Data protection

The BHA wants you to feel confident about how we collect, store and handle your personal data.

Our new privacy notices below set this out in detail, as well as the rights that you have in relation to your personal data.

In addition, the Racing Administration System now has functionality so that users can update their contact details and marketing preferences from within the site.  In order that the BHA can ensure that the personal data that it holds on its licensed and registered personnel is as accurate as possible, you are encouraged to keep your details up to date via the Racing Administration System.

If you have any questions, please contact dataprotection@britishhorseracing.com

COVID-19 Privacy Notice

What does this policy cover?

This notice describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it as part of its Covid-19 screening activities by and about: all personnel that plan to attend a race fixture at a racecourse; and licensed and registered personnel that plan to attend gallop training at a racecourse.  This notice is supplementary to the privacy notice concerning the BHA’s existing data processing activities in relation to your role in racing as set out on the BHA website https://www.britishhorseracing.com/about/data-protection/ .

This policy also describes your data protection rights, including a right to object to some of the processing that the BHA carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information do we collect?

We collect confirmation of your completion of the mandatory education program at Racing2Learn.

We collect the information included on the Covid-19 Screening Questionnaire, which includes your name, date of birth, BHA unique identifier and information collected in order to determine whether you may be displaying symptoms of Covid-19 or may have recently been exposed to Covid-19.  This includes high level information about your state of health and your possible contact with Covid-19 patients.

We collect proof of your negative Covid-19 test result, where we have requested you provide this following a failed admission to a racecourse.

We collect the information included on the voluntary Covid-19 Positive Test Reporting Form, which includes your date of birth, ethnicity, biological sex, partial postcode, date of positive test and role in racing.

What information do we receive from third parties?

When you attend a racecourse, the racecourse representative (or the racecourse’s subcontractor) will ask you to confirm the information previously collected in the Covid-19 Screening Questionnaire. They will also collect additional information you provide about your state of health and will take your body temperature. A BHA Official will be present and will collect this information for processing, recording your body temperature (or highest reading if the test needs to be repeated).

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:

• As required by the BHA to pursue our legitimate interests, in particular:

– we will use your information to assess your suitability for entry to the racecourse in order to protect your health and safety and that of other racing participants and to communicate with you and your contracting/ employing organisation regarding logistics for your planned racecourse attendance. Where this involves your sensitive data, this is also done for reasons of public health and to ensure compliance with BHA’s health and safety obligations under employment law.

• For purposes which are required by law:

– in response to requests by government or law enforcement authorities conducting an investigation, or in accordance with our statutory duties, including to Public Health England.

Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above. You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.

Who will we share this data with, where and when?

We will share your information with companies providing IT services to the BHA from time to time for the limited purposes of hosting, supporting and maintaining their software, for instance the software used to validate your entry to the racecourse.

We will share a top level red/ green entry status with:

– the racecourse that is hosting the fixture in relation to which you have undertaken the BHA’s Covid-19 screening activities so that they can admit/ refuse entry, as appropriate;

– your employing/ contracting body or organisation so that they can make alternative staffing arrangements should your entry status be red.

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

For jockeys, we may share information (including your medical information) relating to you with foreign racing authorities so that they may determine your fitness to ride in those jurisdictions or where you wish to participate otherwise in horseracing in a different jurisdiction. Some of these regulators may be located outside of the European Economic Area. Where this is to a regulator in a country that is not subject to an adequacy decision by the EU Commission, data is adequately protected by EU Commission approved standard contractual clauses, an appropriate Privacy Shield certification or a vendor’s Processor Binding Corporate Rules.  A copy of the relevant mechanism can be provided for your review on request. In other circumstances, we might ask for your consent to share this data, where you have requested that we provide it to a foreign racing authority.

We will share the name of any individual accompanying an Irish based runner to a horseracing fixture in Great Britain with the Irish Horseracing Board so that they are able to monitor and enforce Irish Government guidance that persons should self-isolate for fourteen days on arrival in the Republic of Ireland.

What rights do I have?

You have the right to ask us for a copy of your personal data and to correct, delete or restrict (stop any active) processing of your personal data.

In addition, you can object to the processing of your personal data in some circumstances where we don’t have to process the data to meet a contractual or other legal requirement.

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in both the GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to an EU data protection authority where you live, work or where you believe a breach may have occurred. This is likely to be the Information Commissioner’s Office in the UK.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, you can get in touch at dataprotection@britishhorseracing.com or by writing to either the Head of Legal or the Data Protection Officer c/o British Horseracing Authority, 75 High Holborn, London, WC1V 6LS.

How long will you retain my data?

We will retain the results of any Covid-19 tests, screening questionnaires, temperature readings and answers to questions upon entry to the racecourse for a period of six months from the date that the UK Government’s Covid-19 Alert remains at Level 1.

This V.2 is dated 1 June 2020 and has been amended to provide notice that red/ green entry status will be shared by the BHA with individuals’ employing/ contracting bodies or organisations so that they can make alternative staffing arrangements in the event of a red flag.

COVID-19 PRIVACY NOTICE PDF

Anti-doping privacy notice

What does this policy cover?

This notice describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it by and about riders as part of its anti- doping activities pursuant to Rider Manual D Part 6 of the Rules of Racing.

This notice also describes how the BHA will make use of the data provided to it about the “Responsible Persons” as part of it equine anti-doping activities pursuant to Rider Manual G of the Rules of Racing.

This policy also describes your data protection rights, including a right to object to some of the processing that the BHA carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information do we collect?

We outsource our human anti- doping sampling and testing function to a third party, currently Alere Toxicology.

Alere collect from you and provide to us the following information, in addition to the results of your anti- doping test:
– your name;
– your date of birth;
– your gender;
– details of medication you have taken in the recent past.

We also collect and process the name of the “Responsible Person” pursuant to the Equine Anti- Doping Manual at Rider Manual G of the Rules of Racing. We may also, during an investigation into an equine anti-doping matter, collect relevant personal data of trainers and stable employees around the circumstances of a test, race or incident. In rare circumstances where there is a concern related to sample contamination, we may ask for and process medical samples of relevant individuals to confirm whether a sample has become contaminated.

What information do we receive from third parties?

Intelligence about alcohol or substance use/abuse may be received from the BHA Integrity Team. This information may be used to inform anti-doping testing strategy, generally or in relation to an individual rider. This is discussed in more detail in the Integrity Privacy Notice.

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:

o As required by the BHA to conduct our business and pursue our legitimate interests, in particular:

o we will use your information to assess your conduct against the Rules of Racing and take any enforcement action as required under the Rules of Racing in order to maintain the integrity of the sport and the health and safety of yourself and other racing participants. Where this involves your sensitive data, this is also done on the basis of the BHA’s measures to carry out anti- doping activities in sport.

o we will also, in the area of equine doping, use your information to assess the conduct of others against the Rules of Racing and to take any enforcement action as required under the Rules of Racing in order to maintain the integrity of the sport and the welfare of all its participants. Where this involves your sensitive data, this is done on the basis of the BHA’s measures in place to maintain the integrity of racing.

o we will contact you in relation to any rules or other information you may require as a person licensed, permitted or registered under the Rules of Racing and any questions we may have in relation to your conduct or the conduct of others;

o we will maintain records of our anti- doping activities, enforcing the Rules of Racing, including publishing our decisions in the event that you are sanctioned under the Rules of Racing;
o we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation), such as maintaining intelligence on particular individuals of interest.
o For purposes which are required by law:

o in response to requests by government or law enforcement authorities conducting an investigation, or in accordance with our statutory duties, including sharing information with the Gambling Commission and/or the police.

Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above. You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.

Who will we share this data with, where and when? 

We will share your information with companies providing IT services to the BHA from time to time for the limited purposes of hosting, supporting and maintaining their software, for instance the software used to validate your entry to the racecourse.

We will share a top level red/ green entry status with:

  • the racecourse that is hosting the fixture in relation to which you have undertaken the BHA’s Covid-19 screening activities so that they can admit/ refuse entry, as appropriate;
  • your employing/ contracting body or organisation so that they can make alternative staffing arrangements should your entry status be red.

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

For jockeys, we may share information (including your medical information) relating to you with foreign racing authorities so that they may determine your fitness to ride in those jurisdictions or where you wish to participate otherwise in horseracing in a different jurisdiction. Some of these regulators may be located outside of the European Economic Area. Where this is to a regulator in a country that is not subject to an adequacy decision by the EU Commission, data is adequately protected by EU Commission approved standard contractual clauses, an appropriate Privacy Shield certification or a vendor’s Processor Binding Corporate Rules.  A copy of the relevant mechanism can be provided for your review on request. In other circumstances, we might ask for your consent to share this data, where you have requested that we provide it to a foreign racing authority.

We will share the name of any individual accompanying an Irish based runner to a horseracing fixture in Great Britain with the Irish Horseracing Board so that they are able to monitor and enforce Irish Government guidance that persons should self-isolate for fourteen days on arrival in the Republic of Ireland.

What rights do I have?

 

You have the right to ask us for a copy of your personal data and to correct, delete or restrict (stop any active) processing of your personal data.

In addition, you can object to the processing of your personal data in some circumstances where we don’t have to process the data to meet a contractual or other legal requirement.

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in both the GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to an EU data protection authority where you live, work or where you believe a breach may have occurred. This is likely to be the Information Commissioner’s Office in the UK.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, you can get in touch at dataprotection@britishhorseracing.com or by writing to either the Head of Legal or the Data Protection Officer c/o British Horseracing Authority, 75 High Holborn, London, WC1V 6LS.

How long will you retain my data?

We retain the results of our anti- doping sampling and testing for the following periods:

– positive and negative results are retained for the period during which you are licensed/ permitted and for a period of ten years thereafter. Where the case is the subject of disciplinary proceedings, details of positive results may also be published on our Judicial Panel microsite where they remain for seven years from the date of the decision, or in the case of disqualifications lasting longer than seven years, for as long as the disqualification is in place;
– we retain records of our human anti-doping investigations and retain intelligence around anti- doping in accordance with our Integrity Privacy Notice.

Owner privacy notice

Summary of how we use your data

• The British Horseracing Authority uses the data you provide in this form to administer your ownership registration, to administer and regulate horseracing in Great Britain and to ensure the welfare of your horses.
• The British Horseracing Authority asks you to provide information in relation to your unspent criminal records history. This information will be processed to ensure the integrity of the sport, and we will be entitled to retain this information for this purpose.
• The British Horseracing Authority may also gather information about you from third party sources, particularly in relation to our integrity activities. More details on the information we collect from third party sources such as the public, the media and publicly available information, BHA and racecourse officials, the press and bookmakers are set out in the BHA’s Integrity Privacy Notice, available on the BHA website.
• The British Horseracing Authority may share information relating to you with foreign racing authorities in other countries in relation to your registration and licensing history. Some of these authorities may be located outside of the European Economic Area.
• We may also share information we receive from or about you with other third parties as set out in more detail below.
• The British Horseracing Authority may, as part of its suitability checks, carry out a credit reference check with its chosen credit referencing agency, Equifax. More information on your credit history and status can be sought directly from Equifax. Where the BHA makes a search, this may in itself affect your credit history.

What does this policy cover?

This policy describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it by and about owners, particularly as part of the registration process. It does not describe the processing carried out by the BHA in relation to its integrity activities, which are covered in the BHA’s Integrity Privacy Notice, available on the BHA website.
This policy also describes your data protection rights, including a right to object to some of the processing which the BHA carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information do we collect?

We collect and process personal data about you when you complete your ownership registration.  This includes all the information you provide to us in the registration form and any attachments submitted alongside the form.

What information do we receive from third parties?

Sometimes, we receive information about you from third parties. In particular:

• we may receive information about you from foreign racing authorities in relation to your licensing and registration history and conduct;
• we may receive information about you from our member organisations in relation to any safeguarding concerns or investigations;
• we may receive information about you from Racing Welfare in relation to any safeguarding concerns or investigations;
• we may receive information about you from other licensed, registered or permitted personnel;
• we may seek information about you and your suitability and requirements for registration from publicly available sources, such as through internet searches and director checks and through vetting checks carried out by or with third parties, such as credit referencing checks;

• we may receive information about your performance and conduct from racecourses and BHA and racecourse officials;
• we may collect some information for integrity purposes from a variety of sources such as the public, the media and publicly available information, the press, bookmakers and the stewards– this is discussed in more detail in the Integrity Privacy Notice.

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:
• As required by the BHA to conduct our business and pursue our legitimate interests, in particular:
o we will use your information to process your registration to become an owner and ensure your suitability in accordance with measures we take to ensure the integrity of the sport;
o we use your criminal records data, provided as part of your registration, to ensure the integrity of the sport;
o we will contact you in relation to any rules or other information you may require as a registered owner;
o we will maintain records of horseracing results and share results with third party publishers of results;
o we will carry out a credit check to confirm your responses to financial questions and suitability for ownership;
o we will monitor compliance with the Rules of Racing to ensure that breaches of the Rules are upheld and sanctioned (for more details, see our Integrity Privacy Notice); and
o we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation).
• Where you give your consent:
o in other circumstances where we rely on your consent, and have explained the use of data at that time, including email marketing as set out in the owner registration.
• required by law:
o in response to requests by government or law enforcement authorities conducting an investigation, including the Gambling Commission.

Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above. You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.

Withdrawing consent or objecting to direct marketing

Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes. You have an absolute right to opt-out of direct marketing, or profiling we carry out for direct marketing, at any time. You can do this by following the instructions in the communication where this is an electronic marketing message, or by contacting us using the details set out below.

Who will we share this data with, where and when?

We will share your information with Weatherbys Limited, our data processor, who administer our racing database and provide racing related services to the BHA such as account services, VAT services and weight adding.

We may share your information with our member organisations in relation to any safeguarding concerns or investigations.

We will share your information with Racing Welfare in relation to any safeguarding concerns or investigations.

If you are already a member or have opted to become a member of the Racehorse Owners Association (ROA), we will share your information with this organisation so that they can represent your interests as a registered owner. More information on how the ROA process your personal data can be sought directly from the ROA.

We will share information with the RCA and/ or racecourses in relation to entries, including any integrity concerns.

For owners domiciled overseas, we will share your information with Great British Racing Limited in order that they can validate your ownership interests in the event that you are nominated by to join the GBRI Members’ Club by your trainer.

We will share your information with data processors that provide IT services to the BHA, for the limited purpose of hosting, supporting and maintaining their software.

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

Where information is transferred outside the EEA, and where this is to a stakeholder or vendor in a country that is not subject to an adequacy decision by the EU Commission, data is adequately protected by EU Commission approved standard contractual clauses, an appropriate Privacy Shield certification or a vendor’s Processor Binding Corporate Rules. A copy of the relevant mechanism can be provided for your review on request.

What rights do I have?

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format and to ask us to share (port) this data to another controller.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in both the GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to an EU data protection authority where you live, work or where you believe a breach may have occurred. This is likely to be the Information Commissioner’s Office in the UK.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, or would like to opt out of direct marketing, you can get in touch at dataprotection@britishhorseracing.com or by writing to either the Head of Legal or Data Protection Officer c/o British Horseracing Authority, 75 High Holborn, London, WC1V 6LS.

How long will you retain my data?

Where we process registration application data, we do this for as long as you are a registered owner and for ten years after this. We retain top level data recording your name and dates of registration indefinitely in order to keep a record of the sport.
Where we maintain records of racing results, we hold this information indefinitely in order to keep a record of the sport.
Where we hold case files in relation to breaches of the Rules of Racing by registered, licensed or permitted personnel, we hold these for the period of the investigation plus twenty years from the date that the investigation is closed or for as long as you hold a licence, registration and/or permit (whichever the longer) so that we maintain adequate records in the event that you return to horseracing in the same or another registered or licensed profession or otherwise remain a person of interest under the Rules of Racing, by remaining connected to other licensed personnel.. In exceptional circumstances, we may retain case files for a longer period where the requirement for retention outweighs the requirement for deletion.
We publish decisions of our Judicial Panel on our website- these remain for seven years from the date of the decision, or in the case of disqualifications lasting longer than seven years, for as long as the disqualification is in place. We retain the written reasons of the Judicial Panel and top level details of the decision indefinitely in order to keep a record of the sport.

OWNER PRIVACY NOTICE PDF

 

Stable employee privacy notice

Summary of how we use your data

• The British Horseracing Authority uses the data provided by your employer in the Stable Employee Application Form to administer and regulate horseracing in Great Britain and to ensure your safety and welfare.
• The British Horseracing Authority may also gather information about you from third party sources, particularly in relation to our integrity activities. More details on the information we collect from third party sources such as the public, the media and publicly available information, BHA and racecourse officials, the press and bookmakers are set out in the Integrity Privacy Notice, available on the BHA website.
• The British Horseracing Authority may share information relating to you with foreign racing authorities in relation to your registration history. Some of these authorities may be located outside of the European Economic Area. We may also share information we receive from or about you with other third parties as set out in more detail below.

What does this policy cover?

This policy describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it by and about stable employees. It does not describe the processing carried out by the BHA in relation to its integrity activities, which are covered in the Integrity Privacy Notice, available on the BHA website.

This policy also describes your data protection rights, including a right to object to some of the processing which the BHA carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information do we collect?

We collect the following personal data about you when your employer completes the Stable Employee Application Form:

1. Title
2. All Forenames
3. Surname
4. Any previous surnames
5. Date of Birth
6. Gender
7. Nationality
8. NI Number
9. Country
10. Postcode
11. Address
12. Telephone
13. Mobile Phone
14. Email
15. Next of Kin
a. Name
b. Telephone
c. Email

We also collect your name and photograph when you apply for a Racehorse Attendants Pass Card.

We may also generate information about you in order to help regulate and manage horseracing and ensure your welfare.

What information do we receive from third parties?

Sometimes, we receive information about you from third parties. In particular:
• we receive information about you from training providers in relation to your training and any safeguarding concerns or investigations;
• we may receive information about you from our member organisations in relation to any safeguarding concerns or investigations;
• we may receive information about you from Racing Welfare in relation to any safeguarding concerns or investigations;
• we receive information about you from our appointed awarding organisation in relation to your qualifications;
• we may collect some information for integrity purposes from a variety of sources such as the public, the media and publicly available information, the press, bookmakers and the stewards– this is discussed in more detail in the Integrity Privacy Notice;
• we may receive information about you from foreign racing authorities in relation to your licensing and registration history and conduct;
• we may receive information about you from other licensed, registered or permitted personnel;
• we may receive information about your performance and conduct from racecourses and BHA and racecourse officials.

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:
• As required by the BHA to conduct our business and pursue our legitimate interests, in particular:
o we will use your information to process your trainer’s application for you to join the Register of Stable Employees;
o we will contact you in relation to any rules or other information you may require as a registered stable employee;
o we will maintain records of horseracing results and share results with third party publishers of results;
o we will monitor compliance with the Rules of Racing to ensure that breaches of the Rules are upheld and sanctioned (for more details, see our Integrity Privacy Notice); and
o we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation).
• Where you give your consent:
o in circumstances where we rely on your consent, and have explained the use of data at that time, such as for email marketing.
• For purposes which are required by law:
o in response to requests by government or law enforcement authorities conducting an investigation, including the Gambling Commission.

Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above. You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.

Withdrawing consent

Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes.

Who will we share this data with, where and when?

We will share your information with Weatherbys Limited, our data processor, who administer our racing database and provide racing related services to the BHA.

We will share your information with the training providers in relation to your training and any safeguarding concerns or investigations.

We will share your information with our member organisations in relation to any safeguarding concerns or investigations.

We will share your information with Racing Welfare in relation to any safeguarding concerns or investigations.

We will share your information with foreign racing authorities when you wish to participate in horseracing in a different jurisdiction or in order that they may contact you to request your assistance in an investigation. Some of these authorities may be located outside of the European Economic Area.

We will share limited information with other licensed, permitted or registered personnel in relation to your standing as a stable employee.

We will share your information with the National Association of Racing Staff so that they can represent your interests as a registered stable employee.

We will share your information with the National Trainers Federation in order that they can administrate the stakeholder pension scheme, the Racing Industry Accident Benefit Scheme and the Death in Service Benefit Scheme on behalf of their member trainers.

We will share your information with registered or permitted trainers in relation to your employment history.

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

Personal data will also be shared with third party service providers, who will process it on behalf of the BHA for the purposes identified above. Such third parties include providers of website and system hosting for our licensing teams.

Where information is transferred outside the EEA, and where this is to a stakeholder or vendor in a country that is not subject to an adequacy decision by the EU Commission, data is adequately protected by EU Commission approved standard contractual clauses, an appropriate Privacy Shield certification or a vendor’s Processor Binding Corporate Rules. A copy of the relevant mechanism can be provided for your review on request.

What rights do I have?

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format and to ask us to share (port) this data to another controller.
In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing).
These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in both the GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to an EU data protection authority where you live, work or where you believe a breach may have occurred. This is likely to be the Information Commissioner’s Office in the UK.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, or would like to opt out of direct marketing, you can get in touch at dataprotection@britishhorseracing.com or by writing to either the Head of Legal or Data Protection Officer c/o British Horseracing Authority, 75 High Holborn, London, WC1V 6LS.

How long will you retain my data?

Where we process registration data, we do this for as long as you remain on the Stable Employees Register and for a period of five years thereafter. We retain top level data recording your name and dates of registration indefinitely in order to keep a record of the sport.

Where we maintain records of racing results, we hold this information indefinitely in order to keep a record of the sport.

Where we hold case files in relation to breaches of the Rules of Racing by registered, licensed or permitted personnel, we hold these for the period of the investigation plus twenty years from the date that the investigation is closed or for as long as you hold a licence, registration and/or permit (whichever the longer) so that we maintain adequate records in the event that you return to horseracing in the same or another registered or licensed profession or otherwise remain a person of interest under the Rules of Racing, by remaining connected to other licensed personnel.. In exceptional circumstances, we may retain case files for a longer period where the requirement for retention outweighs the requirement for deletion.

We publish decisions of our Judicial Panel on our website- these remain for seven years from the date of the decision, or in the case of disqualifications lasting longer than seven years, for as long as the disqualification is in place. We retain the written reasons of the Judicial Panel and top level details of the decision indefinitely in order to keep a record of the sport.

STABLE EMPLOYEE PRIVACY NOTICE PDF

Trainer privacy notice

Summary of how we use your data

• The British Horseracing Authority uses the data you provide in this form and any attachments, and that you might provide at other occasions, such as during a stable inspection or in response to enquiries, to administer your licence or permit application, administer and regulate horseracing in Great Britain and to ensure the safety and welfare of your horses and staff.
• The British Horseracing Authority may also gather information about you from third party sources, particularly in relation to our integrity activities. More details on the information we collect from third party sources such as the public, the media and publicly available information, BHA and racecourse officials, the press and bookmakers are set out in the Integrity Privacy Notice (available on the BHA website).
• The British Horseracing Authority asks you to provide information in relation to your unspent criminal records history. This information will be processed to ensure the integrity of the sport, and we will be entitled to retain this information for this purpose.
• The British Horseracing Authority may share information relating to you with foreign racing authorities in relation to your licence or permit history. Some of these authorities may be located outside of the European Economic Area. We may also share information we receive from or about you with other third parties as set out in more detail below.

What does this policy cover?

This policy describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it by and about trainers, particularly as part of the licence or permit application process. It does not describe the processing carried out by the BHA in relation to its integrity activities, which are covered in the Integrity Privacy Notice (available on the BHA website).
This policy also describes your data protection rights, including a right to object to some of the processing which the BHA carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information do we collect?

We collect and process personal data about you when you complete your initial licence or permit application and subsequent renewals and also when you register any non- training services pursuant to the Rules of Racing. This includes all the information you provide to us in the application forms and in any attachments submitted alongside the form.

We may also generate information about you in order to help you complete your applications and help regulate and manage horseracing and ensure your welfare. In particular, we may hold and use information on whether you need particular assistance with completing your applications, on stable inspection reports and on stewards’ reports.

What information do we receive from third parties?

Sometimes, we receive information about you from third parties. In particular:
• we may receive information about you from foreign racing authorities in relation to your licence, permit or registration history and conduct;
• we may receive information about you from training providers in relation to both your own training and that of your employees and any safeguarding concerns or investigations;
• we may receive information about you from our member organisations in relation to any safeguarding concerns or investigations;
• we may receive information about you from Racing Welfare in relation to any safeguarding concerns or investigations;
• we receive information about you from our appointed awarding organisation in relation to your qualifications;
• we may receive information about you from other licensed, registered or permitted personnel;
• we may seek information about you and your suitability and requirements for licensing or permit from publicly available sources, such as through internet searches and director checks;
• we may receive information about your performance and conduct from racecourses and BHA and racecourse officials;
• we may collect some information for integrity purposes from a variety of sources such as the public, the media and publicly available information, the press, bookmakers and the stewards– this is discussed in more detail in the Integrity Privacy Notice (available on the BHA website).

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:
• As required by the BHA to conduct our business and pursue our legitimate interests, in particular:
o we will use your information to process your application for a new or renewed licence or permit and ensure your suitability and requirements for licensing in accordance with measures we take to ensure the integrity of the sport;
o we use your criminal records data, provided as part of the licence or permit application, to ensure the integrity of the sport;
o we will contact you in relation to any rules or other information you may require as a licensed or permitted trainer;
o we will maintain records of horseracing results and share results with third party publishers of results;
o we will monitor compliance with the Rules of Racing to ensure that breaches of the Rules are upheld and sanctioned (for more details, see our Integrity Privacy Notice);
o we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation); and
o we use data of some trainers to invite them to take part in industry research.

• Where you give your consent:
o in other circumstances where we rely on your consent, and have explained the use of data at that time, including email marketing as set out in the trainer licence or permit application.

• For purposes which are required by law:
o in response to requests by government or law enforcement authorities conducting an investigation, including the Gambling Commission

.Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above. You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.

Withdrawing consent or objecting to direct marketing

Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes. You have an absolute right to opt- out of direct marketing, or profiling we carry out for direct marketing, at any time. You can do this by following the instructions in the communication where this is an electronic marketing message, or by contacting us using the details set out below.

Who will we share this data with, where and when?

We will share your information with foreign racing authorities when you wish to participate in horseracing in a different jurisdiction or in order that they may contact you to request your assistance in an investigation. Some of these authorities may be located outside of the European Economic Area.

We will share your information with Weatherbys Limited, our data processor, who administer our racing database and provide racing related services to the BHA.

We will share your information with training providers in relation to your training and any safeguarding concerns or investigations.

We will share your information with Racing Welfare in relation to any safeguarding concerns or investigations.

We will share your information with our member organisations in relation to any safeguarding concerns or investigations.

We will share limited information with other licensed, permitted or registered personnel in relation to your standing as a trainer.

We will share your information with Jockey Club Estates in relation to your use of their training facilities.

We will share your information with the Point to Point Authority, where necessary, to assist with their regulated activities.

We will share your information with the National Trainers’ Federation (“NTF”) so that they can represent your interests as a licensed or permitted trainer. They will also use this information for the administration of the Racing Industry Accident Benefit Scheme (RIABS), the Stable Employees Life Assurance Scheme and the Stable Employees’ Pension Plan. More details on how the NTF handle your information can be sought directly from the NTF.

We will share information with the RCA and/ or racecourses in relation to entries, including any integrity concerns.

We will share your information with Great British Racing Limited to assist them in validating your details where you nominate an owner to join the GBRI Members’ Club.
Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

Personal data will also be shared with third party service providers, who will process it on behalf of the BHA for the purposes identified above. Such third parties include providers of website and system hosting for our licensing teams.

Where information is transferred outside the EEA, and where this is to a stakeholder or vendor in a country that is not subject to an adequacy decision by the EU Commission, data is adequately protected by EU Commission approved standard contractual clauses, an appropriate Privacy Shield certification or a vendor’s Processor Binding Corporate Rules. A copy of the relevant mechanism can be provided for your review on request.

What rights do I have?

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format and to ask us to share (port) this data to another controller.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in both the GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to an EU data protection authority where you live, work or where you believe a breach may have occurred. This is likely to be the Information Commissioner’s Office in the UK.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, or would like to opt out of direct marketing, you can get in touch at dataprotection@britishhorseracing.com or by writing to either the Head of Legal or Data Protection Officer c/o British Horseracing Authority, 75 High Holborn, London, WC1V 6LS.

How long will you retain my data?

Where we process licence and permit application data and stable inspection reports, we do this for as long as you hold a trainer’s licence or permit and for ten years after this. We retain top level data recording your name, date of licence/ permit and licence/ permit type indefinitely in order to keep a record of the sport.

Where we maintain records of racing results, we hold this information indefinitely in order to keep a record of the sport.

Where we hold case files in relation to breaches of the Rules of Racing by registered, licensed or permitted personnel, we hold these for the period of the investigation plus twenty years from the date that the investigation is closed or for as long as you hold a licence, registration and/or permit (whichever the longer) so that we maintain adequate records in the event that you return to horseracing in the same or another registered or licensed profession or otherwise remain a person of interest under the Rules of Racing, by remaining connected to other licensed personnel.. In exceptional circumstances, we may retain case files for a longer period where the requirement for retention outweighs the requirement for deletion.

We publish decisions of our Judicial Panel on our website- these remain for seven years from the date of the decision, or in the case of disqualifications lasting longer than seven years, for as long as the disqualification is in place. We retain the written reasons of the Judicial Panel and top level details of the decision indefinitely in order to keep a record of the sport.

TRAINER PRIVACY NOTICE PDF

Valet privacy notice

Summary of how we use your data

• The British Horseracing Authority uses the data you provide in this form and any attachments or in response to enquiries to administer your licence or permit application, administer and regulate horseracing in Great Britain and to ensure the safety and welfare of horses.
• The British Horseracing Authority may also gather information about you from third party sources, particularly in relation to our integrity activities. More details on the information we collect from third party sources such as the public, the media and publicly available information, BHA and racecourse officials, the press and bookmakers are set out in the Integrity Privacy Notice, available on the BHA website.
• The British Horseracing Authority asks you to provide information in relation to your unspent criminal records history. This information will be processed to ensure the integrity of the sport, and we will be entitled to retain this information for this purpose.
• The British Horseracing Authority may share information relating to you with foreign racing authorities in relation to your licence or permit history. Some of these authorities may be located outside of the European Economic Area. We may also share information we receive from or about you with other third parties as set out in more detail below.

What does this policy cover?

This policy describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it by and about valets, particularly as part of the licence or permit application process. It does not describe the processing carried out by the BHA in relation to its integrity activities, which are covered in the Integrity Privacy Notice, available on the BHA website.

This policy also describes your data protection rights, including a right to object to some of the processing which the BHA carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information do we collect?

We collect and process personal data about you when you complete your initial licence or permit application and subsequent renewals. This includes all the information you provide to us in the application forms and in any attachments submitted alongside the form.

What information do we receive from third parties?

Sometimes, we receive information about you from third parties. In particular:

• we may receive information about you from foreign racing authorities in relation to your licensing history and conduct;
• we may receive information about you from our member organisations in relation to any safeguarding concerns or investigations;
• we may receive information about you from Racing Welfare in relation to any safeguarding concerns or investigations;
• we may receive information about you from other licensed, registered or permitted personnel;
• we may seek information about you and your suitability and requirements for a licence or permit from publicly available sources, such as through internet searches and director checks;
• we may receive information about your performance and conduct from racecourses and BHA and racecourse officials;
• we may collect some information for integrity purposes from a variety of sources such as the public, the media and publicly available information, the press, bookmakers and the stewards– this is discussed in more detail in the Integrity Privacy Notice.

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:

• As required by the BHA to conduct our business and pursue our legitimate interests, in particular:
o we will use your information to process your application for a new or renewed licence or permit and ensure your suitability and requirements for licensing in accordance with measures we take to ensure the integrity of the sport;
o we use your criminal records data, provided as part of the licence or permit application, to ensure the integrity of the sport;
o we will contact you in relation to any rules or other information you may require as a licensed or permitted valet;
o we will monitor compliance with the Rules of Racing to ensure that breaches of the Rules are upheld and sanctioned (for more details, see our Integrity Privacy Notice);
o we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation).

• Where you give your consent:
o in other circumstances where we rely on your consent, and have explained the use of data at that time.

• For purposes which are required by law:
o in response to requests by government or law enforcement authorities conducting an investigation, including the Gambling Commission.

Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above. You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.

Withdrawing consent

Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes.

Who will we share this data with, where and when?

We will share your information with foreign racing authorities when you wish to participate in horseracing in a different jurisdiction.

We will share your information with Weatherbys Limited, our data processor, who administer our racing database and provide racing related services to the BHA.

We will share your information with Racing Welfare in relation to any safeguarding concerns or investigations.

We will share your information with our member organisations in relation to any safeguarding concerns or investigations.

We will share limited information with other licensed, permitted or registered personnel in relation to your standing as a valet.

We will share information with the RCA and/ or racecourses in relation to entries, including any integrity concerns.

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

Personal data will also be shared with third party service providers, who will process it on behalf of the BHA for the purposes identified above.  Such third parties include providers of website and system hosting for our licensing teams.

Where information is transferred outside the EEA, and where this is to a stakeholder or vendor in a country that is not subject to an adequacy decision by the EU Commission, data is adequately protected by EU Commission approved standard contractual clauses, an appropriate Privacy Shield certification or a vendor’s Processor Binding Corporate Rules.  A copy of the relevant mechanism can be provided for your review on request.

What rights do I have?

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format and to ask us to share (port) this data to another controller.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.  Relevant exemptions are included in both the GDPR and in the Data Protection Act 2018.  We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to an EU data protection authority where you live, work or where you believe a breach may have occurred.  This is likely to be the Information Commissioner’s Office in the UK.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, you can get in touch at dataprotection@britishhorseracing.com or by writing to either the Head of Legal or Data Protection Officer c/o British Horseracing Authority, 75 High Holborn, London, WC1V 6LS.

How long will you retain my data?

Where we process licence application data, we do this for as long as you hold a valet’s licence and for ten years after this.  We retain top level data recording your name and dates of licence indefinitely in order to keep a record of the sport.

Where we maintain records of racing results, we hold this information indefinitely in order to keep a record of the sport.

Where we hold case files in relation to breaches of the Rules of Racing by registered, licensed or permitted personnel, we hold these for the period of the investigation plus twenty years from the date that the investigation is closed or for as long as you hold a licence, registration and/or permit (whichever the longer) so that we maintain adequate records in the event that you return to horseracing in the same or another registered or  licensed profession or otherwise remain a person of interest under the Rules of Racing, by remaining connected to other licensed personnel.. In exceptional circumstances, we may retain case files for a longer period where the requirement for retention outweighs the requirement for deletion.

We publish decisions of our Judicial Panel on our website- these remain for seven years from the date of the decision, or in the case of disqualifications lasting longer than seven years, for as long as the disqualification is in place.  We retain the written reasons of the Judicial Panel and top level details of the decision indefinitely in order to keep a record of the sport.

VALET PRIVACY NOTICE PDF

Rider privacy notice

Summary of how we use your data

• The British Horseracing Authority uses the data you provide in this form, and medical attachments, to administer your licence or permit application, administer and regulate horseracing in Great Britain and to ensure your health and welfare when racing in Great Britain.

• In order to ensure that your information can be provided to: BHA registered Racecourse Medical Officers; doctors and nurses employed by the racecourses; physiotherapists; other healthcare professionals; and concussion testing centres and neuropsychologists that we engage to provide such services to assess your care, we ask that you consent to the sharing of your medical information with such third parties. This consent is required for us to share your confidential medical records. The BHA uses your data otherwise for the purposes of occupational medicine. If you fail to provide this consent, or withdraw it in the future, we may still retain your data and may be required and entitled to prevent you from racing on safety grounds.

• The British Horseracing Authority also asks that you consent to our retention of your medical records to allow the creation of a research database to study the effects of concussion on riders and jockeys. This database will be accessed only by British Horseracing Authority doctors, although records may be shared with your consent or in anonymous form. You are entitled to opt out of this research at any time. Our legal basis for the processing is the carrying out of scientific research, which is in our legitimate interest. We do not process our research data with the purpose of taking decisions on particular jockeys.
• The British Horseracing Authority asks you to provide information in relation to your unspent criminal records history. This information will be processed to ensure the integrity of the sport, and we will be entitled to retain this information for this purpose.

• The British Horseracing Authority may also gather information about you from third party sources, particularly in relation to our integrity activities. More details on the information we collect from third party sources such as the public, the media and publicly available information, BHA and racecourse officials, the press and bookmakers are set out in the BHA’s Integrity Privacy Notice, available on the BHA website.

• The British Horseracing Authority may share information in relation to your licence or permit history (including your medical information) with foreign racing authorities in other countries. Some of these authorities may be located outside of the European Economic Area.

• We may also share information we receive from or about you with other third parties as set out in more detail below.

• The British Horseracing Authority uses a number of different information systems. One of these systems, used to host our medical database, is currently based in Canada. We take steps to ensure your data is adequately protected whenever it is transferred outside the European Economic Area.

What does this policy cover?

This policy describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it by and about riders, particularly as part of the licence or permit application process. It does not describe the processing carried out by the BHA in relation to its integrity or anti-doping activities, which are covered in the BHA’s Integrity Privacy Notice and Anti-Doping Privacy Notice, both of which are available on the BHA website.

This policy also describes your data protection rights, including a right to object to some of the processing which the BHA carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.
What information do we collect?
We collect and process personal data about you when you: complete your initial licence or permit application and subsequent renewals; complete your pre-licence skills and fitness assessment form; contact the BHA for support and guidance about a graded return to activity following a Covid-19 infection; and when you register any non- riding interests pursuant to the Rules of Racing. This includes all the information you provide to us in the application forms and in the medical attachments submitted alongside the form.
We may also generate information about you in order to help you complete your applications and help regulate and manage horseracing and ensure your welfare. In particular, we may hold and use information on whether you need particular assistance with completing your applications, need to be permitted to take specific medications or should be prevented from racing whilst recovering from an illness or injury.

What information do we receive from third parties?

Sometimes, we receive information about you from third parties. In particular:

• we receive information about you from training providers in relation to your training and performance and any safeguarding concerns or investigations;
• we may receive information about you from our member organisations in relation to any safeguarding concerns or investigations;
• we may receive information about you from Racing Welfare in relation to any safeguarding concerns or investigations;
• we receive information about you from our appointed awarding organisation in relation to your qualifications;
• we may receive information about you from foreign racing authorities in relation to your performance in that jurisdiction, your registration, permit and licensing history and conduct and also your medical records in relation to your fitness to ride;
• we may receive information about your performance and conduct from racecourses and BHA and racecourse officials;
• we may receive information about you from other licensed, registered or permitted personnel;
• we receive, where you have given your consent to the appropriate health professional, assessments or details of your health as part of your medical attachments and otherwise during the course of your licence or permit;
• we may seek information about you and your suitability and requirements for licence or permit from publicly available sources, such as through internet searches;
• we may collect some information for integrity purposes from a variety of sources such as the public, the media and publicly available information, the press, bookmakers and BHA and racecourse officials– this is discussed in more detail in the Integrity Privacy Notice.

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:

• As required by the BHA to conduct our business and pursue our legitimate interests, in particular:

o we will use your information to process your application for a new or renewed licence or permit and ensure your suitability and requirements for licensing or permitting in accordance with measures we take to ensure the integrity of the sport;
o we conduct appropriate occupational health assessments of you and your ability to race throughout the licence or permit period – as this involves sensitive data, this is also based on the BHA’s need to perform occupational medicine to ensure the working capacity and safety of riders;
o we will use your health data and medical records to produce a research database to study the effects of concussion on riders and jockeys. As this involves sensitive data, this is also based on the BHA’s scientific research purposes. This database will be accessed only by British Horseracing Authority doctors, although records may be shared with your consent or in anonymous form. We do not process our research data with the purpose of taking decisions on particular jockeys.
o we use your criminal records data, provided as part of the licence or permit application, to ensure the integrity of the sport;
o we will contact you in relation to any rules or other information you may require as a licensed or permitted rider;
o we will maintain records of horseracing results and share results with third party publishers of results;
o we will monitor compliance with the Rules of Racing to ensure that breaches of the Rules are upheld and sanctioned (for more details, see our Integrity Privacy Notice and Anti-Doping Privacy Notice);
o we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation), such as selecting individuals for anti-doping testing; and
o we use data of some riders to invite them to take part in industry research;

• Where you give your consent:

o we will share information with third parties with whom you would like us to share data, such as medical specialists to assess an injury you have suffered;
May 2020
o in other circumstances where we rely on your consent, and have explained the use of data at that time, including email marketing as set out in the rider’s licence or permit application.

• For purposes which are required by law:

o in response to requests by government or law enforcement authorities conducting an investigation, including the Gambling Commission.

Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above. You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.

Withdrawing consent or objecting to direct marketing or research

Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes – in particular, whilst we seek your consent for sharing with and obtaining data from third party medical staff, we process medical data in order to ensure that you are fit to race and withdrawing consent may result in your being excluded from racing for safety reasons. You have an absolute right to opt-out of research processing, and of direct marketing, or profiling we carry out for direct marketing, at any time. You can do this by following the instructions in the communication where this is an electronic marketing message, or by contacting us using the details set out below.

Who will we share this data with, where and when?

We may share information (including your medical information) relating to you with foreign racing authorities so that they may determine your fitness to ride in those jurisdictions or where you wish to participate otherwise in horseracing in a different jurisdiction or in order that they may contact you to request your assistance in an investigation. Some of these authorities may be located outside of the European Economic Area.

We will share your information with Weatherbys Limited, our data processor, who administer our racing database and provide racing related services to the BHA.

We will share your information with the training providers in relation to your training and performance and any safeguarding concerns or investigations.

We may share your information with our member organisations in relation to any safeguarding concerns or investigations.

We will share your information with Racing Welfare and JETS in relation to your licensing/ permit history and any safeguarding concerns or investigations.

We will share your information with the Professional Jockeys Association (PJA) so that they can represent your interests as a licensed jockey. More details on how the PJA handle your personal data can be sought directly from the PJA.

We will share your information with the Amateur Jockeys Association (AJA) so that they can represent your interests as a permitted rider. More details on how the AJA handle your personal data can be sought directly from the AJA.

We will share limited information with other licensed, permitted or registered personnel in relation to your standing as a rider.

We may share your information with the Point to Point Authority for the purposes of them checking your eligibility to ride.

We will share your information with the Injured Jockeys Fund so that they can provide you with physiotherapy services and offer support through the IJF almoner.

We will share your information with the Professional Riders Insurance Scheme to allow you to claim financial assistance in the event of an injury or illness that prevents you from working.

For amateur riders, we will share your information with our amateur riders insurance scheme service provider so that they can administrate claims.
We will share your information with external medical professionals for the purposes of your baseline and annual concussion testing and otherwise, where required, such as physiotherapists in order that may provide you with medical treatment.
We will share your information with data processors that provide IT services to the BHA such as rider performance management software, for the limited purpose of hosting, supporting and maintaining their software.

We will share information with the RCA and/ or racecourses in relation to entries, including any integrity concerns.

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

Your information may be shared in particular with a medical database, used to ensure that relevant registered staff can access your medical records where required on racecourses. This database is hosted in Canada.

Where information is transferred outside the EEA, and where this is to a stakeholder or vendor in a country that is not subject to an adequacy decision by the EU Commission, data is adequately protected by EU Commission approved standard contractual clauses, an appropriate Privacy Shield certification or a vendor’s Processor Binding Corporate Rules. A copy of the relevant mechanism can be provided for your review on request.

What rights do I have?

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format and to ask us to share (port) this data to another controller.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we are carrying out research, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in both the GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to an EU data protection authority where you live, work or where you believe a breach may have occurred. This is likely to be the Information Commissioner’s Office in the UK.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, or would like to opt out of direct marketing, you can get in touch at dataprotection@britishorseracing.com or by writing to either the Head of Legal or Data Protection Officer c/o British Horseracing Authority, 75 High Holborn, London, WC1V 6LS.

How long will you retain my data?

Where we process licence and permit application data, we do this for as long as you hold a rider’s licence or permit and for ten years after this. We retain top level data recording your name, dates of licence/ permit and licence/ permit type indefinitely in order to keep a record of the sport.

Where we maintain records of racing results, we hold this information indefinitely in order to keep a record of the sport.

Where we hold case files in relation to breaches of the Rules of Racing by registered, licensed or permitted personnel, we hold these for the period of the investigation plus twenty years from the date that the investigation is closed or for as long as you hold a licence, registration and/or permit (whichever the longer) so that we maintain adequate records in the event that you return to horseracing in the same or another registered or licensed profession or otherwise remain a person of interest under the Rules of Racing, by remaining connected to other licensed personnel.. In exceptional circumstances, we may retain case files for a longer period where the requirement for retention outweighs the requirement for deletion.
We publish decisions of our Judicial Panel on our website- these remain for seven years from the date of the decision, or in the case of disqualifications lasting longer than seven years, for as long as the disqualification is in place. We retain the written reasons of the Judicial Panel and top level details of the decision indefinitely in order to keep a record of the sport.

Where we hold copies of your medical records, we hold these for eight years following the date that your licence or permit expires or is otherwise terminated. We will, where we can contact you, ask if you would like to have your records shared with a relevant medical professional responsible for your ongoing care prior to deleting records.

Where your information is being held for research purposes as described above, relevant medical data will be retained for fifty years following the date that your licence or permit expires or is otherwise terminated.

The reason for this retention period is so that we can retain data on the possible long term effects of concussion.

RIDER PRIVACY NOTICE PDF

Plus 10 privacy notice

Summary of how we use your data

• The BHA uses your personal data in order to administer the Plus10 prize fund and award bonus prize monies to winning owners and breeders.
• Data is shared with Horse Racing Ireland where qualifying races are held in Ireland, and information may also be obtained from Horse Racing Ireland to confirm the details of runners and winners. This information may also be obtained from publicly available copies of race results.
• The BHA will also share information with Weatherbys Limited, who administer the Plus10 bonus scheme, and with Weatherbys Bank Limited where you choose to pay using a Weatherbys Bank account.
• Details of the horses, foals and breeders taking part in the Plus 10 scheme are published on the Plus10 website. Details may also be shared with relevant Sales Houses and the Racing Post where horses in the Plus10 scheme are included in sales or race declarations respectively.

What does this policy cover?
This policy describes how The British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of your data in order to manage and administer the Plus10 Bonus Scheme.
It also describes your data protection rights, including a right to object to some of the processing which the BHA carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information do we collect?

We collect and process personal data about you when you register for the Plus10 Bonus Scheme. This includes:
• your name
• your date of birth,
• your home address, email address and phone number;
• your payment details, including billing addresses and bank account details;
• details of your connection to particular horses;
• details in relation to the performance of your connected horses;
• details of your Plus10 contributions and winnings

What information do we receive from third parties?

Sometimes, we receive information about you from third parties. In particular:• Data is shared with Horse Racing Ireland where qualifying races are held in Ireland, and information may also be obtained from Horse Racing Ireland to confirm the details of runners and winners. This information may also be obtained from publicly available copies of race results

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:

• To fulfil a contract, or take steps linked to a contract: in particular, we process data to fulfill the terms of the Plus10 Bonus Scheme. This processing includes:
o verifying your identity;
o taking payments;
o communicating with you about your membership of the scheme;
o providing customer services, managing the scheme and arranging the award of bonus prizes;

• As required by the BHA to conduct our business and pursue our legitimate interests, in particular:
o we will use your information to respond to any comments or complaints you may send us;
o we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation); and

• Where you give us consent:
o we place cookies and use similar technologies in accordance with our Cookies Policy and the information provided to you when those technologies are used;
o on other occasions where we ask you for consent, we will use the data for the purpose which we explain at that time.

Withdrawing consent

Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes, such as those set out above.

Who will we share this data with, where and when?

We will share your data with Horse Racing Ireland where qualifying races are held in Ireland to ensure that the races and scheme are managed appropriately.

We will share your data with Weatherbys Bank Limited where you choose to pay using a Weatherbys Bank account, in order to facilitate your payments.

The BHA will also share details of the horses, foals and breeders taking part in the Scheme on the Plus 10 website. It will also share data more directly with Sales Houses and the Racing Post where horses in the Plus 10 Scheme are included in sales listings or race declarations respectively.
The BHA will also share information with Weatherbys Limited, our data processor, who administers the Plus10 bonus scheme on the BHA’s behalf. Weatherbys undertakes activities such as administering payments and contacting winners. We also share information with our other data processors, who carry out tasks such as hosting our email databases and sending out service emails on our behalf. One such provider is located outside the EEA in Australia, and we ensure adequate protection through the use of model contractual clauses. You can obtain a copy of these clauses by getting in contact with the BHA using the contract details set out below.
Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

What rights do I have?

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format, and to ask us to share (port) this data to another controller.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.

To exercise any of these rights, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to an EU data protection authority where you live, work or where you believe a breach may have occurred. This likely to be the Information Commissioner’s Office in the UK or the Information Commissioner in Ireland.

The provision of the vast majority of information is mandatory in order to allow us to have sufficient information to manage and administer the Plus10 scheme. If relevant data is not provided, then we will not be able to administer your Plus10 entry, and may be unable to accept payment or make bonus payments. Where information is not required for the entry and management of the Plus10 scheme, all other provision of your information is optional.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, you can get in touch at info@plus10bonus.com or by writing to Plus 10 Bonus Scheme, 75 High Holborn, London, WC1V 6LS. You can also get in touch with the BHA’s data protection officer at dataprotection@britishhorseracing.com or by writing to Data Protection Officer, c/o British Horseracing Authority, 75 High Holborn, London, WC1V 6LS.

How long will you retain my data?

Where we process registration data, we do this for as long as you are an active member of the Plus10 Bonus Scheme and for three years after your membership lapses.

Details of any payments made by you, or to you as a result of prize winning, will be retained for five years.

Changes to our privacy policy

Any changes we make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our privacy policy.

Integrity privacy notice

What does this policy cover?

This policy describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it by and about licensed, registered or permitted personnel and other participants in racing in relation to its Integrity processes. Processing carried out as part of the licence, registration or permit application is handled in the relevant notice/form for your profession – please refer to the BHA website to find the appropriate notice. Anti-doping activities are also covered elsewhere, in the BHA’s Anti-Doping Privacy Notice, also available on the BHA website.

This policy also describes your data protection rights, including a right to object to some of the processing which the BHA carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information do we collect from you?

We collect and process personal data about you when you complete your initial licence, permit or registration application and any subsequent renewals. This includes all the information you provide to us in the application forms and any attachments submitted alongside the form.

We collect and process personal data about you when you are subject to an investigation by the BHA Integrity Team, for instance, pursuant to a production order under Rule (A) 50.
Where you are charged under the Rules of Racing, we will also receive any representation you make as part of our investigations or proceedings.

What information do we receive from third parties?

Sometimes, we receive information about you from third parties. In particular:
• we may receive information about potential incidents or concerns from members of the public through our RaceStraight hotline and Priority SMS reporting lines or a member of the public otherwise assisting in an integrity investigation;
• we may receive information about you from Racing Welfare in relation to any safeguarding concerns/ investigations;
• we may receive information about you from our member organisations in relation to any safeguarding concerns/ investigations;
• we may receive information about you from foreign racing authorities in relation to relevant integrity matters;
• we may receive information about you from other licensed, permitted or registered personnel;
• we may collect information about you from publicly available sources such as the media and the internet;
• we may receive information about your integrity and discipline from racecourses and BHA and racecourse stewards, and in particular we may receive CCTV footage from racecourses;
• we may also receive information about you from sources such as the press, bookmakers, surveillance suppliers and from the BHA’s covert human intelligence sources in relation to any relevant integrity matters.

This will usually include information relating to your integrity, performance or actions or other corrupt practices, such as bets you have made or are planning to make, performances you have or will be involved in, or individuals you have been associating with. It may, occasionally, include sensitive data such as your health, or information about criminal offences you are alleged to have committed or convictions that you have.

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:

• As required by the BHA to conduct our business and pursue our legitimate interests, in particular:
o we will use your information to assess your conduct against the Rules of Racing, maintain intelligence and take any enforcement action as required under the Rules of Racing in order to maintain the integrity of the sport. Where this involves your sensitive data or criminal records data, this is also done on the basis of the BHA’s measures to protect the integrity of horseracing. We may also process such data to prevent or detect unlawful acts;
o we will contact you in relation to any rules or other information you may require as a person licensed, permitted or registered under the Rules of Racing and any questions we may have in relation to your conduct or the conduct of others;
o we will maintain records of our actions in investigating, maintaining intelligence and enforcing the Rules of Racing, including publishing our decisions in the event you are sanctioned under the Rules of Racing;
o we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation), such as maintaining intelligence on particular individuals of interest.

• For purposes which are required by law:
o in response to requests by government or law enforcement authorities conducting an investigation, or in accordance with our statutory duties, including sharing information with the Gambling Commission and/or the police.

Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above. You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.

Who will we share this data with, where and when?

We will share information with the Gambling Commission and other relevant statutory bodies, bookmakers and/or the police where this is an appropriate course of action to help enforce the Rules of Racing or ensure that appropriate action is taken by a third party, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws as set out above.

We will share your information with foreign racing authorities as necessary to comply with our obligations under international commitments and to ensure you are appropriately managed and/or suspended under the Rules of Racing in other relevant jurisdictions.

We will share your information with SAS Patriarch, our data processor, who provide and occasionally support our intelligence databases. Information is also shared with other data processors who provide software services relevant to our integrity teams.

We will share your information with Racing Welfare in relation to any safeguarding concerns or investigations.

We will share your information with our member organisations in relation to any safeguarding concerns or investigations.

We will share your information with the RSPCA in relation to any animal welfare concerns.

We will share your information with the Racecourse Association and/ or individual racecourses where you have been disqualified from racing in order to enforce access controls.

Where information is transferred outside the EEA, and where this is to a stakeholder or vendor in a country that is not subject to an adequacy decision by the EU Commission, data is adequately protected by EU Commission approved standard contractual clauses, an appropriate

Privacy Shield certification or a vendor’s Processor Binding Corporate Rules. A copy of the relevant mechanism can be provided for your review on request.

What rights do I have?

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format and to ask us to share (port) this data to another controller.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in both the GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to an EU data protection authority where you live, work or where you believe a breach may have occurred. This is likely to be the Information Commissioner’s Office in the UK.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, you can get in touch at dataprotection@britishhorseracing.com or by writing to either the Head of Legal or Data Protection Officer c/o British Horseracing Authority, 75 High Holborn, London, WC1V 6LS.

How long will you retain my data?

Where we process intelligence data, we will do this for a period of twenty years from the date of collection or for as long as you hold a licence, registration and/or permit (whichever the longer) so that we maintain adequate records in the event that you return to horseracing in the same or another registered or licensed profession or otherwise remain a person of interest under the Rules of Racing, by remaining connected to other licensed personnel.
Where we process investigations data, we will do this for the period of the investigation plus twenty years from the date that the investigation is closed or for as long as you hold a licence, registration and/or permit (whichever the longer) so that we maintain adequate records in the event that you return to horseracing in the same or another registered or licensed profession or otherwise remain a person of interest under the Rules of Racing, by remaining connected to other licensed personnel.

Equine swimming pool privacy notice

Summary of how we use your data

• The British Horseracing Authority uses the data you provide in this form and any attachments, and that you might provide at other occasions, such as during an equine swimming pool inspection or in response to enquiries, to administer your licence application, administer and regulate horseracing in Great Britain and to ensure the safety and welfare of the horses using your facility.
• The British Horseracing Authority may also gather information about you from third party sources, particularly in relation to our integrity activities. More details on the information we collect from third party sources such as the public, the media and publicly available information, BHA and racecourse officials, the press and bookmakers are set out in the BHA’s Integrity Privacy Notice, available on the BHA website.
• The British Horseracing Authority may share information relating to you with foreign racing authorities in relation to your licensing history. Some of these authorities may be located outside of the European Economic Area. We may also share information we receive from or about you with other third parties as set out in more detail below.

What does this policy cover?

This policy describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it by and about equine swimming pools, particularly as part of the licence application process.  It does not describe the processing carried out by the BHA in relation to its integrity activities, which are covered in the Integrity Privacy Notice, available on the BHA website.

This policy also describes your data protection rights, including a right to object to some of the processing which the BHA carries out.  More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information do we collect?

We collect and process personal data about you when you complete your initial licence application and subsequent renewals.  This includes all the information you provide to us in the application forms and in any attachments submitted alongside the form.

What information do we receive from third parties?

Sometimes, we receive information about you from third parties. In particular:
• we may receive information about you from foreign racing authorities in relation to your licensing history and conduct;
• we may receive information about you from other licensed, registered or permitted personnel;
• we may seek information about you and your suitability and requirements for licensing from publicly available sources, such as through internet searches and director checks;
• we may receive information about your performance and conduct from racecourses and BHA and racecourse officials;
• we may collect some information for integrity purposes from a variety of sources such as the public, the media and publicly available information, the press, bookmakers and the stewards– this is discussed in more detail in the Integrity Privacy Notice.

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:
• As required by the BHA to conduct our business and pursue our legitimate interests, in particular:
o we will use your information to process your application for a new or renewed licence and ensure your suitability and requirements for licensing in accordance with measures we take to ensure the integrity of the sport;
o we will contact you in relation to any rules or other information you may require as a licensed equine swimming pool;
o we will monitor compliance with the Rules of Racing to ensure that breaches of the Rules are upheld and sanctioned (for more details, see our Integrity Privacy Notice);
o we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation).

• Where you give your consent:
o in other circumstances where we rely on your consent, and have explained the use of data at that time such as where you consent to the BHA publishing your contact details on the BHA website.

• For purposes which are required by law:
o in response to requests by government or law enforcement authorities conducting an investigation, including the Gambling Commission.

Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above. You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.

Withdrawing consent

Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes.

Who will we share this data with, where and when?

We will share your information with foreign racing authorities when you wish to participate in horseracing in a different jurisdiction.

We will share your information with Weatherbys Limited, our data processor, who administer our racing database and provide racing related services to the BHA.

We will share limited information with other licensed, permitted or registered personnel in relation to your standing as an equine swimming pool.

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

Personal data will also be shared with third party service providers, who will process it on behalf of the BHA for the purposes identified above.  Such third parties include providers of website and system hosting for our licensing teams.

Where information is transferred outside the EEA, and where this is to a stakeholder or vendor in a country that is not subject to an adequacy decision by the EU Commission, data is adequately protected by EU Commission approved standard contractual clauses, an appropriate Privacy Shield certification or a vendor’s Processor Binding Corporate Rules.  A copy of the relevant mechanism can be provided for your review on request.

What rights do I have?

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format and to ask us to share (port) this data to another controller.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.  Relevant exemptions are included in both the GDPR and in the Data Protection Act 2018.  We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to an EU data protection authority where you live, work or where you believe a breach may have occurred.  This is likely to be the Information Commissioner’s Office in the UK.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data.  If you have any concerns about how we process your data, you can get in touch at dataprotection@britishhorseracing.com or by writing to either the Head of Legal or Data Protection Officer c/o British Horseracing Authority, 75 High Holborn, London, WC1V 6LS.

How long will you retain my data?

Where we process licence application data and equine swimming pool inspection reports, we do this for as long as you hold a licence and for ten years after this.  We retain top level data recording your name and dates of licence indefinitely in order to keep a record of the sport.

Where we maintain records of racing results, we hold this information indefinitely in order to keep a record of the sport.

Where we hold case files in relation to breaches of the Rules of Racing by registered, licensed or permitted personnel, we hold these for the period of the investigation plus twenty years from the date that the investigation is closed or for as long as you hold a licence, registration and/or permit (whichever the longer) so that we maintain adequate records in the event that you return to horseracing in the same or another registered or  licensed profession or otherwise remain a person of interest under the Rules of Racing, by remaining connected to other licensed personnel.. In exceptional circumstances, we may retain case files for a longer period where the requirement for retention outweighs the requirement for deletion.

We publish decisions of our Judicial Panel on our website- these remain for seven years from the date of the decision, or in the case of disqualifications lasting longer than seven years, for as long as the disqualification is in place.  We retain the written reasons of the Judicial Panel and top level details of the decision indefinitely in order to keep a record of the sport.

EQUINE SWIMMING POOL PRIVACY NOTICE

Riders’ agent privacy notice

Summary of how we use your data

• The British Horseracing Authority uses the data you provide in this form to administer your licence application and regulate and administer horseracing in Great Britain.
• The British Horseracing Authority asks you to provide information in relation to your unspent criminal records history. This information will be processed to ensure the integrity of the sport, and we will be entitled to retain this information for this purpose.
• The British Horseracing Authority may also gather information about you from third party sources, particularly in relation to our integrity activities. More details on the information we collect from third party sources such as the public, the media and publicly available information, BHA and racecourse officials, the press and bookmakers are set out in the Integrity Privacy Notice, available on the BHA website.
• The British Horseracing Authority may collect and share information relating to you with foreign racing authorities in relation to your licensing history. Some of these authorities may be located outside of the European Economic Area. We may also share information we

What does this policy cover?

This policy describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it by and about riders’ agents, particularly as part of the licence application process.  It does not describe the processing carried out by the BHA in relation to its integrity activities, which are covered in the Integrity Privacy Notice, available on the BHA website.

This policy also describes your data protection rights, including a right to object to some of the processing which the BHA carries out.  More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information do we collect?

We collect and process personal data about you when you complete your initial licence application and subsequent renewals.  This includes all the information you provide to us in the application forms and any further information submitted alongside the form.

We may also generate information about you in order to help you complete your applications and help regulate and manage horseracing and ensure your welfare.  In particular, we may hold and use information on whether you need particular assistance with completing your applications.

What information do we receive from third parties?

Sometimes, we receive information about you from third parties. In particular:
• we receive information about you from training providers in relation to the riders that you represent and any safeguarding concerns or investigations about you;
• we may receive information about you from Racing Welfare in relation to any safeguarding concerns or investigations about you;
• we may receive information about you from our member organisations in relation to any safeguarding concerns or investigations about you;
• we may collect some information for integrity purposes from a variety of sources such as the public, the media and publicly available information, the press, bookmakers and stewards– this is discussed in more detail in the Integrity Privacy Notice;
• we may receive information about you from foreign racing authorities in relation to your licensing and registration history and conduct;
• we may receive information about you from other licensed, registered or permitted personnel;
• we may receive information about your performance and conduct from racecourses and BHA and racecourse officials.

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:
• As required by the BHA to conduct our business and pursue our legitimate interests, in particular:
o we will use your information to process your application for a new or renewed licence and ensure your suitability in accordance with measures we take to ensure the integrity of the sport;
o we use your criminal records data, provided as part of the licence application, to ensure the integrity of the sport;
o we will contact you in relation to any rules or other information you may require as a licensed riders’ agent;
o we will maintain records of horseracing results and share results with third party publishers of results;
o we will monitor compliance with the Rules of Racing to ensure that breaches of the Rules are upheld and sanctioned (for more details, see our Integrity Privacy Notice);
o we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation).
• Where you give your consent:
o in other circumstances where we rely on your consent, and have explained the use of data at that time, including email marketing as set out in the riders’ agent licence application.
• For purposes which are required by law:
o in response to requests by government or law enforcement authorities conducting an investigation, including the Gambling Commission.

Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above.  You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.

Withdrawing consent or objecting to direct marketing

Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes.  You have an absolute right to opt- out of direct marketing, or profiling we carry out for direct marketing, at any time.  You can do this by following the instructions in the communication where this is an electronic marketing message, or by contacting us using the details set out below.

Who will we share this data with, where and when?

We will share your information with foreign racing authorities when you wish to participate in horseracing in a different jurisdiction or in order that they may contact you to request your assistance in an investigation.  Some of these authorities may be located outside of the European Economic Area.

We will share your information with Weatherbys Limited, our data processor, who administer our racing database and provide racing related services to the BHA.

We will share your contact details with third parties regarding the jockeys that you represent and with jockeys that would like you to represent them.

We will share your information with the training providers in relation to the training and performance of the jockeys that you represent and any safeguarding concerns or investigations we may have about you.

We will share your information with Racing Welfare in relation to any safeguarding concerns or investigations.

We will share your information with our member organisations in relation any safeguarding concerns or investigations.

We will share limited information with other licensed, permitted or registered personnel in relation to your standing as a riders’ agent.

Personal data will also be shared with third party service providers, who will process it on behalf of the BHA for the purposes identified above.  Such third parties include providers of website and system hosting for our licensing teams.

Where information is transferred outside the EEA, and where this is to a stakeholder or vendor in a country that is not subject to an adequacy decision by the EU Commission, data is adequately protected by EU Commission approved standard contractual clauses, an appropriate Privacy Shield certification or a vendor’s Processor Binding Corporate Rules.  A copy of the relevant mechanism can be provided for your review on request. We will share your information with foreign racing authorities when you wish to participate in horseracing in a different jurisdiction.

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

What rights do I have?

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format and to ask us to share (port) this data to another controller.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.  Relevant exemptions are included in both the GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to an EU data protection authority where you live, work or where you believe a breach may have occurred. This is likely to be the Information Commissioner’s Office in the UK.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data.  If you have any concerns about how we process your data, or would like to opt out of direct marketing, you can get in touch at dataprotection@britishhorseracing.com or by writing to either the Head of Legal or Data Protection Officer c/o British Horseracing Authority, 75 High Holborn, London, WC1V 6LS.

How long will you retain my data?

Where we process licence application data, we do this for as long as you hold a riders’ agent licence and for ten years after this.  We retain top level data recording your name and dates of licence indefinitely in order to keep a record of the sport.

Where we maintain records of racing results, we hold this information indefinitely in order to keep a record of the sport.

Where we hold case files in relation to breaches of the Rules of Racing by registered, licensed or permitted personnel, we hold these for the period of the investigation plus twenty years from the date that the investigation is closed or for as long as you hold a licence, registration and/or permit (whichever the longer) so that we maintain adequate records in the event that you return to horseracing in the same or another registered or  licensed profession or otherwise remain a person of interest under the Rules of Racing, by remaining connected to other licensed personnel.. In exceptional circumstances, we may retain case files for a longer period where the requirement for retention outweighs the requirement for deletion.

We publish decisions of our Judicial Panel on our website- these remain for seven years from the date of the decision, or in the case of disqualifications lasting longer than seven years, for as long as the disqualification is in place.  We retain the written reasons of the Judicial Panel and top level details of the decision indefinitely in order to keep a record of the sport.

RIDERS’ AGENT PRIVACY NOTICE

Safeguarding privacy policy

Summary of how the British Horseracing Authority (“The BHA”) uses your data

• The BHA processes information about participants in horseracing in order to safeguard its participants and ensure the welfare of both children and adults at risk. This involves both proactive checks (which may include such things as carrying out Disclosure and Barring Service (DBS) checks), and reactive work such as dealing with safeguarding matters that are referred to it (or of which it otherwise becomes aware) in accordance with the BHA’s Safeguarding Policy.
• The information processed by the BHA can involve sensitive and criminal records data where such data is relevant to a safeguarding investigation. This is processed on the basis of preventing and detecting unlawful activity, and for the purposes of safeguarding individuals at risk.
• Information may be obtained both directly from participants, and from third parties: such third parties include other horseracing stakeholders such as racecourses, stables or racing schools, from other individual participants or from other third parties that raise potential issues of abuse or other relevant matters or concerns. This can include other sports governing bodies, charities such as (for example) the NSPCC and ChildLine, statutory bodies, trade bodies such as the National Association of Racing Staff or Professional Jockeys Association, agencies such as the police or local authorities, or members of the wider public.
• Data is shared, where appropriate, with other stakeholders who may come into contact with or have a role in dealing with participants who pose a risk of harm to children or adults at risk in racing or other environments, such as Local Education Authorities, the police, racing stakeholders and others sports governing bodies. Further information as to how the BHA shares data is contained within the BHA’s Safeguarding Policy.
• Our privacy notice below describes your data protection rights, including a right to object to some of the processing which the BHA carries out.

What does this notice cover?

This notice describes how the BHA will make use of data – whether that data relates to a child, adult at risk, parents or carers or someone who interacts with such individuals – in order to carry out its safeguarding functions. Other important policies that may be relevant to how the BHA processes your data in other circumstances can be found by reviewing our main website privacy notice or the notices relevant to any licence or registration application.

This notice describes your data protection rights, including a right to object to some of the processing which the BHA carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information does the BHA collect about me?

The BHA collects information you provide as part of your registration or licence application with the BHA as a participant. Information may also be provided directly to the BHA in response to requests for representations, or where you make a communication about a safeguarding matter.

What information is provided by third parties about you?

Information may be obtained from third parties where the BHA becomes aware of alleged behaviour that raises safeguarding issues/concerns that involve you or in relation to which you might hold relevant information (for example, because an allegation has been made against you, you are an alleged victim, or you are a possible witness).

This information may be obtained both directly from participants, and from third parties: such third parties include other horseracing stakeholders such as racecourses, stables or racing schools, from other individual participants or from other third parties that raise potential issues of abuse or other relevant matters or concerns. This can include other sports governing bodies, charities such as (for example) the NSPCC and ChildLine, statutory bodies, trade bodies such as the National Association of Racing Staff or Professional Jockeys Association, agencies such as the police or local authorities, or members of the wider public.

Information may be obtained through DBS checks for participants where this is relevant for their role.

How does the BHA use this information, and what is the legal basis for this use?

The BHA will use this information for the following purposes:

• As required by the BHA to conduct its business and pursue its legitimate interests, in particular:
o communicating with you or about you where necessary to administer and implement the BHA’s Safeguarding Policy, and relevant regulations in place to ensure the welfare of individuals at risk;
o administering its systems holding safeguarding data; and
o collecting, sharing and retaining evidence and intelligence in relation to safeguarding and enforcing applicable Rules of Racing and regulations regarding safeguarding, including the processing of criminal offence and potentially sensitive data provided by you to prevent and detect unlawful activity and where necessary to protect children and adults at risk from neglect or physical, mental or emotional harm or to protect their physical, mental or emotional wellbeing.

• For purposes which are required by law:
o in response to requests by government or law enforcement authorities conducting an investigation.

How is data shared, where and when?

Data is shared, where appropriate, with other stakeholders who may come into contact with or have a role in dealing with participants who pose a risk of harm to children or adults at risk in racing or other environments, such as Local Education Authorities, the police, racing stakeholders and others sports governing bodies.

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legal or legitimate interests in compliance with applicable laws.

Personal data will also be shared with third party service providers, who will process it on behalf of the controllers for the purposes identified above. Such third parties include the providers of software used by the BHA to maintain records of intelligence and case management and licensing applications. Where information is transferred outside the EEA, and where this is to a stakeholder or vendor in a country that is not subject to an adequacy decision by the EU Commission, data is adequately protected by EU Commission approved standard contractual clauses, an appropriate Privacy Shield certification or a vendor’s Processor Binding Corporate Rules. A copy of the relevant mechanism can be provided for your review – you can ask for this using the contact details below.

What rights do I have?

You have the right to ask the BHA for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where one of the data controllers doesn’t have to process the data to meet a contractual or other legal requirement, or where it is using the data for direct marketing).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where it would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in both the GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, you can get in touch with the BHA – or its data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to the Information Commissioner’s Office.

Where relevant, information that is provided in order to carry out a DBS check so that you can receive a licence or take up a relevant role is mandatory. If relevant data is not provided, it may be that you cannot be registered in certain roles. Other information you provide is optional, although where you are asked to provide information and refuse to do so, where relevant to an investigation into a safeguarding matter, this may have consequences in relation to relevant enforcement action that will be explained at the time of the investigation.

How do I get in touch with the BHA, or its data protection officer?

The BHA hopes that it can satisfy queries you may have about the way it processes your data. If you have any concerns about how your data is processed by the BHA, you can get in touch at dataprotection@britishhorseracing.com or by writing to the Data Protection Officer at British Horseracing Authority, 75 High Holborn, London WC1V 6LS.

How long will you retain my data?

The BHA retains information relating to safeguarding matters as follows:

• information relating to any DBS checks is retained for the duration of any investigation or case;
• information relating to intelligence gathered in relation to safeguarding matters, and details of any actions taken by the BHA and any decisions taken to bar participants from participation on Safeguarding grounds or to enforce BHA Regulations will be reviewed every 7 years. If the BHA considers that ongoing retention is justified, it will continue to retain relevant information until at least the next review. We will also review the information we hold about you at the end of any investigation or case to ensure this remains relevant. Given the importance of ensuring that participants’ welfare is safeguarded, details may be retained for up to 75 years from the date that we receive intelligence, or commence an investigation. For particularly serious cases, we may inevitably hold information for the duration of this period, but this will remain subject to regular review.

Data Release Policy

The British Horseracing Authority has an obligation to process and handle all data and information in accordance with the General Data Protection Regulation and the Data Protection Act 2018. As the regulatory body for horseracing in Great Britain we have a duty to safeguard all types of information and data from misuse.

The BHA will not consider any request for the release of data or information that is not already in the public domain, unless we are satisfied in our sole discretion that exceptional circumstances apply. Should you wish to apply to the BHA for dispensation from this Policy on the basis of exceptional circumstances, please send your request to: dataprotection@britishhorseracing.com

Racecourse (Relevant Persons) privacy notice

Racecourse Licence Privacy Notice | Relevant Persons Suitability Assessment

Summary of how we use your data

• The British Horseracing Authority (“BHA”) uses the data you provide in this form in order to carry out a suitability assessment on all individuals holding key roles within a racecourse business (“Relevant Persons”, as defined in the Applications for a Racecourse Licence Suitability Policy) to administer and regulate horseracing in Great Britain.
• The British Horseracing Authority may also gather information about you from third party sources, particularly in relation to our integrity activities. More details on the information we collect from third party sources such as the public, the media and publicly available information, BHA and racecourse officials, the press and bookmakers are set out in the Integrity Privacy Notice (available on the BHA website).
• The British Horseracing Authority asks you to provide information in relation to your unspent criminal records history. This information will be processed to ensure the integrity of the sport, and we will be entitled to retain this information for this purpose.

What does this policy cover?

This policy describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it by and about Relevant Persons, particularly as part of the racecourse licence application process. It does not describe the processing carried out by the BHA in relation to its integrity activities, which are covered in the Integrity Privacy Notice (available on the BHA website).

This policy also describes your data protection rights, including a right to object to some of the processing which the BHA carries out.  More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section. Defined terms used in this Policy reflect those used in the BHA’s Applications for a Racecourse Licence Suitability Policy.

What information do we collect from you?

We collect and process personal data about you via the Applications for a Racecourse Licence Suitability Questions and from information contained within public registers, for example, records held by Companies House and the Insolvency Register, or from information available publicly and from other regulatory bodies or statutory agencies.  This includes all the information you provide to us in the racecourse licence application form (e.g. name, contact details etc.) and any attachments submitted alongside the form.

What information do we receive from third parties?

Sometimes, we receive information about you from third parties. In particular:

• we may receive information about you from our member organisations in relation to any safeguarding concerns or investigations;
• we may receive information about you from Racing Welfare in relation to any safeguarding concerns or investigations;
• we may receive information about you from other licensed, registered or permitted personnel;
• we may seek information about you and your suitability and requirements for licensing or permit from publicly available sources, such as through internet searches and director checks;
• we may receive information about your performance and conduct from racecourses and BHA and racecourse officials;
• we may collect some information for integrity purposes from a variety of sources such as the public, the media and publicly available information, the press, bookmakers and the stewards– this is discussed in more detail in the Integrity Privacy Notice (available on the BHA website).

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:

• As required by the BHA to conduct our business and pursue our legitimate interests, where your interests and fundamental rights do not override those interests, in particular:

–  we will use your information to conduct your suitability assessment and any requirements for licensing in accordance with measures we take to ensure the integrity of the sport;
–  we use your criminal records data, provided as part of the racecourse licence or permit application, to ensure the integrity of the sport;
–  we will use your information to respond to any comments or complaints you may send us;
–  we will contact you in relation to any rules or other information you may require in your role as a Relevant Person;
–  we will monitor compliance with the Rules of Racing to ensure that breaches of the Rules are upheld and sanctioned (for more details, see our Integrity Privacy Notice);
–  we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation).

• For purposes which are required by law:

–  in response to requests by government or law enforcement authorities conducting an investigation, or in accordance with our statutory duties, including sharing information with the Gambling Commission and/or the police.

• We may also use your personal data in other ways and will provide specific notice at the time of collection and obtain your consent where necessary.

Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above.  You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.

Who will we share this data with, where and when?

We will share information with your employer racecourse and/or the Racecourse Association in relation to any integrity concerns.

We will share your information with Racing Welfare in relation to any safeguarding concerns or investigations.

We will share your information with our member organisations in relation to any safeguarding concerns or investigations.

We will share your information with Weatherbys Limited, our data processor, who administer our racing database and provide racing related services to the BHA.

We will share limited information with other licensed, permitted or registered personnel in relation to your standing as a Relevant Person.

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

Personal data will also be shared with third party service providers, who will process it on behalf of the BHA for the purposes identified above.  Such third parties include providers of website and system hosting for our licensing teams.

Where information is transferred outside the EEA, and where this is to a stakeholder or vendor in a country that is not subject to an adequacy decision by the EU Commission, data is adequately protected by EU Commission approved standard contractual clauses, an appropriate Privacy Shield certification or a vendor’s Processor Binding Corporate Rules.  A copy of the relevant mechanism can be provided for your review on request.

What rights do I have?

 You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format and to ask us to share (port) this data to another controller.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.  Relevant exemptions are included in both the GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to an EU data protection authority where you live, work or where you believe a breach may have occurred.  This is likely to be the Information Commissioner’s Office in the UK.

For the purposes of the Relevant Person suitability test, the provision of information is mandatory: if relevant data is not provided, then we will not be able to process the test and you will not be able to hold the Relevant Position.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data.  If you have any concerns about how we process your data, you can get in touch at dataprotection@britishhorseracing.com or by writing to either the Head of Legal or Data Protection Officer c/o British Horseracing Authority, 75 High Holborn, London, WC1V 6LS.

How long will you retain my data?

Where we process licence application data, we do this for as long as you hold a Relevant Position and for ten years after this.

Where we hold case files in relation to breaches of the Rules of Racing by registered, licensed or permitted personnel or entities, we hold these for ten years following the date of the hearing or, if there is no hearing, for ten years from the date that the investigation is passed over from the BHA Integrity Team to the BHA Regulatory Team.  In exceptional circumstances, we may retain case files for a longer period where the requirement for retention outweighs the requirement for deletion.

We publish decisions of our Judicial Panel on our website- these remain for seven years from the date of the decision, or in the case of disqualifications lasting longer than seven years, for as long as the disqualification is in place.  We retain the written reasons of the Judicial Panel and top level details of the decision indefinitely in order to keep a record of the sport.

 

Covid-19 privacy notice in relation to the elite athlete exemption and frequent private traveller exemption

What does this policy cover?

This notice describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it as part of its Covid-19 screening activities by and about: all licensed and registered personnel that apply to the BHA as sponsoring authority for a general elite athlete exemption under the UK Government’s policy on Cross Border Competition; and all licensed and registered personnel that apply to the BHA for a frequent private traveller exemption.  This notice is supplementary to the privacy notice concerning the BHA’s existing data processing in relation to the more general Covid-19 screening activities and your role in racing as set out on the BHA website https://www.britishhorseracing.com/about/data-protection/ .

This policy also describes your data protection rights, including a right to object to some of the processing that the BHA carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information do we collect?

For the General Elite Athlete Exemption

We collect the information included on the registration form, which includes your name, date of birth, contact details, position in racing, passport details, self- isolation address and journey details including dates and details of the route travelled, locations visited and stop offs.

We collect the results of your Covid-19 tests that you provide to us as a condition of the award of an elite athlete exemption.

We may also collect additional data such as photographs or other evidence requested by the BHA Chief Medical Adviser in order that he can satisfy himself of compliance with the conditions of the elite athlete exemption.

For the Frequent Traveller Exemption

In addition to the data outlined above, we also collect the daily high- level medical screening information, including temperature readings, that you provide via the BHA Smartabase Application during the seven days post your return to the UK.

What information do we receive from third parties?

For the Frequent Traveller Exemption, Covid-19 tests are arranged by the BHA Medical Department with one of its chosen suppliers and the test results are received directly from such suppliers.

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:

• As required by the BHA to pursue our legitimate interests, in particular:

– we will use your information to assess your suitability for the elite athlete exemption and/ or frequent traveller exemption in order to protect your health and safety and that of other racing participants and other citizens of Great Britain. Where this involves your sensitive data, this is also done for reasons of public health;

•For purposes which are required by law:

– in response to requests by government or law enforcement authorities conducting an investigation, or in accordance with our statutory duties, including to Public Health England and Border Force.

Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above. You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.

Who will we share this data with, where and when?

We will share your information with companies providing IT services to the BHA from time to time for the limited purposes of hosting, supporting and maintaining their software, for instance the company used to develop the BHA Smartabase application, Fusion Sport.

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

For jockeys, we may share information (including your medical information) relating to you with foreign racing authorities so that they may determine your fitness to ride in those jurisdictions or where you wish to participate otherwise in horseracing in a different jurisdiction. Some of these regulators may be located outside of the European Economic Area. Where this is to a regulator in a country that is not subject to an adequacy decision by the EU Commission, data is adequately protected by EU Commission approved standard contractual clauses, an appropriate Privacy Shield certification or a vendor’s Processor Binding Corporate Rules.  A copy of the relevant mechanism can be provided for your review on request. In other circumstances, we might ask for your consent to share this data, where you have requested that we provide it to a foreign racing authority.

We will share the name of any individual accompanying an Irish based runner to a horseracing fixture in Great Britain with the Irish Horseracing Board so that they are able to monitor and enforce Irish Government guidance on self- isolation on arrival in the Republic of Ireland.

What rights do I have?

 You have the right to ask us for a copy of your personal data and to correct, delete or restrict (stop any active) processing of your personal data.

In addition, you can object to the processing of your personal data in some circumstances where we don’t have to process the data to meet a contractual or other legal requirement.

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in both the GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to an EU data protection authority where you live, work or where you believe a breach may have occurred. This is likely to be the Information Commissioner’s Office in the UK.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, you can get in touch at dataprotection@britishhorseracing.com or by writing to either the Head of Legal or the Data Protection Officer c/o British Horseracing Authority, 75 High Holborn, London, WC1V 6LS.

How long will you retain my data?

We will retain the results of any Covid-19 tests, application forms, daily monitoring questionnaires and temperature readings for a period of six months from the date that the UK Government’s Covid-19 Alert remains at Level 1.