Privacy Notice

Grange Rifle & Pistol Club
Version 1.0 - October 2026

1. Who we are and how to contact us

Grange Rifle & Pistol Club (“the Club”, “we”, “us”) is a company limited by guarantee registered in England and Wales, company number 12001878, and a Home Office approved shooting club under section 15 of the Firearms (Amendment) Act 1988.

Our registered address is The Old Quarry, Column Road, West Kirby, Wirral, CH48 8AW.

The Club is the data controller for the personal information described in this notice. Our Club Secretary acts as Data Protection Lead.

You can contact the Data Protection Lead:

• By email: secretary@grangeshooting.club.

• By post: Data Protection Lead, Grange Rifle & Pistol Club, at the address above.

This notice explains how we collect and use personal information about people who contact us, applicants, probationary and full members, parents and guardians, guests and other visitors. It also explains your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended.

2. Information we collect

Website visitors and people contacting us

When you visit our website, our hosting and security services process technical information such as your internet address, the pages requested, request times and information needed to operate the website and prevent abuse.

When you use our Contact Us form, we collect your name, email address and message. We send a one-time code to your email address to verify it before delivering your message. We also process verification and security records associated with the request.

Membership enquiries and applications

Depending on the stage of your enquiry or application, we collect:

• Your names, title where provided, email address, postal address, date and place of birth, occupation where provided and telephone numbers.

• Information needed to verify your identity and address.

• Whether you hold or have held a firearm certificate or shotgun certificate, and whether a certificate application has been refused or a certificate revoked.

• Your declaration about whether section 21 of the Firearms Act 1968 prohibits you from possessing firearms or ammunition.

• Relevant health information, including information about mental health, treatment and alcohol or drug misuse, subject to the arrangements in section 4.

• Your shooting experience, previous and current shooting-club memberships, interests and availability.

• Your responses to declarations and consent requests, including records of when consent was given or withdrawn.

• Correspondence, screening results, relevant assessment notes and decisions about your enquiry or application.

For junior applicants, we also collect appropriate parent or guardian details, including their name, relationship to the applicant and contact information. Where another person assists with an application, we may record their identity and authority to act.

Probationary and full members

We also collect and maintain information needed to administer membership and shooting activities, including:

• A photograph for identification.

• Dates of introductory calls, meetings and application appointments.

• Training attendance, progress and assessment records.

• Supporting documents and references where required.

• Membership status and decisions by authorised Club officers or the Directors.

• Correspondence with police firearms licensing departments.

• Subscriptions, payment history and purchases from the Club armoury.

• Range attendance, firearms used and the Club officer recording or countersigning attendance.

• Competition entries and results.

• Emergency-contact details.

• Information needed to operate your members’ portal account, including your email address, authentication settings and security records.

Guests and visitors

We collect information appropriate to the visit, including your name, the member hosting you, the reason for your visit and arrival and departure times. Shooting guests may also need to provide eligibility declarations and information about their shooting activities.

Firearms, certificates and recordings

Where relevant to our activities and record-keeping, we hold firearm make, model, calibre and serial-number information, together with certificate numbers, dates and related verification records.

We also operate video surveillance and designated range audio recording as explained in section 10.

3. Where information comes from

Most information comes directly from you, including through forms, correspondence, attendance records and documents you provide.

Where relevant and lawful, we may also receive information from a parent or authorised representative, a referee or sponsoring member, Club instructors and officers, another shooting club, a governing body, the police, or a healthcare professional acting under appropriate authorisation.

If you provide another person’s details, such as an emergency contact, please make them aware of this notice.

4. Why we use information and our legal grounds

Applications, membership and Club activities

We use information to take steps at your request before membership, administer your membership, arrange training, manage subscriptions and bookings, and provide activities you request. Where necessary for these purposes, we rely on Article 6(1)(b) UK GDPR: performance of a contract or steps requested before entering into a contract.

