Who we are
W/Rhinos Cycling Club is an unincorporated association of cyclists based in Birmingham. The club is the controller of the personal information described here, which means it decides how that information is used and is responsible for looking after it.
Our Data Protection Lead is Arasu Rayen. If you have a question about your information, or want to use any of the rights below, speak to Arasu or to any committee member, who will pass it on.
What we collect
When you fill in the membership form we collect:
- Your details. Email address, full name, date of birth, home address and postcode, and mobile number.
- Your emergency contact. Their name, their relationship to you, and their mobile number.
- Health information, if you choose to give it. Anything that matters for your safety on a ride, such as a condition or medication emergency responders would need to know about. This question is optional.
- Your confirmations. That you have read the Constitution and Framework, and that you accept the points about own risk, insurance, fitness and your bike, how rides are described, and data.
- For members under 18. The details of the parent, or adult authorised in writing by a parent, who is a member and takes responsibility for them.
When you book a trip, the Ride Coordinator may ask for more information needed for that trip, and the Treasurer keeps a record of your trip payments.
Why we use it, and our lawful basis
| What we use it for | Information | Lawful basis |
|---|---|---|
| Keeping the register of members the Constitution requires, sending you ride details and club news, and running general meetings | Your details | Your membership agreement with the club (contract), and our legitimate interest in running the club |
| Checking age: members under 18 must be accompanied and cannot vote or serve on the Committee | Date of birth | Contract, and legitimate interests |
| Contacting someone for you if you are hurt or unwell on a ride | Emergency contact, mobile number | Legitimate interests; in an emergency, protecting your vital interests |
| Planning safely for your participation and helping emergency responders | Health information | Your explicit consent, given by choosing to fill in the question. In an emergency where you cannot consent, protecting your vital interests |
| Collecting and reconciling trip payments and keeping the club’s accounts | Name, payment records | Contract, and legal obligations for keeping financial records |
| Registering ride leaders and volunteers with our affiliating cycling body, which our insurance requires | Name, contact details | Legitimate interests |
If you give us someone else’s details as your emergency contact, please let them know, and point them to this notice.
Who sees it
- Committee members who run membership, such as the Secretary or Membership Secretary and the Data Protection Lead, see membership details.
- The Ride Coordinator and Deputy for a trip you are on see your emergency contact and any health information. As the Framework says, this is held by one named person in an access-controlled document: not a group chat, not a shared spreadsheet, not a printout in the van.
- Emergency services, if you need help on a ride.
- Google, because the membership form and its responses are stored in Google Forms and Google Drive. Google acts as our service provider and may process data outside the UK under its standard contractual safeguards.
- Our affiliating national cycling body, but only for people registered as ride leaders or volunteers.
We never sell your information, never use it for anyone else’s marketing, and never publish it. The only members named on this website are the committee and founding members, with their agreement.
How long we keep it
- Membership details and emergency contact. While you are a member, then deleted within 12 months of your membership ending.
- Health information on your membership record. Only while it is current. We may ask you to confirm or update it each year, and it is deleted when you leave.
- Health information collected for a trip. Deleted within 30 days of returning, unless an incident means a record has to be kept.
- Incident records. For as long as they may be needed for insurance or legal purposes.
- Trip and payment records. Six years, in line with normal accounting practice.
Keeping it safe
Access to the form responses is limited to the committee roles above, using accounts protected by two-step sign-in. We collect only what we need, and we review who has access when roles change.
Your rights
You can ask us to:
- give you a copy of the information we hold about you
- correct anything that is wrong or out of date
- delete your information, where we no longer need it
- restrict or stop using it, or object to how we use it
- withdraw your consent for us to hold health information, at any time
Ask the Data Protection Lead or any committee member. We will reply within one month.
If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
This website
wrhinos.com sets no cookies, uses no analytics or tracking, and does not collect anything you type. Its fonts are hosted on the site itself. The site is hosted by GitHub Pages, which keeps standard server logs, including IP addresses, for security. The membership form is a Google Form, covered by Google’s own privacy policy as well as this notice.
Changes to this notice
The Committee reviews this notice from time to time and reports material changes to the Annual General Meeting. The latest version is always on this page.