Privacy Notice

Lacrosse Scotland is committed to protecting the privacy and security of your personal information. This
privacy notice sets out the purposes for which we will collect, hold and use your personal information and how this might be shared with third parties, in accordance with Data Protection legislation. It also explains your rights in respect of your personal information.
Lacrosse Scotland will be a “controller” of the personal information that you or your club provide to us to
enable you to participate in our activities.

Our Contact Details

Lacrosse Scotland
24a Ainslie Place | Edinburgh | EH3 6AJ

Web: https://www.lacrossescotland.com

Data Protection contact details: admin@nulllacrossescotland.com

What we need

Members’ and Volunteers’ personal data

When you register as a member of Lacrosse Scotland or renew your membership, including if you are
registering or renewing on behalf of a child under the age of 16, we will ask you for and record the
following personal information:

your name, address, email address, date of birth, mobile number and gender
your billing address, bank account and payment card details
membership criteria / category – adult, junior, U19, club, umpire, support, life member
role within a club (if applicable) – coach, captain, trustee, secretarial position, treasurer, club administrator
legal requirements – PVG, anti-doping
participation details – club affiliations, qualifications, disciplinary actions relating to the sport
Equality information – gender, disability, members’ personal information relating to health, racial or ethnic origin, age range, demographic and geographic for equality monitoring purposes
any other personal information you provide to us when contacting or corresponding with us, when requesting any products and services from us, when providing any products and services to us, or when signing up to, attending or participating in our events, competitions or matches.

It is your responsibility to check and ensure that all the personal information you provide to us is correct,
complete, accurate and not misleading. If you become aware that any of the personal information you have provided to us or that we hold about you is out of date or is otherwise inaccurate, please contact us using the details set out as the end of this Privacy Policy.

If you are providing this personal information on behalf of any other person, you must ensure that you have that person’s permission to do so, and for their personal information to be processed in accordance with this privacy policy.

We may also collect the following information

Information about your computer, including your IP address, location data, operating system, how and when you use our website. Read our cookie policy.
Any information you provide to us when contracting or corresponding with us, either through social media, email or telephone.
Your image (if filmed or recorded when attending our sites or events). Please note that filming and photography takes places at a number of our matches, competitions and events. By participating and/or attending any match, competition or event, you agree to your image being filmed, photographed or recorded, free of charge, for both Lacrosse Scotland and its licensees to use such images in pictures and/or files (including publication on the interest and in social media).

Member of National Programme/National Squad

When you trial or are selected for a national programme, your membership information may be shared
with squad managers/coaches/staff/physios and may include sportscotland/GB Lacrosse / World Lacrosse /European Lacrosse Federation / The World Games / International Olympic Committee. This will also include some or all of the following information:

Medical history
Accident reports
Performance records
Anti-doping record/
Passport / Visa information
Emergency contact details

Why we need your personal information

Member benefits

We need to collect our members’ personal information so that we can manage your membership. We will use our members’ personal information to:

Provide you with core member services including, but not limited to, [insurance], match eligibility in Lacrosse Scotland / GB Lacrosse / World Lacrosse competitions, [player transfers domestically and internationally], umpire appointments, attendance eligibility on Lacrosse Scotland run courses and member benefit discounts / promotions from sponsors / partners.
Set up your online membership account and send you membership communications by post, phone or email in relation to essential membership services, including but not limited to, general meeting notices, umpire appointments, [club finder], membership fees, information and other information relevant to your membership.
Facilitate disciplinary processes in line with the Lacrosse Scotland Disciplinary and Grievance Procedure. Personal information will be shared with an appointed panel in this instance.
To comply with applicable law or regulations, court orders, law enforcement and fraud prevention requirements.

If you do not provide us with all of the personal information that we need to collect the this may affect our ability to offer the membership services and benefits.

Legitimate and legal purposes

We process our members’ personal information in pursuit of our legitimate interests to:

