Privacy & GDPR Policy

Who we are

Y Wal (Cardigan Climbing) is a community climbing club based in Cardigan (Aberteifi), Ceredigion, Wales. For the purposes of UK data protection law (including the UK GDPR and the Data Protection Act 2018), Y Wal is the data controller for the personal information described in this policy.

Information we collect

When you create an account, book onto an event, complete an induction, or make a payment, we may collect:

• Your name, email address, phone number, and postal address
• Date of birth
• Emergency contact name and phone number
• Booking, attendance, and certification/induction records, including declarations you agree to and an electronic signature where relevant
• Payment records for donations or bookings, processed for us by Stripe (see "Who we share information with" below) — we do not store your card details ourselves
• Your mailing list preference (opted in or out)
• Notes our volunteers and staff keep about your membership, for club administration purposes

If you're recorded as the dependent of another member (for example, a family membership), some of this information may instead be held and managed by your parent's account.

How we use your information

We use your information to:

• Create and manage your membership account
• Process and manage your event bookings
• Keep everyone safe — for example, by holding emergency contact details for sessions, and induction/certification records for restricted activities
• Process payments and donations, and keep the financial records we're legally required to keep
• Send you service emails relating to your account, bookings, and certifications
• Send you newsletter updates, but only if you've opted in — you can opt out at any time

Our legal basis for processing

Depending on the activity, we rely on one or more of the following legal bases:

• Contract — to provide the membership and booking services you've asked for
• Legitimate interests — to run the club safely and effectively, including keeping emergency contact and induction records
• Consent — for newsletter emails and analytics cookies, which you can withdraw at any time
• Legal obligation — to keep financial records for accounting and tax purposes

Who we share information with

We don't sell your information. We share it only with the service providers who help us run the club:

• Stripe — to process card payments and donations
• Postmark — to deliver the emails we send you
• Our website hosting provider, who stores the data described in this policy on our behalf
• Google — if you accept analytics cookies, Google Analytics collects information about how you use this site (see "Cookies" below)

Some pages on this site also load fonts (and, for club administrators, icons) from third-party content delivery networks, which may see your IP address as part of that request.

How long we keep information

We keep your information for as long as your membership is active, and for a reasonable period afterwards in case you rejoin. Where a member leaves and asks us to remove their personal details, or where we no longer need to keep them, we archive the account: personal details such as email, address, and emergency contact information are permanently removed, while booking and payment records are kept in an anonymised form, since we have a legal obligation to retain financial records.

Your rights

Under UK data protection law, you have the right to:

• Ask what personal information we hold about you, and get a copy of it
• Ask us to correct inaccurate information
• Ask us to erase your information, or restrict how we use it
• Object to processing based on legitimate interests
• Ask for your information in a portable format
• Withdraw consent at any time, for anything we process based on consent (such as the newsletter or analytics cookies)

To exercise any of these rights, get in touch using the details below.

Cookies

We use strictly necessary cookies — for example, to keep you signed in. These don't need your consent.

With your permission, we also use Google Analytics to understand how people find and use this site, such as which pages are visited, roughly where visitors are located, and what device and browser they use. This helps us improve the site and report on interest in the project. Google Analytics sets cookies (named _ga and _ga_*) and sends this information, including your IP address, to Google, which may process it outside the UK. Google's own use of this data is covered by Google's privacy policy.

Google Analytics only runs if you click "Accept" on our cookie banner. If you click "Reject", no analytics cookies are set. You can change your mind at any time using the "Cookie settings" link at the bottom of every page; if you withdraw consent, we'll stop loading Google Analytics and remove its cookies. We don't use advertising cookies, and we don't use analytics on our shared kiosk or induction sign-off pages.

Data protection contact

Our nominated Information Officer is Chris Tanner. If you have a question, concern, or request relating to your personal information, please contact us at hello@cardiganclimbing.org.

If you're not satisfied with our response, you have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).

Changes to this policy

We may update this policy from time to time as the club or the law changes. The "last updated" date at the top of this page reflects the most recent revision.