Privacy Policy

Last Updated 27 August 26

1. Who we are

Base Grapple Club respects your privacy and is committed to protecting your personal information. This policy explains what information we collect, how we use it and the rights you have under UK data protection law.

Base Grapple Club is the trading name of DST Ventures, which is the data controller responsible for the personal information described in this notice.

Contact details

Email: [email protected]
Address: Crickets lane industrial estate, Unit 1A, Chippenham SN15 3EQ
Telephone: +44 7384 588095

2. Information we collect

Depending on how you interact with us, we may collect:

Your name, email address and telephone number

Your age or date of birth

The name and contact details of a parent or legal guardian

Your membership type, preferred classes and training availability

Your previous martial arts or relevant sporting experience

Information supplied through enquiry, trial-session and membership forms

Attendance and membership records

Payment status, payer information and payment references

Emergency contact details

Relevant health, injury, medication, allergy, disability or accessibility information

Accident, injury and first-aid records

Complaints, disciplinary and safeguarding information where necessary

Records of emails, messages and other communications with us

WhatsApp, Spond or other club-group membership and communications

Marketing and photography preferences

Photographs, video or audio where an appropriate lawful basis or permission applies

Electronic signatures, agreement acknowledgements, submission timestamps and the version of the agreement accepted

Technical information about how you use our website and online forms, such as your IP address, browser and device information

Please provide only health information that is relevant to participating safely, receiving appropriate support or responding to an emergency.

If you provide another person’s details as an emergency contact, please make sure they know that you have given their information to us and direct them to this Privacy Policy.

3. How we collect your information

We may collect information when you:

Visit or use our website

Complete a Tally membership or health-declaration form

Complete an enquiry or registration form through our website or Tekmatix

Book or attend a trial session

Apply for, purchase or renew a membership

Electronically sign our Membership Agreement and Code of Conduct

Contact us by email, telephone, social media or messaging service

Join or participate in a WhatsApp, Spond or other club communication group

Attend a class, competition or club event

Report an accident, injury, complaint or safeguarding concern

Give permission for photography, video, marketing or other optional activities

Provide information as the parent or legal guardian of a junior member

Interact with website cookies or similar technologies

We may also receive limited information from payment providers, attendance systems, competition organisers, the United Kingdom Brazilian Jiu Jitsu Association (UKBJJA), VT Jiu Jitsu or other relevant organisations where necessary to administer membership, affiliation, insurance or competition participation.

4. How we use your information

We may use your information to:

Respond to enquiries

Arrange trial sessions

Create and administer memberships

Manage classes, attendance and capacity

Verify and record acceptance of our Membership Agreement and Code of Conduct

Maintain an accurate register of signed agreements and the version accepted

Communicate important information about training, timetables, safety and the Club

Process and reconcile membership payments and maintain financial records

Support safe participation in training

Make reasonable adjustments where appropriate

Provide first aid and contact emergency services or an emergency contact

Record and respond to accidents, injuries, complaints and disciplinary matters

Manage junior memberships and communicate with parents or guardians

Meet our safeguarding responsibilities

Administer UKBJJA membership, affiliation and applicable insurance arrangements

Administer competition entries and our affiliation with VT Jiu Jitsu

Manage optional WhatsApp, Spond and other member communication groups

Use photographs, video or audio where appropriate permission or another valid lawful basis applies

Improve our website, services and member experience

Send club news, offers or marketing where permitted

Meet our legal, accounting, safeguarding, insurance and regulatory responsibilities

Establish, exercise or defend legal claims

We will not use information for a purpose that is incompatible with the reason it was collected unless the law permits or requires us to do so.

5. Our lawful bases

We only use personal information where we have a lawful reason to do so. The lawful basis will depend on why the information is being used.

We may rely on:

Contract: where processing is necessary to provide a trial, membership or another service requested by you. This includes administering membership, attendance, payments and signed agreements.

Legitimate interests: where processing is reasonably necessary to operate and protect the Club, respond to enquiries, communicate with members, maintain appropriate records, support safety, prevent misuse and manage legal or insurance matters. We consider the individual’s rights and reasonable expectations before relying on this basis.

Consent: where you have actively agreed to receive particular marketing communications, appear in promotional photographs or videos, join an optional communication group, provide relevant health information under an explicit-consent process, or where consent is otherwise appropriate. You may withdraw consent at any time, although this will not affect processing already carried out lawfully.

Legal obligation: where we must process or retain information to comply with the law.

Vital interests: where information is needed to protect someone’s life or physical safety in an emergency.

Health and injury information is special-category personal data. We normally process relevant health information using an appropriate Article 6 lawful basis together with explicit consent under Article 9 of the UK GDPR. In an emergency, we may process or share relevant information where necessary to protect someone’s vital interests. Where an accident, complaint or legal claim arises, relevant information may also be retained or used where necessary to establish, exercise or defend legal claims.

Safeguarding information will be processed and shared only where there is an appropriate lawful basis and condition, taking account of the safety and best interests of the child or adult concerned.

6. Enquiries and automated emails

Our website, enquiry forms and follow-up communications may be managed through Tekmatix or another notified service provider.

When you submit an enquiry, we may use the information supplied to:

Confirm that we have received your enquiry

Explain what to expect from a first session

Answer common questions

Help arrange a trial

Follow up on the service you asked about

Ask whether you still wish to hear from us

These are service-related communications connected with the request you made and are separate from general marketing.

Where marketing consent is required, we will ask for it through a separate, optional choice. You can unsubscribe from marketing at any time using the link in an email or by contacting us. Refusing or withdrawing marketing permission will not affect your membership or ability to train.

We may use WhatsApp, Spond or another service to provide operational information and optional member discussion groups. Joining a social or community group is optional. Essential membership, safeguarding and safety messages may still be sent directly by email, telephone or another appropriate route.

If you join a WhatsApp or similar group, your telephone number, profile name, profile image and messages may be visible to other group members according to the service and your own privacy settings.

7. Children’s information

We process information about children and young people who attend junior classes or participate in Club activities.

Information will normally be provided by, or with the involvement of, a parent or legal guardian. We use it to:

Administer membership and attendance

Communicate with parents or guardians

Support safe and appropriate participation

Make reasonable adjustments

Respond to emergencies

Meet safeguarding responsibilities

Record permission choices

Administer affiliation, insurance and competition participation where applicable

We take additional care when handling children’s information. We collect only what is reasonably necessary and do not knowingly use children’s information for unrelated marketing.

Where appropriate, we will explain our use of information to children in clear and age-appropriate language. Children have data-protection rights in relation to their own personal information, although a parent or guardian may exercise these rights on their behalf where appropriate.

We may share children’s information where there is a compelling safeguarding, safety, legal or insurance reason, taking account of the child’s best interests.

8. Who we share information with

Where necessary and proportionate, we may share limited information with:

Tally, which provides our membership forms and electronic-signature facility

Google Workspace, including restricted Google Sheets and Google Drive records

Tekmatix and providers supporting our website, enquiry forms and email

communications

Membership, booking and attendance platforms

Payment processors, banks and accounting providers

Coaches and authorised Club administrators who need the information for their role

The UKBJJA for Club affiliation, member and instructor registration, competition administration and applicable insurance cover

VT Jiu Jitsu and competition organisers where required for affiliation or competition entry

WhatsApp, or other communication providers when you use those services

Insurers, insurance brokers and professional advisers

Safeguarding organisations, local authorities and relevant governing bodies

Emergency services and healthcare professionals where necessary

IT, website-hosting and data-storage providers

Regulators, courts, law-enforcement bodies and other authorities where required or permitted by law

We do not sell or rent personal information.

We share only the information reasonably necessary for the relevant purpose. Where a supplier processes information on our behalf, it may use that information only for the agreed purpose and must provide appropriate protection.

Information posted voluntarily in a member discussion group may be seen or retained by other group members. Members must not copy or use another person’s information for unrelated purposes.

9. International transfers

Some technology and communication providers may store, access or process personal information outside the United Kingdom.

Tally is based in the European Union. Google, Tekmatix, WhatsApp and other technology providers may process information in the United Kingdom, European Economic Area, United States or other locations.

Where personal information is transferred internationally, we take reasonable steps to ensure that an appropriate legal safeguard applies. This may include:

UK adequacy regulations

The UK International Data Transfer Agreement

The UK Addendum to approved standard contractual clauses

Another safeguard permitted under UK data-protection law

Further information about the safeguards used by a particular provider is available on request where applicable.

10. How long we keep information

We keep personal information only for as long as it is reasonably required for the purpose for which it was collected and to meet our legal, accounting, safeguarding, insurance and regulatory responsibilities.

