ClubRecord
Exmouth Archers
Your information
Privacy policy
This explains how Exmouth Archers uses personal information in ClubRecord, who can see it, and how to ask about it.
Last updated 25 September 2026
Who is responsible and how to contact us
Exmouth Archers decides why and how its club information is used. It is the data controller for its members' information in ClubRecord. ClubRecord provides the software used to manage that information on the club's behalf. A different club using ClubRecord is responsible for its own members' data and should provide its own privacy information.
For a privacy question, correction, access request or complaint, email twiggcraftcoding@gmail.com. Please do not send medical or safeguarding details in an ordinary email unless we have agreed a suitable way to receive them.
Information we hold and where it comes from
Depending on your involvement, this may include your name, contact details, date of birth or age category, family links, emergency contact, club and governing-body membership, payment and equipment records, key-holder status, qualifications and their expiry dates, and whether a DBS check has been recorded. We may also hold event bookings, volunteer shifts, scores, arrow plots, scoresheet images, competition details, club-record decisions, corrections and audit history. Health, disability, adjustment or safeguarding information is recorded only where relevant and is subject to stricter access.
Account records include your email address, login identity, club role and limited activity or security information. Passwords are handled by the authentication provider; club officers cannot read them. Information may come from you, an authorised officer, the scorepad, an existing club register, or a society or event record supplied to the club. If essential information is not provided, we may be unable to verify membership, book a place or provide a particular service.
Why we use information and our lawful bases
We use only information relevant to the purpose. The main purposes and ordinary UK GDPR lawful bases are:
| Purpose | How it is used | Lawful basis |
|---|---|---|
| Membership and affiliations | Identity, contact, age and society details let us administer club membership, verify eligibility and manage renewals. | Membership arrangements and the club's legitimate interests in operating safely. |
| Payments and equipment | We record subscription or affiliation payments, loans, keys, deposits and returns. | Membership arrangements, accounting obligations and the club's legitimate interests. |
| Scores and records | We record results, score sheets, arrow plots, competition details and record decisions so members can track shooting and the club can verify achievements. | The club's legitimate interests in running the sport and maintaining accurate records. |
| Events, volunteering and qualifications | We use bookings, shift times and relevant qualifications to run events and allocate suitable helpers. | Membership arrangements and the club's legitimate interests in safe event administration. |
| Safety and safeguarding | Relevant emergency, health, adjustment, DBS-status and safeguarding information is used only where needed for safe participation or protection of people. | The club's legitimate interests or legal obligations, plus an applicable additional condition for sensitive information. Access is tightly restricted. |
| Accounts and security | We use login details, roles and limited activity records to protect accounts, control access and investigate faults or misuse. | The club's legitimate interests in a secure service. |
Our legitimate interests are running an accurate, safe and secure archery club, supporting members and resolving disputes, balanced against members' privacy. Where we use sensitive health or safeguarding information, we also need a separate legal condition under data-protection law and restrict it to people with a genuine safeguarding or operational need. Optional photographs or promotional messages require a separate choice where applicable.
Who can see or receive it
Members can see their own information made available through their accounts. Officers receive role-based access only to information relevant to their duties. Family relationships do not themselves give access to another person's account. Members may see the number of event volunteer places filled, but not a named list of other volunteers. Club scores and official records may show names and results to members according to club rules.
We use Supabase for accounts, the database and uploaded score sheets; IONOS for website hosting and account email; and Cloudflare for website traffic and domain services. Necessary information may also be shared with relevant archery bodies, event organisers, insurers, safeguarding bodies or public authorities when justified. We do not sell member information.
These providers and their sub-processors may handle some service data outside the UK. Any restricted international transfer must have an appropriate legal safeguard, such as an adequacy arrangement or contractual protections. You may request information about the safeguards that apply to your data using the contact address above. We do not claim that all data stays in the UK.
Website, app and device storage
ClubRecord stores session information and an inactivity timestamp in your browser so you can stay signed in and be signed out after 20 minutes without activity. It may store your app-install preference and cache website files for the installable web app. The scorepad can keep unfinished shoots and round information on your device while offline; those drafts are not in the club's online score register until you send them. If you share a device, sign out and remove local shoots you no longer need. The website does not use behavioural advertising.
How long we keep information
We keep information while it is needed for an active membership or another stated purpose. When membership ends, we review records by category. Eleven years is not a blanket period for the whole profile and is not presented as a universal legal requirement.
| Record | Retention approach |
|---|---|
| Active member profile | While membership is active and the information is needed for club services. Details are updated or removed when no longer current. |
| Former-member core history | The minimum membership, affiliation and participation information reasonably needed for insurance or legal claims may be kept for up to 11 years after membership ends. We review what is needed rather than retaining the entire profile automatically. |
| Emergency, health and current access details | Reviewed when a member leaves or circumstances change; removed when no longer needed for an activity, outstanding obligation, safeguarding matter or claim. |
| Scores and club-record history | Kept while needed to verify results and maintain the club's sporting history. Where appropriate, older information may be anonymised rather than retaining unnecessary contact details. |
| Payments, events, loans and qualifications | Kept for the applicable accounting, administration, insurance or dispute period, then reviewed and deleted or anonymised when no longer needed. |
| Safeguarding and active claims | Handled separately. A live case, claim or legal hold may require relevant records to be retained longer, with restricted access and periodic review. |
| Account and device data | Access is removed when no longer authorised. Unsent scorepad drafts remain on the user's device until sent or deleted. Server backups and technical logs follow the relevant provider's lifecycle and are not used as an active member register. |
| Website activity history | The club's administrator can see which club accounts were active or explicitly signed in on a selected day. ClubRecord keeps this day-level activity for a rolling 90 days; older activity is deleted as new activity is recorded. |
At review, information no longer needed is deleted or irreversibly anonymised unless a documented legal, insurance or safeguarding reason requires retention. Junior records may need a different period. ClubRecord does not currently perform scheduled automatic deletion: authorised club officers must review and action retention decisions. We are developing club-specific retention settings, but they are not active yet.
How we protect it
We use account sign-in, role-based access and restricted database queries to limit who can see information. Officers should use records only for club duties and safeguard any exports. No online system can promise absolute security; suspected loss or misuse should be reported promptly using the contact address above.
Your rights and complaints
You can ask to see your personal information, correct inaccuracies, request erasure where the law permits, restrict or object to certain uses, and request portability where applicable. If a use relies on consent, you can withdraw that consent. A request to erase information may be limited where the club needs it for an ongoing claim, legal duty or other lawful reason. We may ask for proof of identity before disclosing personal information.
Your right to object: you can object to processing based on our legitimate interests. Tell us what concerns you, and we will review whether we have compelling grounds to continue.
Children can exercise data-protection rights too; we will explain matters in an age-appropriate way and consider a parent or guardian's involvement where appropriate. We do not make decisions with legal or similarly significant effects solely by automated processing.
Email twiggcraftcoding@gmail.com to make a request or complain about how your data has been handled. We will acknowledge a data-protection complaint within 30 days, investigate it, keep you informed and tell you the outcome without undue delay. If you remain unhappy, you can complain to the Information Commissioner's Office.
Changes to this policy
We will update this page when the club's practices or the software change and show the latest update date here. Material changes will be brought to members' attention.