updated march 2025; next review march 2027

Privacy Notice

Introduction

This Privacy Notice explains how the Scottish Bridge Union uses the personal data collected from you, how this is stored and provides details on your rights in relation to this data.

What is the legal basis for collecting data?

According to Article 6 of the GDPR, a lawful basis is necessary whenever organisations process personal data. Scottish Bridge Union collects your personal data on the following legal basis:

  • ‘Legitimate interests’ – Scottish Bridge Union, needs certain personal information about its members (name, address, etc.) when joining, and maintain membership with, the Scottish Bridge Union.

  • ‘Legal obligation’ – Scottish Bridge Union is obliged to retain certain personal information to comply with its legal responsibilities for e.g. HMRC, MEMPAD regarding e.g. membership fees paid, bank details etc.

  • ‘Consent’ – Scottish Bridge Union requires ‘consent’ from its members to permit it to perform certain functions.

What data do we collect and how do we collect your data?

The information Scottish Bridge Union collects includes: a member’s full name, title, gender, date of birth, postal address, email address, telephone number(s) and also financial information (credit card/bank details.) This information is collected electronically only. Scottish Bridge Union also records player’s SBU number, their home club and district or if they are a Direct member, and whether their membership is active or lapsed.

Members of the Scottish Bridge Union may also be members of other British Isles NBO (EBU etc.) and we collect identifying numbers to enable the transfer of points to the member’s home union. We also collect BBO usernames and may extend this to other identifiers that players might have or use to play bridge on the internet. For some of our members holding official positions or responsibilities, we may hold additional information such as Club or District official roles, committee memberships and tournament director roles.

Scottish Bridge Union hold members’ financial data in the form of records of their payment of annual membership fees and entry payments for competitions and events. This is to comply with legal and tax accounting obligations, as well as to maintain a record of current, fully paid-up members. Where payments (such as refunds) are made using internet banking to members, the Scottish Bridge Union retains a record (completely separate from MEMPAD, and protected by multifactor authentication), of the account name, sort code and account number for audit purposes.

How will we use your data?

The Scottish Bridge Union uses members’ personal data for the administration of membership, payment of membership fees, communication of information and the organisation of events.

How do we store your data and for how long do we store it?

Members’ information is stored in digital form on our MEMPAD database, which is held on an external server utilising Amazon Web Services ‘Cloud’ storage, and accessible via a website www.mempad.co.uk.

We retain members’ data after they resign, or their membership lapses, in case they later wish to rejoin. This means that on re-joining, such a member will not start with a new number and will benefit from any previous ranking or accumulated Master Points. If former members request that we no longer hold their data, we will delete it.

Since underlying statistical data, like scores from bridge games, continues to be necessary for the purpose for which they were originally collected and processed, results from events are not deleted by the Scottish Bridge Union although Master Points will no longer be attributed to a player if this is requested.

At bridge events, or at prize-giving ceremonies, photographs are taken and may be used on the Scottish Bridge Union websites. If players do not wish their image to be used, then they must advise us accordingly and we will take necessary steps to prevent such occurrences. Images of children will not be used.

Historical ranking lists and prize lists are required for archiving purposes and names cannot be deleted.

Other data, such as that relating to tax/accounting/personnel matters, is kept for the legally required period.

Technical measures we put in place to protect data

Information storage is security protected using DRUPAL content management software. Whenever collective data is transferred between Scottish Bridge Union officials, it is sent utilising encrypted file transfer. Individual members require a password to access their personal MEMPAD data.

SBU uses Amazon Web Services for cloud storage. Amazon Web Services (AWS) customers can use all AWS services to process personal data that is uploaded to the AWS services under their AWS accounts (customer data) in. In addition to compliance, AWS is committed to offering services and resources to customers to help them comply with the GDPR requirements that may apply to their activities. New features are launched regularly, and AWS has 500+ features and services focused on security and compliance.

Who do we share your data with and who has access to it?

Scottish Bridge Union shares data with the following organisations: Scottish Bridge Union officials; World Bridge Federation, district organisers; home club officials; tournament officials; other British NBO e.g. English Bridge Union, Bridgewebs, MEMPAD, DRUPAL, ECATS. The data that is shared is very limited and is name, rank, scoring results, suspension notices and length of any suspension. Given the very limited personal information being shared, there are no formal Data Share Agreements in place.

What are your data protection rights?

Scottish Bridge Union would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:

  • The right to access - You have the right to request that Scottish Bridge Union provides a note/copy of the personal data held.

  • The right to rectification - You have the right to request that Scottish Bridge Union corrects any information you believe is inaccurate. You also have the right to request Scottish Bridge Union completes information you believe is incomplete.

  • The right to erasure - You have the right to request that Scottish Bridge Union erases your personal data, under certain conditions.

  • The right to restrict processing - You have the right to request that Scottish Bridge Union restricts the processing of your personal data, under certain conditions.

  • The right to object to processing - You have the right to object to Scottish Bridge Union’s processing of your personal data, under certain conditions.

  • The right to data portability - You have the right to request that Scottish Bridge Union transfers the data that they have collected to another organisation, or directly to you, under certain conditions.

If you make a request, we have one calendar month to respond to you. If you would like to exercise any of these rights, please contact us at our email: Email: ronan.valentine@sbu.org.uk

What are cookies and how do we use cookies and how to manage your cookies?

Cookies are text files placed on your computer to collect standard Internet log information and visitor behaviour information. When you visit our websites, we may collect information from you automatically through cookies or similar technology. For further information, visit allaboutcookies.org.

Scottish Bridge Union uses cookies in a range of ways to improve your experience on our website, including:

  • Understanding how you use our website

There are a number of different types of cookies, however, our website uses:

  • Functionality - Scottish Bridge Union uses these cookies so that we recognise you on our website and remember your previously selected preferences. These could include what language you prefer and location you are in. A mix of first-party and third-party cookies are used.

  • Advertising - Scottish Bridge Union uses these cookies to collect information about your visit to our website, the content you viewed, the links you followed and information about your browser, device, and your IP address. Scottish Bridge Union sometimes shares some limited aspects of this data with third parties for advertising purposes. They may also share online data collected through cookies with advertising partners. This means that when you visit another website, you may be shown advertising based on your browsing patterns on our website.

How we manage cookies

You can set your browser not to accept cookies and the above website tells you how to remove cookies from your browser. However, in a few cases, some of our website features may not function as a result.

Changes to our Privacy Notice

Scottish Bridge Union keeps its Privacy Notice under regular review and places any updates on its web page. This Privacy Notice was last updated on 11 March 2025. Please note that if extensive changes are made to this Privacy Notice, then it will be sent out to all members to bring this directly to their attention. This Privacy Notice will be formally reviewed by the Board of Management every two years. How to contact us If you have any questions about Scottish Bridge Union’s Privacy Notice, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us. Email us at: ronan.valentine@sbu.org.uk

How to contact the appropriate authority

Should you wish to report a complaint or if you feel that Scottish Bridge Union has not addressed your data rights or concerns in a satisfactory manner, you may contact the Information Commissioner's Office by telephone (0303 123 1113) or in writing to:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF