1. Who is responsible for your information
Concrete Cows Motorcycle Club is the data controller. This notice applies to members, prospective members, website account holders, event participants, volunteers, guests and people who contact us.
2. Information we collect
Depending on your relationship with the Club, we may collect:
- your name, email address, username and other contact details;
- membership or application status, joining date, mailing preferences and communications with us;
- information you include in a membership enquiry, including motorcycle or riding interests;
- event attendance, booking or participation information;
- photographs, captions and material from Club rides, events and activities;
- account and security information, including password hashes, roles, account status, login-attempt records, session information and administration audit logs;
- optional mailing consent timestamps and records showing whether an authorised Club mailing was sent or failed;
- technical information, such as a hashed version of your IP address for login security and ordinary hosting logs;
- daily website totals and a pseudonymised IP-address hash used to estimate unique visitors, without storing the raw address, device fingerprints or individual page histories; and
- records needed for enquiries, complaints, accidents, insurance matters or legal obligations.
Please do not send health information or other sensitive information unless we have asked for it and explained why it is needed.
3. Where information comes from
We normally receive information directly from you through membership records, website forms, email, events and Club activities. We may receive information from an existing Club officer or member where needed to administer membership or an event. Photographs may be taken by Club officers, members or authorised event photographers.
4. Why we use information
| Purpose | Lawful basis |
|---|---|
| Membership enquiries and applications | Steps requested before a membership arrangement and our legitimate interests in managing applications |
| Membership, accounts, subscriptions, communications and benefits | Performance of the membership arrangement and our legitimate interests in operating the Club |
| Rides, events and attendance | Performance of the membership or event arrangement and our legitimate interests in well-organised activities |
| Account protection, misuse prevention, audit records and security | Our legitimate interests in protecting members, the Club and its systems, and legal obligations where applicable |
| Website usage totals and pseudonymised unique-visitor measurement | Our legitimate interests in understanding whether the website is useful and planning Club communications |
| Ordinary Club photographs and event reports | Our legitimate interests in recording and promoting Club activities, balanced against individual rights |
| Optional promotional or fundraising emails | Consent where consent is required; it may be withdrawn at any time |
| Complaints, accidents, insurance, disputes and claims | Legitimate interests, legal obligations, and establishing, exercising or defending legal claims |
Providing information for a general enquiry is optional. Required identity and contact details are necessary to process an application or provide an account. We do not make solely automated decisions that produce legal or similarly significant effects.
Members can separately choose whether to receive Club newsletters and monthly event mailings in the members' Clubhouse. Both choices are optional, default to off and can be changed or withdrawn there at any time.
5. Photographs and events
Club events may be photographed. We will take reasonable steps to make attendees aware. Tell the organiser or photographer if you do not wish to be photographed where practicable. You may ask us not to publish, or to remove, a photograph that identifies you. We will consider requests promptly, taking account of your rights and any lawful reason to retain the image.
6. Who we share information with
Access within the Club is limited by role. We may share relevant information with authorised Club officers, administrators and volunteers; website, database, email, backup and IT providers acting on our instructions; venues, insurers and professional advisers; authorities where required by law; or an organisation where you request or validly consent to disclosure. We do not sell personal information.
The Responsible Data Officer maintains a register of suppliers, processing locations and safeguards. Current details are available on request.
7. International transfers
Some technology suppliers may process personal information outside the UK. Where this happens, we use an approved transfer mechanism, such as UK adequacy regulations or appropriate contractual safeguards, and assess the protection available. The website currently requests font files from Google Fonts, which may disclose technical request information such as an IP address to Google. The Club will review this and may host fonts locally to reduce external sharing.
8. How long we keep information
| Record | Retention |
|---|---|
| Unsuccessful or withdrawn applications | 12 months after the final decision or withdrawal |
| Accepted application and core membership/contact record | While membership continues, then up to 6 years where needed for accounts, disputes or claims |
| Website account | While required, then delete or anonymise within 90 days after access ends unless a record must be retained |
| Failed login attempts | 30 days |
| Administration audit records | 24 months, unless needed for an investigation or claim |
| Mailing consent and delivery records | While the account or consent is active, then up to 24 months for suppression, accountability and troubleshooting |
| Routine enquiries and correspondence | Up to 24 months after the matter closes |
| Event administration records | Up to 24 months, or longer for insurance, accounts or a claim |
| Club photographs and historical event records | As part of the Club archive while relevant, subject to review and individual objections |
| Financial, tax, insurance or legal records | As required by law or reasonably needed for a claim, commonly up to 6 years |
| Hosting and security logs | According to the documented provider schedule and only as long as needed |
| Pseudonymised unique-visitor hashes | Until 24 months after the address was last seen, then automatically deleted |
Unique-visitor figures are estimates rather than identification of individual people. Several people may share one public IP address, while VPNs, mobile networks or changing connections may cause one person to appear under more than one pseudonymous value. The secret used to create each hash is held separately in the protected website configuration.
We may retain information longer where required by law, for an active complaint or claim, or to protect vital interests. When no longer required, it is securely deleted or anonymised.
9. Security
We use proportionate technical and organisational measures, including role-based access, password hashing, encrypted SMTP credentials, protected administrator sessions, login throttling, audit logging, CSRF protection, restricted original-photo downloads, database controls, HTTPS and controlled backups. No online service can guarantee absolute security.
10. Your rights
Depending on the circumstances and lawful basis, you may ask for a copy of your information; correction; erasure; restriction; portability; or object to processing based on legitimate interests. You may withdraw consent where we rely on it. These rights are not absolute. We may verify identity and normally respond within one month.
You may object to processing based on our legitimate interests. Contact the Responsible Data Officer and explain your objection.
11. Complaints
Please contact us first so we can try to resolve your concern. You may also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint or telephone 0303 123 1113.
12. Changes to this notice
We will review this notice at least annually and whenever our use of personal information changes. The latest version will be published here, and material changes will be brought to affected people's attention where appropriate.