Introduction
The Royal Twirling Association (RTA) is committed to protecting the privacy and personal data of all individuals who interact with us. This Privacy Policy explains how we collect, use, store, and share your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Royal Twirling Association (RTA) is a trading name of RTA Twirling & Events Ltd, a company registered in England and Wales under company number 17174281, with its registered office at 128 City Road, London, EC1V 2NX. RTA Twirling & Events Ltd is the data controller for the personal data described in this policy. Our contact details are: Email: admin@royaltwirlingassociation.co.uk, Website: https://royaltwirlingassociation.co.uk, Registered office: 128 City Road, London, EC1V 2NX.
What Personal Data We Collect
We collect and process the following categories of personal data:
Account & Registration Data: Full name, email address, phone number, password (encrypted), role (troupe leader, parent, dancer), and troupe affiliations.
Dancer Data: Dancer name, date of birth, age group, troupe membership, competition entries, and performance records.
Child-Specific Data: For dancers under 16, we collect parent/guardian name, contact details, relationship to the child, emergency contact name and phone number, and medical information (allergies, conditions, or other relevant health information provided voluntarily).
Payment Data: Payment transactions are processed by Stripe. The RTA does not store your full card details. We retain transaction records including amounts, dates, and invoice references.
Contact Form Data: Name, email address, subject, and message content submitted via our contact form.
Marketing & Email Delivery Data: a log of the marketing and transactional emails sent to you, including subject line, send date, and delivery status (our "email send log"); if an email to you bounces, or you unsubscribe or otherwise object to marketing, a record on our suppression list so we do not email you again; and a record of when and how your marketing preferences were given, changed, or withdrawn ("marketing consent records").
Images & Recordings: photographs and video footage taken at RTA events, in accordance with, and subject to the consent choices set out in, the RTA Photography & Filming Policy.
Complaint & Disciplinary Records: information relating to complaints, investigations, and disciplinary outcomes handled under the RTA Complaints & Disciplinary Policy.
Technical Data: IP address, browser type, pages visited, and cookies (see Section 8).
How We Use Your Data
We use your personal data for the following purposes: to register and manage your RTA account; to process troupe affiliations, dancer registrations, and competition entries; to process payments for memberships, competition entries, and event tickets; to communicate with you about events, competitions, and RTA news; to fulfil our safeguarding obligations (including maintaining records of DBS checks and safeguarding concerns); to respond to your enquiries via the contact form; to comply with legal and regulatory obligations; and to improve our website and services.
Legal Basis for Processing
We process your personal data on the following legal bases:
Contract: Processing necessary to perform our contract with you (e.g., registration, competition entry, payment processing).
Legitimate Interests: Processing necessary for our legitimate interests (e.g., improving our services, communicating about events), provided these are not overridden by your rights.
Legal Obligation: Processing necessary to comply with our legal obligations (e.g., safeguarding, health and safety).
Consent: Where you have given specific consent (e.g., photography consent, marketing communications). You may withdraw consent at any time by contacting us.
For special category data (e.g., medical information), we rely on explicit consent or the processing being necessary for reasons of substantial public interest (safeguarding of children) under Schedule 1, Part 2, paragraph 18 of the Data Protection Act 2018.
4A. Marketing Communications
From time to time we send marketing and goodwill communications by email, for example birthday greetings and event announcements, to existing customers. Where you have registered a membership, entered a competition, or purchased a ticket, we rely on the 'soft opt-in' exemption in regulation 22(3) of the Privacy and Electronic Communications Regulations 2003 (PECR). This means we may email you about similar products and services to those you have already used, because we gave you a simple, free way to refuse this at the point we collected your details, and we give you the opportunity to opt out in every marketing message we send.
The lawful basis for this processing under UK GDPR is our legitimate interest (Article 6(1)(f)) in keeping members and customers informed about the RTA. It is not based on your consent, and you do not need to have actively agreed to receive it, but you can opt out at any time.
You can opt out of marketing emails by clicking 'unsubscribe' in any marketing email, in your account settings, or by contacting admin@royaltwirlingassociation.co.uk. When you opt out, we add your email address to a suppression list so we do not contact you again for marketing purposes.
We do not send marketing communications directly to a dancer under the age of 18. Where a dancer's account is managed by a parent or guardian, any marketing communications relating to that dancer are sent only to the parent or guardian's own registered email address, never to the child directly.
Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:
Account data: Retained for the duration of your account plus 2 years after account deletion or last activity.
Dancer and competition records: Retained for 3 years after the dancer's last competition entry.
Payment records: Retained for 6 years in accordance with HMRC requirements.
Safeguarding records: Retained in accordance with statutory guidance (typically 25 years or until the individual reaches the age of 25, whichever is longer).
Contact form submissions: Retained for 1 year.
Email send log: retained for 24 months, to investigate delivery issues and demonstrate PECR/UK GDPR compliance.
Suppression list: retained for as long as we hold your contact details, including after any request to delete your data. Keeping your address on this list is the only way we can guarantee we do not contact you again, in line with your objection and our obligations under PECR.
Marketing consent/objection records: retained for 6 years after the event, as evidence of compliance with PECR and UK GDPR's accountability principle (Article 5(2)).
Photographs and video used for RTA promotional purposes: retained for 3 years, or until consent is withdrawn, whichever is sooner.
Complaint and disciplinary records: retained for 6 years after the matter is closed, or for the safeguarding retention period above if the complaint relates to a safeguarding concern.
When personal data is no longer required, it will be securely deleted or anonymised.
Your Rights
Under UK GDPR, you have the following rights regarding your personal data:
Right of Access: You can request a copy of the personal data we hold about you.
Right to Rectification: You can request that we correct any inaccurate or incomplete data.
Right to Erasure: You can request that we delete your personal data (subject to legal retention requirements).
Right to Restrict Processing: You can request that we limit how we use your data.
Right to Data Portability: You can request your data in a structured, commonly used format.
Right to Object: You can object to processing based on legitimate interests.
Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time.
Where you have asked us not to contact you for marketing, or where a marketing email to you has bounced, we retain your email address on a suppression list even after an erasure request, solely to ensure we do not contact you again. This does not affect the rest of your data being deleted.
To exercise any of these rights, please contact us at admin@royaltwirlingassociation.co.uk. We will respond within one month.
Data Security
We take the security of your personal data seriously. Measures include: encryption of data in transit (HTTPS/TLS) and at rest; secure password hashing; access controls limiting who can view personal data; regular security reviews; and use of reputable, security-certified third-party providers (Supabase, Stripe, Vercel).
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and inform affected individuals without undue delay.
Children's Data
We recognise the importance of protecting children's personal data. For dancers under 16, we require parental or guardian consent before collecting and processing their data. Parents and guardians can exercise data rights on behalf of their children by contacting us.
We do not send marketing communications directly to a child. Where the soft opt-in described in Section 4A applies, marketing is sent only to the registered email address of the dancer's parent or guardian.
Because our platform is likely to be accessed by under-18s, we apply the principles of the ICO's Age Appropriate Design Code (the "Children's Code") across the site, including data minimisation, high-privacy default settings, and not using a child's data for advertising profiling.
Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last Updated" date. We encourage you to review this policy periodically.
Contact & Complaints
If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at admin@royaltwirlingassociation.co.uk.
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): Website: https://ico.org.uk, Telephone: 0303 123 1113.