Trust and Your Data
Trust
How we look after your data
Archery GB holds data about members, many of them children, and about safeguarding and money. This page sets out who can see it, how long we keep it, how we secure it, and what you can do. Our Data Protection & Privacy Policy is the full statement.
Who can see what
| Name, club, results and rankings | Everyone: they’re a public sporting record |
|---|---|
| Coach, judge and welfare register listings | Everyone, only while listed, and never for under-18s |
| Date of birth, contact details and address | The member, the people who manage their account, and BF membership staff |
| Qualifications and certificates | The member, the people who manage their account, and BF staff. A club sees only whether its coaches and welfare officer meet the requirements |
| Criminal records checks | BF’s safeguarding team only. Not other staff, not administrators |
| Payments | The member, and BF’s finance staff. Card details never reach BF: Stripe takes the payment |
Personal details are kept out of the site’s public data. Only the site itself reads them, and shows each person only what they’re allowed to see. Staff see only what their role needs.
Children
- A child’s membership is taken out and managed by a parent or guardian.
- Archer pages for under-18s are kept out of search engines.
- Under-18s are never listed on public registers, and sanctions against them are never published.
How long we keep it
| Membership records | Our policy: 12 years after someone’s last membership, then only an anonymised name, date of birth, postcode and country |
|---|---|
| Results and rankings | Kept: they’re the sport’s record |
| Criminal records check certificate numbers | Only while the check is in use, then deleted automatically |
| Safeguarding records | Kept, as safeguarding requires |
| Payments | As HMRC requires |
| Marketing choices | Every change, with the words agreed to and when, until the account is erased |
Security
- Every member of staff signs in with two-step verification (a passkey, an authenticator app or an emailed link) and confirms it again every 12 hours. Any member can turn it on too, or sign in with a passkey instead of a password.
- Every change staff make to a person’s record is logged with who, when and why.
- Certificates and other evidence are private files, never public links.
- Payments go through Stripe’s own checkout, so card details never touch Archery GB’s systems.
- Planned before launch: Cyber Essentials Plus, UK hosting on ISO 27001-certified infrastructure, an independent penetration test, and a data protection impact assessment.
Your rights
- A copy of your data: download everything we hold about you and the people you look after, straight away, from Privacy and your data.
- What we send you: we email you about your own memberships and entries. Anything else only if you agree, and you can change your mind there at any time.
- Erasure: ask us to erase your account from the same page; we do it within a month, keeping only what the law and our policy require.
- Questions or complaints: contact our Data Protection Lead through the privacy policy. You can also complain to the Information Commissioner’s Office.