BMC Privacy Policy
Introduction
The British Mountaineering Council (company number 02874177) want to make sure all the personal information we have collected about you is safe and secure whether we collect it through our website at thebmc.co.uk (“Site”) BMC apps or from other sources. This Policy set outs our commitments to you, in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We have appointed a data protection lead to oversee our compliance with data protection laws. If you have any questions about this Policy or what we do with your personal information, their contact details are set out in the "Contact" section below.
Collecting specific, relevant personal information is a necessary part of us being able to provide you with any services you may request from us or in providing services to our customers and members or just managing our relationship with you.
This privacy policy will give an overview on what personal information is collection from you and the privacy notices below set out specific information that we may collect from different BMC operational areas which may apply to you:
Membership
When you sign up for membership with us, you may provide us with or we may obtain personal information about you, such as information regarding your
- personal contact details that allows us to contact you directly such as name, title, address, email addresses and telephone numbers;
- date of birth;
- family members connected to your membership;
- current and historic membership details including membership type, start and end date;
- any club or committee connections;
- records of your interactions with us such as telephone conversations, emails and other correspondence and your instructions to us;
- payment details – bank account number, sort code, card details records of your attendance at any events hosted by us;
- records of your attendance at any events hosted by us and incidents / near misses;
- your marketing preferences so that we know whether and how we should contact you
Insurance
In addition to the membership information above:
- Insurance policy details such as policy type, start and end date; medical referral number
Competitions and other events
In addition to any membership details (when applicable):
- Dietary requirements
- Medical conditions
- Physical or mental disabilities
- Gender
- Date of birth
- Membership details (including Mountaineering Scotland)
- Next of kin details
- Climbing/mountaineering ability
- Instructor or coaching award levels
- Full name and category is published on the results page after each competition
Volunteers
In addition to any membership details and any Competition and other events details (when applicable):
- Training undertaken for the role
Shop
- Delivery address
- Billing address
- Item purchases
We also collect and use cookies on the BMC websites. Please see below for further information.
In addition to cookies, we may occasionally use limited personal information (such as your name and email address) to help deliver more relevant marketing through trusted advertising partners like Meta (Facebook and Instagram) and Google (including Google Ads and YouTube).This may include creating “lookalike” audiences or excluding existing members or insurance customers from promotional campaigns. Your data is encrypted before sharing and is not used by Meta for any other purpose.
You can opt out of this type of data use at any time by contacting us office@thebmc.co.uk or by adjusting your cookie preferences at here
In some cases, and in line with our cookie and privacy policies, we may also use encrypted versions of your personal information (such as your email address) to work with trusted advertising partners like Meta (Facebook and Instagram) and Google (including Google Ads and YouTube). This helps us show relevant content to new audiences and avoid sending marketing to existing members or customers. These partners do not receive your information in a personally identifiable form and are not permitted to use it for their own purposes.
Non-essential cookies are only set after consent has been obtained and users can manage cookie preferences through the cookie banner or preference centre.
For more details, please refer to our Cookie Policy and your BMC Marketing preference details
Special categories of personal information
We voluntarily collect anonymised EDI data from surveys via the membership portal or in person at events, in order to report on and understand our membership base.
The table below describes the main purposes for which we process your personal information, the categories of your information involved and our lawful basis for being able to do this.
| Purpose | Personal information used | Lawful basis |
| Members | ||
| To administer any membership account(s) you have with us and managing our relationship with you, including arranging for any insurance and dealing with payments and any support, service or product enquiries made by you | All contact and membership details, transaction and payment information, records of your interactions with us, and marketing preferences. | This is necessary to enable us to properly manage and administer your membership contract with us on the basis of explicit consent. |
| To arrange and manage any contracts for the provision of any products and/or services. | All contact and membership details. Transaction and payment information. | This is necessary to enable us to properly administer and perform any contract for the provision of products and/or services. |
| To send you information which is included within your membership benefits package, including details about advanced membership information, your insurance policies*,* competitions and events, partner offers and discounts and any updates about the British Mountaineering Council organisation. | All contact and membership details | This is necessary to enable us to properly manage and administer your membership contract with us on the basis of explicit consent. |
| To answer your queries or complaints | Contact details and records of your interactions with us | We have a legitimate interest to provide complaint handling services to you in case there are any issues with your membership on the basis of explicit consent. |
| To conduct data analytics studies to better understand event attendance and trends within the sport | Records of your attendance at any events or competitions hosted by us. | We have a legitimate interest in doing so to ensure that our membership is targeted and relevant. |
| For audience matching with our paid advertising platforms such as Meta (Facebook and Instagram) and Google in order to advertise our membership and travel insurance services more cost-efficiently. This involves securely sharing encrypted (hashed) data to enable the creation of “lookalike audiences” and to suppress existing members from receiving irrelevant marketing. | Limited personal data such as email addresses | We have a legitimate interest in doing so to ensure that our membership is targeted and relevant. |