Legal and regulatory requirements

We use information to comply with applicable firearms legislation, legally binding approval requirements, and company, accounting and tax obligations. Where processing is necessary to comply with a legal obligation, we rely on Article 6(1)(c).

Safety, security and administration

We also rely on Article 6(1)(f), legitimate interests, where appropriate. Our interests include assessing suitability, operating a safe shooting club, protecting members and visitors, verifying identity, preventing abuse and fraud, maintaining proportionate attendance and security records, handling enquiries and complaints, and establishing or defending legal claims.

We consider whether these purposes can be achieved in a less intrusive way and balance our interests against the rights and interests of the people concerned.

Health information and explicit consent

Health information is special category data and needs an additional condition under Article 9 UK GDPR.

For routine health information supplied during application screening, we obtain your explicit consent under Article 9(2)(a). This is additional to the applicable Article 6 lawful basis for assessing your application. We ask for information necessary to assess safe participation and any appropriate safety arrangements or reasonable adjustments.

We explain the purpose before collecting your health answers and record your consent. Agreeing to continue with an application or acknowledging this Privacy Notice does not itself give health-data consent.

Consent to use the health information you supply does not authorise unrestricted access to your medical records. If further medical evidence is needed, we explain what is required and why. We seek separate, specific authorisation before requesting information directly from your GP.

You may refuse or withdraw consent by contacting the Data Protection Lead. If we cannot complete a necessary safety assessment without that information, we may be unable to progress your application or permit the relevant activity.

Criminal-offence and eligibility information

Information about convictions, offences and related security measures is subject to Article 10 UK GDPR. This is separate from the rules governing health information.

We use relevant information, including section 21 declarations and information explaining certificate refusals or revocations, to assess lawful eligibility, meet applicable requirements and address relevant safety concerns.

In addition to the applicable Article 6 lawful basis, processing criminal-offence information requires authorisation under Article 10 and an applicable condition in Schedule 1 of the Data Protection Act 2018. We must identify and document that condition before carrying out the processing. Health-data consent does not provide consent for criminal-offence checks.

We maintain an appropriate policy document where required by the condition on which we rely.

Serious safety concerns and disclosures without consent

Where serious wellbeing or safety concerns arise that may affect a member’s safe access to firearms, we notify the police firearms licensing department urgently in accordance with Home Office club-approval guidance.

We may process and share relevant information, including health information, without consent where the applicable legal requirements permit or require this.

For example, Article 9(2)(g) and Schedule 1, paragraph 10 of the Data Protection Act 2018 may apply where disclosure is necessary to prevent or detect an unlawful act, seeking consent would prejudice that purpose, and disclosure is necessary for substantial public interest. A separate Article 6 lawful basis must also apply.

Other specific conditions may apply to safeguarding children or adults who meet the statutory criteria for an individual at risk. We assess the requirements of the relevant condition rather than treating every health concern as automatically authorising disclosure.

We limit disclosures to necessary information and record the concern, the reasons for sharing and the legal grounds. A diagnosis alone does not automatically require a report to the police.

5. Information you need to provide

Some information is necessary to verify your identity, establish legal eligibility, assess safe participation or administer membership. We identify required information in our forms or explain why it is needed.

If necessary information is not provided, we may be unable to process an application, offer membership or allow participation in an activity. Optional information is identified as such.

Applications made for or with assistance from another person require appropriate authority. For children, we consider their understanding and ability to consent and obtain consent from a person with parental responsibility where required.

6. Who receives information

Within the Club

Access is limited according to role and need. Relevant information may be used by authorised membership officers, instructors, range officers, safeguarding personnel, Directors and administrators. Detailed health information is restricted to those who need it for the relevant assessment or purpose.

Police and other authorities

In accordance with Home Office approval requirements, we notify the relevant police firearms licensing department of formal membership applications, progression to full membership, cessation of membership and members who have not shot with the Club for twelve months. Casual enquiries are distinguished from formal applications.

