Privacy Policy

---

Cotswold Yeti Mountaineering - Dan Rogers ML

UK GDPR

Privacy Policy

Data Protection Mitigation

1.0 All leaders are required to read this policy document as part of their training alongside further

guidance outlined in their leader handbook.

1.1Cotswold Yeti Mountaineering - Dan Rogers ML annually reviews data protection standards

annually.

1.2 Cotswold Yeti Mountaineering - Dan Rogers ML commits to following the most current data

protection standards in line with the Data Protection Act 2018.

Collection of Data

2.0 Cotswold Yeti Mountaineering - Dan Rogers ML will request next of kin & medical information

from all participants (data subjects) to allow our team to make informed decisions in the case of an

emergency.

2.1 Cotswold Yeti Mountaineering - Dan Rogers ML works closely with companies & charities to

establish best practice in the collection & transfer of personal data.

2.2 Cotswold Yeti Mountaineering - Dan Rogers ML will either collect personal data from one of the

following methods:

a) Direct data collated from participants signing up through Adventure Café’s online booking

form. Cotswold Yeti Mountaineering - Dan Rogers ML uses Google Forms as their secure

cloud server.

b) Transfer of data collated by our client via encrypted spreadsheets via a Google Form

online or Microsoft SharePoint.

2.3 Cotswold Yeti Mountaineering - Dan Rogers ML may require last minute participants to

complete a paper registration / medical form. In this instance paper copies will be typed up and

saved to the secure cloud as soon as practicably possible & the paper copies destroyed.

Containment of data

3. Participant data will be held on the secure cloud server only and never downloaded.

1. All participant data available to Cotswold Yeti Mountaineering - Dan Rogers ML will be

password protected.

2. Cotswold Yeti Mountaineering - Dan Rogers ML will only use participant data for the purpose of

risk prevention and safety management and will not share any participant data with third

parties.

3.3 Cotswold Yeti Mountaineering - Dan Rogers ML are required to retain participant data on the

secure cloud server for 3 years in the case of legal / medical claims. After 3 years data will be

destroyed.

Interpretation of data

4.0 Cotswold Yeti Mountaineering - Dan Rogers ML will vet all participants to ensure they are safe

to partake in a challenge event. Should there be any doubt, Cotswold Yeti Mountaineering - Dan

Rogers ML shall make contact with the participant to discuss further and request a doctor’s letter if

appropriate.

Printing of Data

5.0 Cotswold Yeti Mountaineering - Dan Rogers ML is required to print paper copies of participant

data for leader awareness and participant safety on event.

5.1 Cotswold Yeti Mountaineering - Dan Rogers ML will print the data in a three-part system so that

any data on a single sheet cannot be interpreted by anyone else as an additional failsafe measure

(please see Schedule 1). Each component will be physically retained by leaders in separate

places. The 3 components of data are as follows:

5.1.1 Participant Event Number, Name and Mobile Phone Number

To be retained by all event leaders in waterproof phone/map case or in secure zipped pocket.

5.1.2 Participant Event Number & Medical Details

To be retained by all event leaders in waterproof casing within their First Aid Kits.

Data to include the following:

a) Dietary Requirements

b) Allergies

c) Medical Conditions

d) Current Medication

5.1.3 Participant Event Number & Emergency Details

To be held only by the Event Manager in their Event Management Folder along with all other

personal data components. This data must be always kept on the Event Managers person or

stored securely within a support vehicle.

Data to include the following:

a) Male/Female

b) Date of Birth

c) Address

d) Postcode

e) Home Telephone

f) Next of Kin Name

g) Next of Kin Relation

h) Next of Kin Phone Contact

5.2 Participants will be provided with an event number upon registration. Participants are required

to always display their number whilst on activity. Event numbers will be issued via a wristband,

armband, helmet sticker or on a lanyard.

Leader’s Use of Data

6.0 Leaders will be informed of any serious medical issues upon the event briefing.

6.1 Leaders will be able to identify participants through their event number and refer to the

participant data available to them if required in an emergency.

6.2 Leaders briefed around confidentiality. Participant data should never be shared with any third

party except in the event of an emergency with the emergency services and anyone else

necessary to assist in keeping the participant safe.

Mobile Phone Number Sharing Agreement

7.0 Participant phone numbers may be entered into an Cotswold Yeti Mountaineering - Dan

Rogers ML emergency phone and deleted immediately after the event.

7.1 A participant WhatsApp group may be set up if permission is granted from the charitable or

corporate partner.

7.1.2 The WhatsApp group will be a primary method of communication whilst on event. This

encrypted messaging service is recommended to our clients and participants.

