The Cotswild Coach – Data Protection Documentation
1. Privacy Policy (Privacy Notice)
Introduction
The Cotswild Coach ("we", "our", "us") is committed to protecting your personal data in accordance with UK GDPR and the Data Protection Act 2018.
Data Controller
Business Name: The Cotswild Coach
Status: Sole Trader
Contact: Mary Sroka, trading as The Cotswild Coach
Email: mary@thecotswildcoach.co.uk
Personal Data We Collect
- Identity data (name, date of birth)
- Contact data (email, phone, address)
- Emergency contact information
- Health/medical information where required for coaching
- Booking and attendance data
- Payment information (handled via secure third‑party processors)
- Communications data
- Website analytics/cookie data (if applicable)
Purposes and Lawful Bases
- Service delivery (Contract)
- Communication (Legitimate Interest/Contract)
- Health & safety (Legitimate Interest / Explicit Consent for special category data)
- Payments and tax records (Legal Obligation)
- Business administration (Legitimate Interest)
- Website analytics (Consent for non‑essential cookies)
Sharing Personal Data
We may share personal data with:
- Coaching staff (if applicable)
- Emergency services
- Payment processors
- IT/hosting services
- Professional advisers (e.g., accountants)
We do not sell or rent your data.
Data Retention
We keep data only as long as necessary for the purposes collected, including:
- Financial records: 6 years
- Client records: see retention schedule below
Your Rights
You have rights to access, rectification, erasure, restriction, objection, data portability, and to withdraw consent.
Contact and Complaints
If you have concerns, contact us first. You may also contact the ICO.
2. Record of Processing Activities (ROPA)
Overview Table
Category of Data | Purpose | Lawful Basis | Retention | Recipients |
Identity & Contact data | Service delivery, communication | Contract | Duration of relationship + 2 years | Internal use only |
Emergency contact | Safety management | Legitimate Interest | Duration of active client relationship | Staff/first aiders |
Health data | Fitness screening, safety | Explicit Consent | Duration of relationship + 1 year | Internal, emergency services |
Booking & attendance | Service fulfilment | Contract | 3 years | Internal |
Payment info | Payments & tax compliance | Legal Obligation | 6 years | Payment processor, accountant |
Website data | Analytics (if used) | Consent | 2 years | Analytics provider |
Storage & Security Measures
- Password‑protected devices
- Encrypted cloud storage
- Limited access controls
- Secure disposal of digital and paper records
3. Data Retention Policy
Retention Periods
Data Type | Retention Period | Notes |
Client identity & contact details | Duration of relationship + 2 years | For enquiries/administration |
Health/medical information | Duration of relationship + 1 year | Deleted earlier upon request unless required for safety records |
Emergency contact | Duration of relationship | Deleted immediately when no longer relevant |
Financial/transaction records | 6 years | HMRC requirement |
Emails & communications | Up to 3 years | Routine clean‑up annually |
Website analytics | 2 years | If analytics enabled |
Secure Disposal
- Digital deletion with secure wipe where possible
- Shredding of any paper documents
4. Data Breach Procedure
Definition of a Breach
Any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.
Immediate Actions
- Identify and contain the breach.
- Assess risk to individuals.
- Document the incident in a breach log.
Notification Requirements
- Notify the ICO within 72 hours if the breach risks individuals' rights and freedoms.
- Notify affected individuals if there is a high risk of harm.
Response Steps
- Stop further data loss.
- Recover compromised data where possible.
- Review security controls.
- Implement corrective actions.
5. Data Protection Policy (Internal)
Principles
The Cotswild Coach follows GDPR principles:
- Lawfulness, fairness, transparency
- Purpose limitation
- Data minimisation
- Accuracy
- Storage limitation
- Integrity and confidentiality
- Accountability
Staff Obligations (if applicable)
- Only access data when necessary for your role
- Keep devices secured with passwords/biometrics
- Use secure communication channels
- Report any suspected breach immediately
Technical Measures
- Cloud storage with encryption
- Regular password updates
- Backups of essential data
6. Cookie Policy (If Website Uses Cookies)
What Cookies We Use
If used, the site may use:
- Essential cookies (site function)
- Analytics cookies (Google Analytics or similar)
- Third‑party embedded content cookies (e.g. maps, videos)
Consent
Non‑essential cookies only load with user consent via a cookie banner.
Managing Cookies
Users can manage choices using browser settings or the cookie banner tools.
7. Consent Policy (If Collecting Special Data or Marketing Opt‑in)
When Consent Is Used
- Health information collection
- Marketing communications
- Photos/videos for promotional use
Requirements for Valid Consent
- Freely given
- Specific
- Informed
- Recorded
- Withdrawable at any time
How We Record Consent
- Forms (paper or digital)
- Timestamps stored securely
Withdrawing Consent
Clients may contact us anytime to withdraw consent; changes will be applied promptly.