As a general guide:

Unsuccessful or inactive enquiries will normally be deleted or anonymised after 12 months

Routine membership, contact and attendance information will be reviewed when membership ends and deleted or anonymised when no longer required

Signed membership agreements, electronic signatures and records showing the version accepted may normally be retained for up to six years after membership ends

Financial and payment records may normally be retained for up to six years after the relevant financial year

Relevant health information will be reviewed at least annually and kept only while needed to support safe participation

Health information will normally be deleted or anonymised after membership ends unless it is connected with an accident, complaint, safeguarding matter, insurance claim or legal dispute

Accident, first-aid and incident records will be retained according to applicable legal, safeguarding and insurance requirements

Safeguarding records may be retained for a longer period where necessary to protect children or adults, meet governing-body guidance or respond to a concern

Complaints and disciplinary records will be retained for a period proportionate to the seriousness and outcome of the matter

Photography and video permissions will be retained while the material remains in use or until permission is withdrawn, subject to any continuing legal need

Marketing information will be retained until you unsubscribe or until we determine that it is no longer appropriate to contact you

A minimal suppression record may be retained to ensure that an unsubscribe request continues to be respected

Longer retention may apply where required by law, safeguarding guidance, insurance arrangements or a continuing complaint or legal claim. Records relating to junior members may need to be retained for longer in some circumstances.

We periodically review the information we hold and securely delete or anonymise information that is no longer required.

11. Cookies

Our website may use cookies and similar technologies to:

Operate essential website functions

Remember user preferences

Understand how the website is used

Support embedded forms, documents, videos or other services

Measure or support marketing where permission has been given

Essential cookies may be used without consent where they are necessary for the website to operate.

We will request permission before placing non-essential analytics, advertising or similar cookies where consent is required. Non-essential cookies should not be activated before the user has made a choice.

You can manage your choices through our cookie banner and your browser settings. Withdrawing cookie permission will not affect the lawfulness of processing carried out before withdrawal.

Third-party content embedded on our website or forms may set its own cookies or collect technical information. Where appropriate, we will explain this through the cookie banner or at the point the content is used.

12. Keeping your information secure

We use reasonable organisational and technical measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

These measures include, where appropriate:

Restricting access to people who need the information for their role

Using password-protected accounts and multi-factor authentication

Restricting access to membership, health, junior and safeguarding records

Separating public documents from confidential member records

Using reputable service providers and appropriate data-processing agreements

Reviewing access when roles change

Maintaining appropriate backups and retention controls

Taking additional care when communicating sensitive information

Completed membership forms, health information, accident records and safeguarding information are not stored in publicly accessible folders.

No online system can be guaranteed completely secure. We regularly consider the safeguards used by the Club and its service providers and take reasonable action where risks are identified.

If a personal-data breach occurs, we will assess it and notify the Information Commissioner’s Office and affected individuals where required by law.

13. Your rights

Depending on the circumstances and the lawful basis being used, you may have the right to:

Ask for confirmation that we process your personal information

Ask for a copy of your personal information

Ask us to correct inaccurate or incomplete information

Ask us to delete information that is no longer required

Ask us to restrict how information is used

Object to processing based on legitimate interests

Object to direct marketing at any time

Receive certain information in a portable format

Withdraw consent at any time where processing is based on consent

Complain about how your information has been handled

These rights are not absolute and may depend on the information, lawful basis and circumstances involved.

To exercise a right, contact us using the details at the beginning of this policy. Requests may be made verbally or in writing. We may need to verify your identity before responding.

Withdrawing consent will not affect processing already carried out lawfully. If relevant health information is withdrawn or cannot be processed, we may need to discuss whether participation can continue safely.

We do not currently make decisions about membership or participation using solely automated decision-making that produces legal or similarly significant effects.

14. Complaints

Please contact us first if you have a concern about how your information has been handled so that we can try to resolve it.

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Website: www.ico.org.uk
Telephone: 0303 123 1113

You do not have to contact us before making a complaint to the Information Commissioner’s Office.

15. Changes to this policy

We may update this Privacy Policy when our services, systems, suppliers or legal responsibilities change.

The latest version will be published on our website with its revision date. Where a change materially affects how we use existing member information, we will take reasonable steps to bring it to the attention of affected members.

Last updated: 27 September 2026