We also report serious concerns affecting safe access to firearms and respond to lawful requests, investigations and other applicable legal requirements. Health and criminal-offence disclosures remain subject to the additional conditions described above.

Other recipients

• Governing bodies and competition organisers: relevant membership, entry and result information where you participate in competitions or arrange governing-body membership through the Club, including the National Rifle Association and National Smallbore Rifle Association.

• Insurers and professional advisers: information necessary for insurance matters, complaints, legal advice and claims.

• Healthcare professionals: information necessary for an authorised request for medical evidence or another disclosure permitted by law.

• Service providers: information needed to provide the services listed below.

Service providers

• JustGo: membership administration, subscriptions and payment services.

• Supabase: portal database and authentication services.

• Vercel: website and portal hosting.

• Resend: delivery of Club emails.

• Google Workspace: Club email and related administrative services.

• Microsoft Azure: storage of scanned Club documents.

• Anthropic: automated extraction of information from selected scanned documents to support indexing and searching.

• Upstash: protection against abuse of forms and sign-in services, including request counting using internet-address information.

• Esendex: text-message delivery.

• Worldpay: online payments for Club events.

Providers acting as our processors must process information under appropriate contractual arrangements and instructions. Some organisations, particularly payment providers, may also process information as independent controllers for their own legal, security or regulatory purposes.

Payment-card details are entered through the relevant payment provider’s service. Club systems receive the transaction information needed to administer the payment rather than storing full card details.

Our document-processing service may receive document content, including personal information contained in the documents selected for processing. We use it under business contractual arrangements that do not permit use of that content to train AI models. Automated extraction can make mistakes, and information used for consequential decisions needs appropriate checking.

7. International processing

Some providers or their authorised service providers may process information outside the United Kingdom, including through overseas support or infrastructure. A UK hosting location does not necessarily mean every processing activity remains in the UK.

Where UK international-transfer requirements apply, transfers must be covered by an applicable UK adequacy decision or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses, together with any required assessment and supplementary measures.

You can contact the Data Protection Lead for information about relevant destinations and safeguards, including how to obtain a copy of applicable safeguards.

8. How long we keep information

We keep information for the period needed for its purpose, applicable record-keeping requirements and proportionate handling of complaints or claims. The following are our normal retention periods. Health information and exceptional cases are addressed separately below.

A waiting period may exceed twelve months. Remaining in an active queue does not guarantee an invitation, a start date or membership. We do not retain an enquiry indefinitely merely because it has not progressed.

Detailed health information is not automatically retained for the full membership-record period. We review what is necessary for the ongoing assessment, safe participation and any specific incident or claim, and remove unnecessary detail. Any continued retention must have both an Article 6 lawful basis and an applicable Article 9 condition.

Where a complaint, incident, investigation, legal claim or preservation obligation requires longer retention, we restrict the retained material to what is necessary and review that need.

The seven-year periods are Club retention periods for the purposes described; they are not a statement that every record has a statutory seven-year retention requirement or that every legal claim has a seven-year limitation period.

At the end of the applicable period, information is securely deleted, destroyed or irreversibly anonymised. Where residual copies remain in backups, they are protected, excluded from routine use and removed through the applicable backup lifecycle.

9. Video surveillance and range audio

We use cameras at Club premises for safety, security, protection of firearms and investigation of incidents. We rely on our legitimate interests under Article 6(1)(f), subject to necessity and proportionality.

Audio recording is restricted to designated range areas for the specific purpose of reviewing safety instructions and range commands, including whether commands were issued and followed during an incident.

Audio recording is not used routinely in social areas or outside the designated range areas. Recording must be limited to locations and periods for which its necessity has been established. Signage identifies where video and audio recording take place.

Recordings are normally retained for around twenty days. Relevant extracts may be kept longer where needed for an incident, complaint, investigation or claim. Access is restricted to authorised people, and recordings may be disclosed where necessary and lawful, including to police, insurers or legal advisers.

To ask about recordings of yourself, contact the Data Protection Lead with the approximate date, time and location. We consider requests alongside the rights of other people appearing in the recordings.

10. Security and firearm information

We use technical and organisational measures appropriate to the information, including access controls, named accounts, authentication, access logging, secure storage and backup arrangements.

The Club uses equipment at its premises to maintain detailed firearm and certificate records separately from ordinary portal records. Access is restricted to authorised roles.

Information may nevertheless leave the premises where needed for a lawful purpose, such as providing a requested attendance record, making an authorised police disclosure or processing an approved document. Any electronic transmission or use of a service provider remains subject to appropriate security and data-protection arrangements.

We therefore distinguish the location of the primary record from any authorised copies, disclosures or processing. We do not promise that every document mentioning a firearm or certificate will remain solely on Club premises.

Paper records are kept securely. Members must protect their login details and promptly report suspected unauthorised access.

11. Communications, cookies and browser storage

We send administrative communications about enquiries, appointments, applications, membership, payments and activities you have requested. These may include email and text-message reminders.

You can ask us to stop appointment text reminders by contacting the Club. We may still need to contact you by another appropriate method about your application or membership.

Promotional messages are treated separately from necessary administrative messages and are sent only where the applicable marketing rules permit them. You can object to direct marketing at any time.

We do not use analytics or advertising cookies. Our public pages do not intentionally set cookies for tracking visitors.

The members’ portal uses session storage or cookies needed to keep users signed in and support security. A light-or-dark display preference may also be stored in your browser. Cookies and browser storage do not replace the server and security records described in section 2.

Third-party payment services may provide their own information about cookies and processing when you use their services. If our use of non-essential cookies or similar technologies changes, we will provide appropriate information and obtain consent where required.

12. Withdrawing consent

You can withdraw consent at any time by emailing secretary@grangeshooting.club or using any withdrawal facility provided with the relevant service. Please tell us which consent you wish to withdraw.

We stop processing that depends on the withdrawn consent. Withdrawal does not make processing carried out lawfully before withdrawal unlawful.

Withdrawal does not automatically require deletion of every Club record. For example, an accounting record may have a separate legal retention requirement, and a necessary safety disclosure may have separate legal grounds.

However, we cannot continue the same consent-dependent health screening simply by relabelling it as legitimate interests. Retaining or using health information for a different purpose requires an applicable Article 6 lawful basis and Article 9 condition. We explain any continuing processing and retention where appropriate and legally permitted.

13. Your rights

Depending on the circumstances and legal basis, you may have the right to:

• Access your personal information and receive a copy.

• Have inaccurate information corrected and incomplete information completed.

• Have information erased where the legal conditions are met.

• Restrict processing in specified circumstances.

• Receive certain information in a portable format where the right to data portability applies.

• Withdraw consent.

• Exercise applicable rights concerning significant solely automated decisions.

Your right to object: where we rely on legitimate interests, you may object for reasons relating to your particular situation. We must stop unless we can demonstrate grounds recognised by law for continuing. You may object to direct marketing at any time, and we will stop using your information for that purpose.

These rights are subject to applicable conditions and exemptions. If we cannot fulfil a request, we will explain why, except where the law permits or requires us to withhold that explanation.

Send requests to secretary@grangeshooting.club. We may ask for proportionate information to verify your identity or clarify a request.

We normally respond without undue delay and within one month. Where the law permits an extension, clarification-related pause or another adjustment to the time limit, we will explain the applicable arrangements.

14. Complaints

If you are concerned about how we use your information, contact the Data Protection Lead. We will acknowledge and investigate your complaint and explain our response.

You also have the right to complain to the Information Commissioner’s Office:

• Website: ico.org.uk/make-a-complaint.

• Telephone: 0303 123 1113.

15. Changes to this notice

We review this notice at least annually and when our processing changes. We publish the current version on our website and draw significant changes to your attention where appropriate.

Version 1.0 - October 2026