Register our members on our membership database and affiliation with their club
Pay any authorised expense claims in relation to work on our behalf
Promote and encourage participation in lacrosse by sending members’ communications and booking information for upcoming competitions and events. Your personal information may also be used in images captured which we use for promotional, educational and development purposes.
Provide competition in lacrosse by accepting and managing entries for our competitions and checking your personal information to ensure you are entered into the correct category
Monitor and develop participation in lacrosse by evaluation members’ engagement and participation through clubs, competitions and events, inviting our members to participate in surveys for research and development purposes to establish if we are representative of what and
who we aim to serve
Develop and maintain our members’ qualifications, including sending email communications to members to inform you of upcoming courses, renewal requirements [and verify that any mandatory training has been completed].
Where needed, to collect personal information relating to criminal convictions or allege commission of criminal offences where you are required to compete a PVG check under the Protection of Vulnerable Groups (Scotland) Act 2007 (or any preceding legal act). This information will include your PVG certificate number, PVG membership number, date of issue and any relevant information in relation to your membership of the PVG scheme.
Respond to and communicate with members regarding your questions, comments, support needs or complaints, concerns or allegations in relation to lacrosse such as anti-doping, on and after match incidents, etc.
Verify that international athletes meet criteria to compete in international tournaments and events for Lacrosse Scotland / GB Lacrosse / World Lacrosse.
Additional legal obligations under the following:
- Children and Young People’s Act 2014 to the extent data needs to be shared;
- Anti-Doping Rules UK
- The Equality Act 2010
- Any common law medical duties applicable to our medical practitioners, and
- Any other applicable legal requirements which may become relevant to the work of Lacrosse Scotland both now and in the future.

Where we process your personal information pursuit of our legitimate interest, you have the right to object to us using your personal information for the above purposes. If you wish to object to any of the above processing please contact us on admin@nulllacrossescotland.com . If we agree and comply with your objection, this may affect our ability to undertake tasks for the benefit of you as a member or volunteer.

Equality monitoring requirements

We are required to use our members’ personal information relating to health, racial or ethnic origin, gender, age, demographic and geographic for equality monitoring purposes as required by sportscotland.

We will process such personal information through aggregated and anonymised reports to identify and keep under review the existence or absence of equality of opportunity or treatment between groups of people within the same categories to promote or maintain equality within our sport.

Other uses of your personal information

We may ask you if we can process your personal information for additional purposes. Where we do so, we will provide you with an additional privacy notice with information on how we will use your information for these additional purposes.

Our member clubs collect and store personal information about their individual members. The clubs have a responsibility as “controllers” to provide their members with privacy notices.

Who we share your personal information with

If your personal information is included in images or videos taken by us, or accredited organisations or individuals, at competitions, events, or other lacrosse activities, we may share this with sportscotland, Lacrosse Scotland, GB Lacrosse, media organisations, partners / sponsors as shown on the website and World Lacrosse for promotional and/or journalistic purposes. Team sheets may be shared with media and broadcast providers prior to a match, competition or event and will contain some personal information for the purpose of commentary and match reports.

We may be required to share personal information with statutory or regulatory authorities and organisations to comply with statutory obligations. Such organisations include the Information Commissioners Office, the Health and Safety Executive, Disclosure Scotland and Police Scotland.

We may also share personal information with our professional and legal advisors for the purpose of taking advice.

Lacrosse Scotland employs third party suppliers to provide services, including IT, qualifications, payments, media, etc. These suppliers may process personal information on our behalf as “processors” and are subject to written contractual conditions to only process that personal information under our instructions and to protect it.

In the event that we do share personal information with external third parties, we will only share such personal information strictly required for the specific purposes and take reasonable steps to ensure that recipients shall only process the disclosed personal information in accordance with those purposes.

How we store and protect your personal information

Your personal information is stored on our electronic filing system and our servers based in the UK. Where Lacrosse Scotland utilises cloud-based storage your personal information may be stored outside the UK within the European Union country data centres, in which case Lacrosse Scotland will ensure adequate security measures are in place to protect your personal information. Core systems are only accessible by Lacrosse Scotland staff and non-Lacrosse Scotland staff who are responsible for processing and accessing Lacrosse Scotland performance data.

Security measures in place within Lacrosse Scotland’s servers based in the UK include strong passwords, password lock-out policy, managed permissions, encryption, anti-virus software, anti-malware software, data loss prevention software and appropriate data backup arrangements.

As part of the World Lacrosse Federation we transfer some data outside the UK to the US and other legal jurisdictions. Where it is transferred out of the UK e.g. for travel arrangements for training camps, tournaments etc. please refer to the relevant country’s website for information regarding safeguards or if you have any questions, please contact us as per the contact information above.

Please be aware that data transmission received by service users over the internet is inherently insecure and we cannot guarantee the security of data sent over the internet.

If a password is required to access certain areas of our applications, IT systems or website, you are responsible for keeping your password secure and confidential. You must not leave you password unattended or disclose you password to any other person.

