We process the answers under Article 9(2)(g), substantial public interest (equality of opportunity or treatment) (Schedule 1, Part 2, paragraph 8 of the Data Protection Act 2018), and only for the purpose described above. We never hold this data for junior members, and we never ask for it during sign-up; it is offered only after a member has completed registration.

3.7 Horse data

Members who ride horses at events register those horses in our system. Horse records include:

• Horse name, breed, colour, sex, date of birth, height, microchip number and distinguishing marks
• Passport number and a copy of the passport document
• Vaccination records (type, date administered, expiry date, batch number, veterinarian name)
• The member who registered the horse (its owner of record)
• Records of checks made by administrators or the horse welfare officer
• A welfare status flag (“Dangerous Vice Record”) where a horse has been placed under review or subject to a permanent restriction on welfare or safety grounds, with an optional note visible to administrators and to the household of the member who registered the horse

Horse data relates to animals, not people. However, it is linked to member records and is therefore described here for completeness.

3.8 Payment data

Payments are processed by Stripe (see section 5.1). We do not store card numbers, bank account numbers, or any raw payment credentials. We do hold:

• Payment amount, currency, status and type (for example membership, event entry, or refund)
• How the payment was made (card, cash, cheque, bank transfer, voucher, waived or sponsored), any discount applied, and the card processing fee
• A description of the payment, which includes the payer’s name
• Stripe payment, charge and refund reference numbers
• Timestamp of successful payment, failure, or refund

3.9 Contact form submissions

When you use the contact form on this website, your name, email address, optional subject and message are sent by email to our contact inbox. They are not stored in the member portal. Submissions identified as automated spam are recorded in our audit log.

3.10 Technical and security data

To maintain the security of the member portal, we log:

• IP address and browser/device information associated with login sessions
• Failed sign-in attempts and any temporary lock on an account
• Whether your password has been found in a known data breach (see section 5.4), so that we can ask you to change it
• An audit log of significant actions (for example, a membership being granted, a grade being assigned, or a club transfer being approved). The audit log records what changed, including the values before and after, who made the change, and when. Where an authorised administrator signs in as a member to give support, this is also recorded.
• Email verification, password-reset and email-change links (stored as hashes). When you change your login email, the system sends a confirmation link to the new address and a notice to the old address; the change only takes effect when the link sent to the new address is used.
• If our session-security system detects an attempted re-use of a revoked sign-in token (a sign that a session cookie may have been compromised), every active sign-in session for the account is ended and the event is recorded in our audit log.
• A copy of each email we send, kept so that it can be re-sent if delivery fails

3.11 Bulk-email recipient records

When an administrator sends a bulk email through the audience builder (for example, a region-wide announcement), the system snapshots the recipient list at the moment of sending so the campaign can be accounted for. Each recipient row holds:

• Member identity (for traceability of who received the message)
• Email address and club name as they were at send time
• First name and member full name as captured at send time (used only for personalisation tokens such as “Hi {{firstName}}”)
• Whether the recipient is the member themselves or a guardian
• The campaign’s audit metadata (subject line, filter snapshot, who pressed Send, when)

3.12 Disciplinary and dangerous-play records

To meet our safeguarding and welfare responsibilities, we may hold the following incident records:

• Dangerous Play Records (members). Where a member is involved in a dangerous-play incident, we may record the date, the tournament or event, a description of the incident, and the umpire or official who reported it. These records form part of a member’s disciplinary history. A record can be marked as no longer in force but is retained as history.
• Dangerous Vice Records (horses). Where a horse is placed under review or subject to a permanent restriction on welfare or safety grounds, we record that status against the horse (see section 3.7).
• Welfare notes. A horse welfare officer may record a note about a person who brings an unregistered horse to an event.

These records are visible to authorised administrators, to the organiser of an event that the member or horse is entered in, and to the horse welfare officer on duty at that event. The note attached to a horse’s record is also visible to the household of the member who registered it. Access by an event organiser is logged in our audit trail. We process this data under our legitimate interests in maintaining the safety and integrity of the sport and, where relevant, to meet safeguarding obligations. We do not use it for any purpose other than discipline, welfare, and safety.

3.13 Other records

• Sign-up review: when you sign up, any note you give and the club you say you belong to are reviewed by an administrator before your account is approved. If a sign-up is declined, its email address is kept so that it cannot be used to register again.
• Requests to join a club, and grade suggestions made by clubs
• Feedback you submit about the organisation or an event
• Family invitations sent between account holders

3.14 Event information and directories

• Event pages. For events, we publish the order of play, team lists, results and standings on a page that anyone can view unless the organiser restricts it to members or administrators. It shows players’ names, playing grades and clubs, and the names of umpires and officials, and may include junior members.
• Live event notifications. If you choose to receive event notifications in your browser, we store the subscription details your browser gives us. The live event board records an anonymous device identifier and browser type to count how many devices are viewing it.
• Members directory. Logged-in members can see a directory of other members showing name, membership number, grades, club, membership type and any official role. It does not show contact details or dates of birth. Logged-in members can also see a list of coaches; appearing on it shows that the coach’s safeguarding checks are in date.
• Officials and contacts. If you hold an official role or act as a club or event contact, your name, role, role contact email and phone, and any photograph and biography you provide are published on our public website.