Participant Data Destruction

8.0 All paper copies of participant data required for the event are destroyed immediately after an

event. Leaders must do one of the following post event:

a) Hand in personal data to the event manager

b) Burn the data

c) Shred the data

8.1 Any participant data required for writing up incident/accident or near miss reports will be

retained by the event manager for the Cotswold Yeti Mountaineering - Dan Rogers ML Health &

Safety Log.

Use of Images, Videos, Statements and Logos

9.0 Cotswold Yeti Mountaineering - Dan Rogers ML will use the name and logo of the company/

charity during the term of engagement for promotional and participant information material with the

prior approval of the company/charity.

9.1 Cotswold Yeti Mountaineering - Dan Rogers ML leaders will take photographs and videos on

the event for future marketing & information documents.

9.2 Photographs and/or video may be shared with participants via chat groups (e.g. WhatsApp) or

via email post event. We advise all organisations working alongside Cotswold Yeti Mountaineering

- Dan Rogers ML to inform their participants/challengers of this.

9.3 An individual can opt out of being included in photos. Charities & companies must inform

Cotswold Yeti Mountaineering - Dan Rogers ML of any individuals who wish to opt out of photos.

Leaders will also provide an oral briefing regarding photo’s. Individuals may choose to opt out on

the day of the event.

9.4 Permission will be requested for any statement, message or image, whether oral, print or video

for marketing, promotion or social media usage.

Data Processing Terms & Conditions

10.1 Cotswold Yeti Mountaineering - Dan Rogers ML will be a data processor acting on behalf of

the charitable/corporate partner in relation to the processing of Participant Data.

10.2 Cotswold Yeti Mountaineering - Dan Rogers ML will notify its corporate/charitable partner

immediately if they consider that any of their client’s instructions infringe Data Protection Laws.

10.3 Cotswold Yeti Mountaineering - Dan Rogers ML will implement the appropriate technical and

organisational measures outlined in this policy to protect the security of Personal Data processed

in performance of the services required, and to protect Personal Data against unauthorised or

unlawful processing, accidental or unlawful destruction and damage or accidental loss, alteration,

unauthorised disclosure, or access.

10.4 Cotswold Yeti Mountaineering - Dan Rogers ML will comply with all laws that apply as a data

processor of Personal Data and provide the charitable/corporate partners with co-operation,

assistance and information as they may request, to comply with its obligations under the Data

Protection Laws or to another data controller of the Personal Data, provided by the charitable/

corporate partner.

10.5 Cotswold Yeti Mountaineering - Dan Rogers ML will only disclose Personal Data to, or allow

access by, its staff and freelancers who have had appropriate guidance in data protection matters,

are bound by professional confidentiality obligations, and whose use of Personal Data is necessary

for the performance of their job function.

10.6 Cotswold Yeti Mountaineering - Dan Rogers ML ensures all employees and freelancers who

can access Personal Data are appointed as persons in charge of the processing and are informed

of its confidential nature and do not publish, disclose or divulge any of the Personal Data to any

third party.

10.7 Cotswold Yeti Mountaineering - Dan Rogers ML will notify the charitable/corporate partner

without undue delay and no later than within 24 hours of becoming aware of any Security Incident

with all relevant details reasonably available, or required by Data Protection Laws, and provide

reasonable cooperation and information to assist in the investigation, mitigation and remediation of

a Security Incident, and keep the charitable/corporate partner properly informed.

10.8 Cotswold Yeti Mountaineering - Dan Rogers ML will only carry out data processing as

necessary for the purposes of its engagement with the charitable/corporate partner and in

accordance with this policy.

10.9 Cotswold Yeti Mountaineering - Dan Rogers ML shall comply with any, and all, of its

obligations under this policy (and any Schedules forming part of the Agreement), Data Protection

Laws and Applicable Laws.

Summary of Definitions:

"Applicable Laws" means all applicable laws, statutes, regulations and codes from time to time in force;

"Data Protection Laws" means: (a) Regulation (EU) 2016/679 on the protection of natural persons with

regard to the processing of Personal Data and on the free movement of such data (the "General Data

Protection Regulation"); (b) the version of the General Data Protection Regulation in force in the United

Kingdom by virtue of the European Union (Withdrawal) Act 2018 and the Data Protection Act 2018; (c) any

legislation in force from time to time in the United Kingdom) which implements the European Community's

Directive 95/46 EC and Directive 2002/8/EC, the Privacy and Electronic Communication (EC Directive)

Regulations 2003; and (d) any other legislation in force from time to time in the United Kingdom relating to

privacy and/or the processing of Personal Data;

"Data Subject" has the meaning given to that term in the Data Protection Laws;

"Personal Data" has the meaning given to that term in the Data Protection Laws;

"Security Incident" means any accidental or unlawful destruction, loss or alteration of Personal Data, or

any unauthorised disclosure of or access to Personal Data.