| For the purposes of promoting the sport, our events and membership packages. | Images in video and/or photographic form. | Where you have given us your explicit consent to do so – and parental consent where children are involved. |
| To comply with health and safety requirements | Records of attendance | We have a legal obligation and a legitimate interest to provide you and other members of our organisation with a safe environment in which to participate |
| For the purposes of equal opportunities monitoring | Information about your race or ethnicity, religious beliefs and sexual orientation | We have a legitimate interest to promote an environment that is inclusive, fair and accessible. |
| Competitions and other events (when applicable) | ||
| To administer your attendance at any courses or programmes you sign up to | All contact and membership details, Youth Climbing Series age category, transaction and payment data.Details of your current affiliated club or other, coaching/teaching qualifications and/or officiating history. | This is necessary to enable us to register you on to and properly manage and administer your development through the course and/or programme. |
| To conduct performance reviews, managing performance and determining performance requirements | All performance and attendance data and information about your health.Details of your current affiliated club or other, coaching/teaching qualifications and/or officiating history.Qualification start & end dates. | This is necessary to enable us to properly manage and administer your development through the course and/or programme.We process special category personal data on the basis of the “special category reasons for processing of your personal data” |
| To ensure the smooth running of the event for example passing relevant data to event organisers or volunteers | All contact and membership details, Youth Climbing Series age category, transaction and payment data.Dietary requirements, booking preferences, accessibility requirements.Data may be shared with event organisers such as venues, judges, routesetters. | We have a legitimate interest in doing so to ensure that events run smoothly. |
| To comply with legal obligations, for example, regarding people working with children or vulnerable adults to comply with our safeguarding requirements | Information about your criminal convictions and offences, DBS checks, case management files. | For criminal records history we process it on the basis of legal obligations or based on your explicit consent. |
| Everything else | ||
| To administer any shop purchases, donations or legacies you make with us and managing our relationship with you, and dealing with payments and any support, service or product enquiries made by you | All contact, transaction and payment information, records of your interactions with us, and marketing preferences. | This is necessary to enable us to properly manage and administer your shop purchase with us. |
| To send you other marketing information we think you might find useful or which you have requested from us, including our newsletters, information about Membership, events, participation products and information about our commercial partners | All contact and membership details and marketing preferences | Where you have given us your explicit consent to do so. |
| Research and analysis to monitor and improve our services | All contact and membership details and marketing preferences, cookie data from Site use and any additional information given to us | To enable us to monitor for safeguarding, ensure that services run smoothly, and improve them where we can. |
We typically collect information that you provide by filling in forms on http://www.thebmc.co.uk (the “Site”). This includes information provided at the time of registering to use the Site, becoming a member of the British Mountaineering Council (the BMC), purchasing insurance or shop items, donating to the Access and Conservation Trust and signing up to events. We may also ask you for information when you report a problem with the Site.
We may also collect information from you from other 3rd party online platforms for events and surveys (see below for more information about data sharing).
If you contact us, we may keep a record of that correspondence.
We may collect information about your computer, including (where available) your IP address, operating system and browser type. This data is used to help improve your experience with our online communications and to report aggregate information to our advertisers.
You may refuse to accept cookies by changing the settings on your browser. However, if you select this setting you may be unable to access certain parts of the Site. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when visit the Site. Find out more about which cookies are collected here.
Where applicable, we may share personal information with the following parties and Data Processors:
- To any governing bodies, regional bodies or event organisers for the activities covered by the BMC, to allow them to properly administer the event on a local, regional and national level.
- To Mountain Training, if you are also a member of Mountain Training.
- Other service providers: for example, email marketing platforms, SMS platform payment processors, insurance underwriters, online Summit magazine platform, data analysis, contractors or suppliers and IT services (including CRM, website, video- and teleconference services);
- Our supply chain partners & sub-contractors, such as couriers, mailing houses;
- The Government or our regulators: where we are required to do so by law or to assist with their investigations or initiatives.
- Police, law enforcement and security services: to assist with the investigation and prevention of crime and the protection of national security.
- In addition, we may securely share encrypted versions of limited personal information (such as names and email addresses) with trusted advertising partners such as Meta (Facebook and Instagram) and Google (including Google Ads and YouTube). This is done to help us deliver more relevant marketing and avoid sending promotions to existing members or insurance customers. These partners use this data only to create “custom” or “lookalike” audiences and then delete it after matching. We rely on our legitimate interests as the lawful basis for this processing.
We do not disclose personal information to anyone else except as set out above. Any Data Processor, will be vetted to the highest standard, and sufficient contracts will be in place to protect the integrity and privacy of your data.
Disclosure of your personal information with clubs
BMC affiliated clubs provide us with personal information about their members in order to register them for insurance and other member benefits. By storing and using this personal data, we become joint controllers of this personal data. Clubs have a responsibility to provide their members with both our and their privacy notices.