4. How we use your personal data

The table below sets out each purpose, the data used, and the legal basis under UK GDPR.

Some checks are automatic: for example, whether you are eligible to enter an event (valid membership, Handbook accepted, any required rules test passed), whether a new sign-up matches an existing member record, and whether a chosen password appears in a known data breach. These checks support decisions that people make, and you can ask an administrator to review any outcome. We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

5. Who we share your data with

We share personal data only where necessary and with appropriate safeguards in place.

5.1 Stripe (payment processing)

Card payments are processed by Stripe Payments UK, Ltd and its affiliates, which act as our processor and, for some purposes such as fraud prevention, as an independent controller. Stripe is certified to the highest payment security standards (PCI DSS Level 1). Stripe’s privacy policy is available at stripe.com/gb/privacy. We do not store card details.

Where an event is organised by a member club, entry fees are paid directly to that club’s own Stripe account, and the club receives the payment details, including the payer’s name. They are separate data controllers for those payment records.

5.2 Club administrators

Club administrators can view the records of their own club’s members. Where their club organises an event, they can also see that event’s entries, payments, balances and refunds, and any Dangerous Play Records of entrants that are in force. Club administrators can also see the players on teams entered in events.

Club administrators cannot see members’ individual equality-monitoring answers (section 3.6). The aggregate equality report is restricted to specifically-authorised administrators only, and even within that report the minimum cell size of 10 prevents re-identification.

Administrators may send bulk emails to filtered groups of members through an audience builder. Club administrators have a version of the same tool that is restricted to members of their own club. These emails concern the administration of membership, events and the organisation; they are not marketing.

5.3 Legal and regulatory disclosures

We may disclose personal data where required to do so by law, court order, or a regulatory authority (for example, safeguarding referrals to statutory agencies).

5.4 Service providers

We use the following providers to run the service:

• Our hosting provider, and an email provider that sends and receives our email
• A backup provider that holds encrypted off-site copies of uploaded files
• Cloudflare Turnstile, to block automated sign-ups and spam; it receives your IP address and signals from your browser
• Have I Been Pwned, which receives only a short, anonymous fragment of a scrambled form of your password so that we can check whether it has appeared in a known data breach
• Browser push services run by your browser’s maker (such as Google, Apple, Mozilla or Microsoft), to deliver event notifications you have chosen to receive
• YouTube, for videos shown on some pages

5.5 International transfers

Our hosting, email and backup providers store data in the United Kingdom or the European Economic Area. Stripe, Cloudflare, browser push-notification services and YouTube may process data in the United States. Where they do, they rely on the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Addendum, or equivalent safeguards.

6. How long we keep your data

You may ask us to erase your personal data at any time (see section 8). We do this by anonymising your record: what identifies you is removed, and the remaining records are kept as “Former member” for the history of the sport. We keep your year of birth and postcode district only for statistical analysis. We cannot anonymise a record while it must remain identifiable, for example while you hold a current membership or where there is a disciplinary record or welfare note; we will tell you if this applies.

7. Security

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures, including:

• Your password is stored as a one-way scrambled value; even we cannot read it.
• Two-step sign-in is required for every account, using a code sent by email or an authenticator app. If someone loses access to their authenticator app, a national administrator (never the person themselves) can reset it. The reset is recorded and the account holder is emailed.
• All connections between your device and the portal use HTTPS encryption.
• Strict access controls: administrators see only the data they need for their role, and sensitive data such as payment records and the audit history is restricted to officers who specifically need it.
• Significant changes to your data are recorded in an audit log that cannot be altered through the portal and is kept for the period stated in section 6.
• If our security systems detect a sign that a session may have been compromised, we automatically end all of the account’s sign-in sessions and record the event.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours and, where required, contact affected individuals directly.

8. Your rights

Under UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

To exercise any of these rights, please contact us. We do not charge a fee for reasonable requests and will respond within one month.

9. Cookies and similar technologies

We use only cookies and similar storage that the service needs in order to work:

• Sign-in cookies that keep you logged in while using the portal
• A setting that remembers which administrator mode you are using
• A device identifier used by the live event board (see section 3.14)
• Security cookies set by Stripe on payment pages, to prevent fraud
• Security signals collected by Cloudflare Turnstile on sign-up and contact forms

Videos on some pages are shown using YouTube’s privacy-enhanced mode, in which YouTube does not set cookies unless you play the video. We do not use advertising or analytics cookies.

10. Children’s data

Where a member is under 18, their membership is managed by a parent or guardian through the member portal. The guardian provides explicit consent for the junior member’s data to be collected and processed. We record the date consent was given and which guardian manages the junior.

Junior members may appear on public event pages (section 3.14). Guardians may exercise data subject rights on behalf of junior members they are responsible for. Contact us to do so.

11. Changes to this notice

We may update this privacy notice from time to time. The version history at the top of this page records every material change. Where changes are material, we will inform members by email or via a notice in the member portal.

12. How to complain

If you have a concern about how we handle your personal data, please contact us first so that we have the opportunity to address it.

If you remain unsatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection:

• ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113
• Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF