Privacy policy
This privacy policy will explain how I Can Run CIC uses the personal data we collect from you when you use our website, app or attend our courses. At ICR we are committed to respecting and protecting your online privacy. This includes your right to know what we do with the personal information you share with us. It also guides our policies regarding the management of your data, including how the information is collected, how it is processed, and for what purposes.It is important to us that we communicate our policies and procedures with you clearly and in a manner that provides clarity to you. As such, this policy covers the following key areas:
Background Information
Why we need your data
Categories of Data
What data we collect
What data we share
How we contact you
How we protect your information
Retention Periods
Your rights to manage your data
1. Background Information
I Can Run Community Interest Company is a unique women only running group. We believe that all woman - regardless of their size, shape, age, ability or background should have the opportunity to run and progress with like-minded women. Questions about this privacy policy may be submitted to ICR via email to: hello.icanruncic@gmail.com
2. Why we need your data
In order to support our running events, it is critical we understand who is participating. There are many reasons for this, from providing participants with information around how and when they have taken part, through to measuring the impact of our events on those communities. The General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA) require that all information we collect must be done so under a specific lawful basis. There are six clearly defined lawful bases for processing information, and we categories the majority of our data processing under three of those: Contract, Legitimate Interests and Consent.
Contract
When you register for ICR, either for the Beginner Courses or Free Runs, we need certain information about you to enable us to provide you with the service and to ensure the event is delivered to an appropriate standard, and to allow us to provide you with accurate records of your participation.
This lawful basis also includes any administrative or service-related emails, for example to confirm you have registered with us or taken part, or to alert you to an update to this Privacy Policy or other policies that are relevant to you. These therefore do not offer an option to unsubscribe as they are necessary to provide the services you requested.
Legitimate Interests
Outside of your direct participation we also wish to develop the reach and impact of our events and as such have a legitimate interest to process certain information with this aim. This includes things like carrying-out research to further understand who is or isn’t participating in our events (in order to understand our ability to impact those most in need) or capturing and sharing images of our events taking place, helping us to inspire other women to engage in physical activity and redefine what it means to be active.
Consent
Above and beyond simple participation as a runner or volunteer, there are a number of ways you can help us to ensure ICR positively impacts the health and happiness of their local communities and supports the social enterprise initiative.One of the best ways to support us in this way is by consenting to receive emails regarding things like merchandise, offers, competitions and newsletter emails. We therefore provide the opportunity at registration to opt in to these communications. You can opt out at any time.Due to GDPR requirements for providing consent, we do not process any data on children under the age of 13 if it would require consent as the lawful reason for processing. For this reason, children under the age of 13 do not have the option to opt in to the above emails.
3. Categories of data
ICR collects the following data:
Name, email address, phone number, postal address, date of birth, gender, medical information, next of kin
Event photography
4. What data we collect
There are a number of ways where either you directly provide data to ICR or we are able to collect it when you:
Register online or place an order for any of our products or services from ICR website
Voluntarily complete a customer survey or provide feedback on any of our message boards or via email
Use or view the ICR website via your browser cookies
Register and attend any of our Beginner Running Courses or free runs
Register online for the TeamApp
Incident Reports (in the event of an incident during one of our runs or courses)
Social media user profiles
Event photography and filming – Please see Image Policy (pending)
5. What data we share
When ICR processes your order, it may send your data to and also use the resulting information from, credit reference agencies to prevent fraudulent purchases.
6. How we contact you
ICR would like to send you information about products and services of ours that we think you might like. The large majority of our outgoing communication to you is via email through TeamApp (if you have signed up) or via our MailChimp newsletter.
Sending an email to you is a form of data processing, and as such may only be carried out under a specific lawful basis.
TeamApp will also ask you if you require push notifications via your mobile phone. These are only used when an event you have booked is cancelled in short notice.p
Under the Lawful Basis of Fulfilling a Contract
In order to fulfil our obligation to you as a runner, to ensure our events are delivered in a safe and appropriate manner, and to ensure the ICR organisation is managed appropriately, there are some communications we send to everyone. The following communications fall into this category:
Confirmation you have registered with us.
Updates to key documents, such as this privacy policy.
Confirmation that your participation has been recorded.
Notification that you have joined/completed the Beginner Running Course and are eligible to claim any associated items such as a medal.
For those who volunteer as Run Leaders, a regular volunteer update.
For those who have signed up to volunteer at a specific event, emails from that event team relating to that volunteering situation.
Under the Lawful Basis of Legitimate Interest
There are some occasions where we may contact you as part of our mission. For example, where we write to people who’ve registered but not participated, with the aim of understanding why and then being able to create a more supportive environment. The following types of communications fall into this category:
Questionnaires aimed at developing our understanding of who is participating.
Emails sign-posting participants to peer-support groups we feel may be suitable based on information you have provided.
Questionnaires for research aimed at understanding the effect of running on global health and wellbeing.
You have a right to object to receiving these emails, to do that please contact us (email).
Under the Lawful Basis of Consent
Not only is our mission statement focussed on bringing women together in safe and supportive environments to experience the power of running, but we have also made a commitment that participation in free runs will remain free where possible. There are ways in which we rely on runners to achieve both of those ambitions, some of which require us to be able to send certain communications. We therefore offer all runners the chance to opt-in (at registration or via their profile) to receive regular updates from us.Consent can be withdrawn at any time but does not apply to processing that happened before the consent was withdrawn.
If you have agreed to receive marketing emails such as newsletters, you may always opt out at a later date. You have the right at any time to stop ICR from contacting you for marketing purposes. If you no longer wish to be contacted for marketing purposes, please email hello.icanruncic@gmail.com or click unsubscribe at the bottom of the newsletter.
7. How we protect your information
We work extremely hard to apply appropriate security measures in order to protect your data from being accessed or disclosed without your permission, or lost. We have a very small staff team who are regularly updated on good practice in data handling, all personal data is password protected and only available to those with a specific need for access.
We will also use Facebook to communicate with participants, and in these cases we retain admin control centrally and are able to control/remove access when required.
8. Retention periods
In order to present our data retention periods as simply as possible we have chosen to do so using our definitions of categories of data defined in section 3 above.
Profile & Identity Data – In perpetuity
This is in order to maintain historic records of participation, to allow participants to access their participation records, and to allow anyone who is registered with us to participate at any future event without the requirement to re-register.
Contact Data – Ten years from most recent participation instance
It is common for people to leave significant time periods between running or volunteering at our events. It is also common for people to enjoy receiving our communications without participating at our events themselves.
Technical Data – Three years from point of data collection
In order to provide the best possible service to our users, to support the administration of our systems and processes, and to comply with legal obligations.
Incident Data – In perpetuity
We retain this data in order to keep a historical record of our incident profile, from which we are able to continually review our operating policies in order to enable the safe and appropriate delivery of our events.
Survey Data – In perpetuity
This data is used for the purposes of understanding our community in greater detail. Changes over time are of particular interest where comparison of current versus historical data allows us to assess the impact of our events and associated interventions.
Event Imagery – In perpetuity
Event imagery is predominantly processed under the lawful basis of Legitimate Interest and may be stored securely by event teams in perpetuity as it represents a historical record of that event. Although extremely rare, there can be occasions where we are required to process information conveyed in photographs under another of the lawful bases, such as Legal Obligation, Vital Interest, Public Task.
9. Your rights to manage your data
You have the right to:
10.1. Be informed if your personal data is being used
Where appropriate we endeavour to inform you of this at the point where your data is being collected, however for circumstances where that is not practical or possible please refer to this Privacy Policy.
10.2. Get copies of your data
You are also free, at any time, to request a downloadable copy of all the data we hold on you. This would include details of all your running, and volunteering instances and as such is something we particularly recommend prior to any request for us to delete your data. To do this please emails us at hello.icanruncic@gmail.com
10.3. Have your data corrected
If at any time you feel the data we hold on you is incorrect, and you are unable to change it via your profile, please email us at hello.icanruncic@gmail.com
10.4. Have your data deleted
Should you wish, at any time, for us to delete your data then please contact us via support and we can enable this process. Please note that this is not something that can be undone and as such we would recommend downloading your historical results (see next section) before doing so.Although we approach every request for deletion on a case-by-case basis, we do not as a rule remove volunteer data simply on request. This is in order support potential future challenges, enquiries, or investigations where this information may be critical.
10.5. Limit how we use your data
If you are concerned about the accuracy of the data or how it is being used please email us on hello.icanruncic@gmail.com . Where you have previously provided us with consent to use your personal data in a specific way, you can remove your consent at any time (or opt-out) by emailing us hello.icanruncic@gmail.com
10.6. Data portability
Following from point 10.2 (above) we will provide copies of your data in standard machine-readable formats. In such cases, please email us.
10.7. Object to the use of your data
Where we are processing your data under the lawful basis of Legitimate Interest you have the right to raise an objection to that processing. This is not an absolute right to object and we will carry out a balancing test where we assess the reasons for your objection in the context of our legitimate interests.
10.8. Raise a concern
If, at any time, you have a concern as to how we are handling your information then please email us. If you feel that we have not addressed your concerns appropriately you have the right to raise them directly with the ICO (click here to find out how).
Version 1.0
11/8/2020
Lauren Hutchinson, Emma Talbot
Revision history
This policy and related guidance will be monitored on a regular basis for compliance and will be reviewed at least annually.
What this means to ICR now
We are beginning to create new policies and procedures to take on board our new way of working and to accommodate the new high-anxiety times of COVID-19. We want to keep all our communication channels open during this time and have therefore created a shared email address for our organisation.
If you have any concerns and are not sure who to get hold of during this time of change, please email: hello.icanruncic@gmail.com