The BMC takes all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy. Where personal information is transferred outside the United Kingdom, we ensure that appropriate safeguards are in place, such as adequacy regulations, the International Data Transfer Agreement (IDTA), or other approved transfer mechanisms.
- This section sets out the data retention policies and procedure of the BMC, which are designed to help ensure compliance with legal obligations in relation to the retention and deletion of personal information
- Personal information that is processed by the BMC for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes.
Without prejudice to point 2 (above) the BMC will usually delete personal data falling within the categories set out below at the date/time set out below:
| Record Type | Retention Period |
| Information about a computer and about visits to and use of the BMC website and associated digital products (including an IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and website navigation paths | 6 years |
| Information provided when registering with the BMC website and associated digital products (including email address) | 6 years after last interaction |
| Information provided when completing a profile on the BMC website and associated digital products (including a name, gender, date of birth, interests and hobbies, educational details) | 6 years after last interaction |
| Information provided for the purpose of subscribing to email notifications and/or newsletters (including a name and email address) | 6 years after last interaction |
| Information relating to any subscriptions made (including name, address, telephone number, email address and card details) | 6 years after last interaction |
Notwithstanding the other provisions of this section, the BMC will retain documents (including electronic documents) containing personal data:
(a) to the extent that the BMC is required to do so by law;
(b) if the BMC believes that the documents may be relevant to any ongoing or prospective legal proceedings;
(c) and in order to establish, exercise or defend the BMC’s legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk).
When we process children’s personal information, where required we will not do so without their consent or, where required, the consent of a parent/ guardian. We will always have in place appropriate safeguards to ensure that children’s personal information is handled with due care. We do not interact digitally or advertise to those under 14. You can contact our safeguarding team here: safeguarding@thebmc.co.uk.
We may contact you by email, post or SMS with information about products and services we believe you may be interested in. We will only send marketing messages to you in accordance with the marketing preferences you set. You can tailor your marketing preferences by logging into “my account” on the website. You can also opt out from all marketing communications here. You can also unsubscribe from our marketing by clicking on the unsubscribe link in the marketing messages we send to you.
Full details of your rights set out in the relevant privacy notice provided to you, but you are entitled by law to ask for a copy of your personal information at any time. You are also entitled to ask us to correct, delete or update your personal information, to send your personal information to you or another organisation and to object to automated decision making. Where you have given us your consent to use your personal information in a particular manner, you also have the right to withdraw this consent at any time.
To exercise any of your rights, or if you have any questions relating to your rights, please contact us by using the details set out in the "Contact" section below. You can also unsubscribe from any direct marketing by clicking on the unsubscribe link in the marketing messages we send to you. You can also tailor your marketing communication preferences by logging into the website here.
You should note that some of your rights may not apply as they have specific requirements and exemptions which apply to them and they may not also apply to personal information recorded and stored by us. However your right to withdraw consent or object to processing for direct marketing are absolute rights.
If you are unhappy with the way we are using your personal information you can complain to the UK Information Commissioner’s Office or your local data protection regulator. More information about your legal rights can be found on the Information Commissioner’s website at https://ico.org.uk/for-the-public/. However, we are here to help and would encourage you to contact us to resolve your complaint first.
Your full list of individual rights under UK GDPR is reproduced below:
Individuals have the right to be informed about the collection and use of their personal data.
Individuals have the right to access and receive a copy of their personal data, and other supplementary information.
The UK GDPR includes a right for individuals to have inaccurate personal data rectified, or completed if it is incomplete.
The UK GDPR introduces a right for individuals to have personal data erased.
5. Right to restrict processing
Individuals have the right to request the restriction or suppression of their personal data.
The right to data portability allows individuals to obtain and reuse their personal data for their own purposes across different services.
The UK GDPR gives individuals the right to object to the processing of their personal data in certain circumstances.
8. Rights related to automated decision making including profiling
The UK GDPR has provisions on:
- automated individual decision-making (making a decision solely by automated means without any human involvement); and
- profiling (automated processing of personal data to evaluate certain things about an individual). Profiling can be part of an automated decision-making process.
Any changes we may make to this Policy in the future will be posted on our website and, where appropriate, notified to you by e-mail. When we change this Policy in a material way, we will update the version date at the top of this page. Please check back frequently to see any updates or changes to this Policy and should you object to any alteration, please contact us as set out in the "Contact" section below.
If you have any questions about data protection and the BMC, please get in touch. The BMC’s data protection lead is our BMC Governance and Compliance Manager.
Email: office@thebmc.co.uk
Phone: 0161 445 6111
Address: 177-179 Burton Road, Manchester, M20 2BB
Whilst this privacy policy sets out a general summary of your legal rights in respect of personal information, this is a very complex area of law. More information about your legal rights can be found on the Information Commissioner’s website at https://ico.org.uk/for-the-public.