DRIBLR Privacy Notice

DRIBLR Ltd. is responsible for the personal information described in this Privacy Notice.

For data protection purposes, DRIBLR Ltd. is the data controller.

You can contact us about privacy or data protection at: hello@driblr.co.uk

Depending on how you interact with DRIBLR, we may collect the following information:  - Parent or guardian details, including name, email address, telephone number and home address. - Child details, including name, date of birth/age and information needed to place them in the appropriate session. - Health and additional needs information.  Any relevant medical conditions, allergies, disabilities or additional needs that you choose to tell us about so we can support safe participation. - Emergency contact details, including name, relationship to the child and contact number. - Booking and membership information, including sessions booked, attendance and membership details. - Payment information.  Information relating to payments and transactions. Card details are processed securely by our payment provider and are not stored directly by DRIBLR. - Photography and video preferences.  Your consent choices relating to photographs or videos of your child. - Communications.  Information you provide when contacting us, registering your interest or making an enquiry.

We use personal information where necessary to:  - Manage bookings, memberships and payments. - Organise and deliver DRIBLR sessions. - Communicate with parents, guardians and participants about sessions, bookings and important updates. - Keep participants safe and respond appropriately to medical, emergency or safeguarding situations. - Make reasonable adjustments and support individual needs where appropriate. - Maintain attendance and membership records. - Respond to enquiries and registrations of interest. - Manage photography and video consent preferences. - Meet our legal, regulatory, insurance and safeguarding obligations. - Manage and improve our services.

• Process and manage bookings
• Provide DRIBLR sessions
• Manage memberships and payments
• Allocate participants to the correct age group or session
• Contact parents, guardians and participants about their booking
• Maintain attendance records
• Respond to enquiries
• Keep participants safe during sessions
• Respond appropriately in an emergency
• Understand relevant medical conditions, allergies, disabilities or additional needs
• Make appropriate reasonable adjustments
• Manage safeguarding concerns
• Deal with complaints or incidents
• Meet our legal and regulatory responsibilities
• Maintain appropriate business and financial records

Under UK data protection law, DRIBLR must have a lawful basis for using personal information.

Depending on the circumstances, we may rely on: - Contract.  Where we need your information to provide the sessions or services you have booked. - Legal obligation.  Where we need to use or retain information to comply with the law. - Legitimate interests.  Where it is reasonably necessary to operate and manage DRIBLR, provided those interests do not override your rights. - Consent.  Where you have given us permission for a particular use, such as certain photography or video uses. You can withdraw your consent at any time. - Vital interests.  In exceptional circumstances where information is needed to protect someone’s life. Special category information Some information you provide, such as information about a participant’s health, medical conditions or disabilities, may be classed as special category data. We only use this information where necessary and where we have an appropriate lawful basis and condition under UK data protection law, including where necessary to protect an individual’s vital interests or where explicit consent has been provided where appropriate.

• Contract – where information is necessary to provide the sessions, membership or services that have been booked.
• Legal obligation – where we are required to process or retain information to comply with the law.
• Legitimate interests – where processing is reasonably necessary for the operation, administration, safety or protection of DRIBLR and its participants, provided those interests do not override an individual's rights and interests.
• Consent – where we specifically ask for permission, for example for certain uses of photographs or videos or other activities where consent is the appropriate lawful basis.

Information concerning a person's health is classed as special category personal data and receives additional protection under data protection law.

DRIBLR will only ask for health, medical, disability or additional-needs information where it is reasonably necessary to support safe and appropriate participation.

Where required, we will obtain explicit consent to process this information.

We will limit access to this information to people who reasonably need it for the participant's safety, welfare or the delivery of their session.

In an emergency or safeguarding situation, information may be used or shared where this is necessary and permitted by law to protect an individual.

The majority of DRIBLR participants are children, and we recognise that children's personal information requires particular protection.

We aim to collect only the information reasonably necessary to provide our sessions safely and effectively.

For children's bookings, information will normally be provided by a parent or legal guardian.

We will take particular care with children's medical information, safeguarding information, photographs and other sensitive information.

Agreeing to DRIBLR's Terms & Conditions does not automatically give DRIBLR permission to use identifiable photographs or videos of a child for promotional purposes.

Where DRIBLR wishes to use identifiable photographs or videos for purposes such as our website, social media, advertising or promotional materials, appropriate permission will be requested separately.

Where we rely on consent, you may withdraw that consent for future use by contacting us.

Withdrawal of consent does not affect the lawfulness of any processing that took place before consent was withdrawn.

Payments are processed securely by Stripe, our third-party payment provider.

DRIBLR does not store your complete payment-card details.  These are handled securely by Stripe.

Stripe processes personal information in accordance with its own privacy and security arrangements.

We do not sell, rent or trade personal information.

Where reasonably necessary, we may share personal information with organisations or individuals that help us operate DRIBLR and provide our services. These may include: - Payment providers, such as our payment processing provider, to securely process membership and other payments. - Website, booking and technology providers that host or support our website, booking systems, email services and other business systems. - Coaches and authorised DRIBLR personnel where they need the information to deliver sessions safely and effectively. - Venues or facility providers, where limited information is genuinely necessary for the safe delivery of a session or to meet venue requirements. - Professional advisers and service providers, such as accountants, insurers, insurance brokers, legal advisers and IT support providers. - Safeguarding organisations, statutory services or relevant authorities where sharing information is necessary to protect a child or another person, or where we have a legal or safeguarding obligation to do so. - Emergency services or healthcare professionals where information needs to be shared in connection with an accident, medical emergency or immediate safety concern. - Regulators, government bodies, courts or law-enforcement agencies where we are legally required or permitted to provide information. We only share personal information where there is an appropriate reason to do so and aim to limit the information shared to what is necessary for the relevant purpose. Where we use third-party service providers to process personal information on our behalf, we take reasonable steps to ensure that appropriate data protection and security arrangements are in place.

• Website, booking and IT service providers
• Payment providers
• Professional advisers such as accountants, insurers or legal advisers
• Relevant venue providers where necessary
• Emergency services
• Safeguarding organisations
• Regulatory bodies or public authorities where required or permitted by law

Some of the technology providers used by DRIBLR may process or store personal information outside the United Kingdom.

Where personal information is transferred internationally, we will take reasonable steps to ensure that appropriate safeguards are in place in accordance with UK data protection law.

DRIBLR takes reasonable organisational and technical measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

Access to personal information is restricted to those who reasonably need it.

Particular care will be taken with information relating to children, medical conditions and safeguarding matters.

We will not keep personal information for longer than reasonably necessary.

Retention periods may vary depending on the type of information and why it is held.

When deciding how long information should be retained, we consider:  - how long the child or family remains registered with DRIBLR; - the reason the information was collected and whether it is still needed; - safeguarding, health and safety, insurance and legal requirements; - accounting and tax record-keeping requirements; and - whether information may be needed to establish, exercise or defend a legal claim. When personal information is no longer required, we will securely delete or dispose of it.

• The reason the information was collected
• Legal and regulatory requirements
• Safeguarding considerations
• Insurance requirements
• Accounting and tax requirements
• Whether information may reasonably be required in connection with a complaint, incident or legal claim

We may contact existing customers with information necessary to manage their DRIBLR membership or sessions. These are service communications and are not marketing.

Where required by law, we will obtain appropriate consent before sending promotional marketing communications.

You can unsubscribe from marketing communications at any time.

Stopping marketing communications will not prevent us from contacting you about an active booking, payment, cancellation, safety issue or other important service matter.

Our website uses strictly necessary technologies to operate correctly and provide services such as bookings and secure payments. These do not require consent where they are necessary for the service requested.

We also use GoDaddy analytics to help us understand how visitors use our website. Analytics will only be enabled if you choose Accept on our cookie banner. You can decline analytics without affecting your ability to use the website or make a booking. You can change your choice at any time using Manage Cookies in the website footer.

Our secure payment provider, Stripe, may also use cookies or similar technologies that are necessary for payment processing, security and fraud prevention.

Depending on the circumstances, you may have rights under data protection law including the right to:  - Access the personal information we hold about you. - Correct information that is inaccurate or incomplete. - Request deletion of your personal information in certain circumstances. - Restrict how we use your personal information in certain circumstances. - Object to the use of your personal information in certain circumstances. - Request the transfer of certain personal information to you or another organisation. - Withdraw consent at any time where we rely on consent to use your information. You will not usually have to pay a fee to exercise these rights. To exercise any of these rights, please contact us at hello@driblr.co.uk.

• Ask for access to your personal information
• Ask us to correct inaccurate information
• Ask us to delete information in certain circumstances
• Ask us to restrict the way information is used
• Object to certain uses of your information
• Ask for certain information to be transferred
• Withdraw consent where we rely on consent

Children have data protection rights in their own right.

Where appropriate, a parent or guardian may exercise these rights on behalf of a child. As children get older and are better able to understand their privacy rights, their own wishes and views may also need to be considered.

We will consider requests concerning children’s information carefully and in accordance with applicable data protection law.

If you have concerns about how DRIBLR uses personal information, please contact us first at: hello@driblr.co.uk

You also have the right to raise a concern with the Information Commissioner's Office (ICO), the UK's data protection regulator.  Further information is available from the ICO at ico.org.uk.

We may update this Privacy Notice from time to time to reflect changes to DRIBLR, our services or data protection requirements.

The latest version will be available on our website and the date at the top of the notice will show when it was last updated.

For questions about this Privacy Notice or how DRIBLR handles personal information, contact:

DRIBLR Ltd

Email: hello@driblr.co.uk