How long we keep your personal information

Your personal information will be held for no longer than is reasonably necessary for the purposes for which it was obtained. We will carry out periodic reviews of the personal information that we hold about you to ensure that this is the case.

We will also retain your personal information to maintain historical, statistical and statutory records in accordance with applicable laws, regulations or guidance, in particular the Public Records Scotland Act (2011).

Legal Basis for processing

We will only collect and process personal information where we have a legal basis for doing so under Data Protection legislation.

The legal basis may differ depending on the purpose for processing your data.

The legal basis used by Lacrosse Scotland for the processing of support athlete personal information are:

GDPR Article 6 (1)

The data subject has given consent to the processing of his or her personal data for one or more specific purposes, or
The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Legal Basis for processing Special Category Personal Data

The processing of Special Category Data is prohibited under Article 9 (1) of the General Data Protection Regulation.

Special Categories of Personal data is information that contains any of the following:

racial or ethnic origin;
political opinions;
religious or philosophical beliefs;
trade union membership;
data concerning health (e.g. physical or mental health);
sex life or sexual orientation;
genetic data;

This means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question, in particular chromosomal, deoxyribonucleic acid (DNA) or ribonucleic acid (RNA) analysis, or from the analysis of another element enabling equivalent information to be obtained, and biometric data. This means personal data resulting from specific technical processing relating to the physical, physiological, or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data (fingerprints).

However, there are exceptions to this general prohibition, usually referred to as ‘conditions for processing special category data’. The condition used by Lacrosse Scotland to process athlete special category information is: – Article 9 (g) – processing is necessary for reasons of substantial public interest, on the basis of domestic law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safe guard the fundamental rights and the interests of the data subject.

When relying on GDPR Article 9 (g) above we need to also rely on conditions within DPA 2018. The conditions Lacrosse Scotland rely upon are: – Part 2, 27 and 28: – Anti-doping in sport. This condition is met if the processing is necessary for the purposes of measures designed to eliminate doping which are undertaken by or under the responsibility of a body or association that is responsible for eliminating doping in a sport, at a sporting event or in sport generally, or for the purposes of providing information about doping, or suspected doping, to such a body or association.

The reference in sub-paragraph (1)(a) to measures designed to eliminate doping includes measures designed to identify or prevent doping.

If the processing consists of the disclosure of personal data to a body or association described in sub- paragraph (1)(a), or is carried out in preparation for such disclosure, the condition in sub-paragraph (1) is met even if, when the processing is carried out, the controller does not have an appropriate policy document in place (see paragraph 5 of this Schedule).

Standards of behaviour in sport

(1) This condition is met if the processing—
(a) is necessary for the purposes of measures designed to protect the integrity of a sport or a sporting event,
(b) must be carried out without the consent of the data subject so as not to prejudice those purposes, and (c) is necessary for reasons of substantial public interest.

(2) In sub-paragraph (1)(a), the reference to measures designed to protect the integrity of a sport or a sporting event is a reference to measures designed to protect a sport or a sporting event against—
(a) dishonesty, malpractice, or other seriously improper conduct, or
(b) failure by a person participating in the sport or event in any capacity to comply with standards of behaviour set by a body or association with responsibility for the sport or event.

We may also rely on Article 9 (h): – processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis domestic law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3.

Consent

In circumstances where you have given us consent to process your information, such as consenting to us using your images on our websites, you have the right to withdraw this consent at any time.

You can do this by contacting us at admin@nulllacrossescotland.com.

Your data protection rights

Under data protection law, you have rights including:

Your right of access – You have the right to ask us for copies of your personal information.
Your right to rectification – You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing – You have the right to ask us to restrict the processing of your information in certain circumstances.
Your right to object to processing – You have the right to object to the processing of your personal data in certain circumstances.
Your right to data portability – You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please note the lawful basis used for processing your personal information can also affect which rights are available to you as there may be exemptions. Our Data Protection Officer will advise on any exemptions on request.

Please contact us at admin@nulllacrossescotland.com if you wish to make a request.

How to complain

If you have any queries or concerns regarding this Privacy Notice or how your personal information is processed, please contact the Lacrosse Scotland Data Protection contact in the first instance:

Please note you have the right to contact the Information Commissioner’s Office if you are unhappy with how your enquiry has been dealt with. Their contact details are noted below:

The Information Commissioner’s Office – Scotland
Queen Elizabeth House
Sibbald Walk
Edinburgh
EH8 8FT
Telephone: 0303 123 1115
Email: Scotland@nullico.org.uk