Information

Event Calendar
Privacy
Merchandise
County Websites

Frequent Questions

General FAQs
T&F FAQs
XC FAQs

Contact the ESAA

Contact Us




guide to the GDPR

The ESAA treats your privacy with the highest regard and are very concerned that other organisations do likewise. In accordance with the body and also the spirit of the General Data Protection Regulations (GDPR), we guarantee that we will only ask you or your school teachers to supply personal data which is actually needed to enable us to process your entry for the specific event you are involved with, and we guarantee that any data you enter here will only be used for that purpose.

Your data won't be passed to anyone other than your County Association officials, and ESAA officials who need to access information in order to run events.

How do we look after your data?

The data the ESAA acquires from you, or via your School teachers, or via County Team managers, is transmitted from their computers using SSL encryption and is stored securely in encrypted form on the ESAA webservers which are operated by one of the largest web hosting companies in Europe (www.ionos.co.uk). The webservers are based in the UK and we rely on the web hosting company's guarantee for the security of data held in their systems.

Your data is processed on the ESAA webserver and stored in an encrypted format so that it is not human readable.

Your data will be backed up onto CD disks, DVD ROMs, memory sticks, external hard drives, (or other such equivalent means as and when they are developed) which may be held at a trusted ESAA official's premises. These backups will be used only to restore damaged data files. The entire ESAA website is also automatically backed up to a physically separate webserver each night in order to be able to continue providing a service in case of downtime on the primary webserver.

Details of results of events which might be published on the internet could remain in the public domain for as long as it is historically valid and useful. Such details will be restricted to name, sex, age group, team or school, County, and actual performances at each event. We will NEVER disclose personal information such as Dates of Birth, Personal Best Performances, your address, or phone numbers.

Lawful Basis

The GDPR requires us to state which lawful basis we rely on to collect and store your data. There are a number of different bases defined in the regulations. The ESAA uses the lawful basis of legitimate interest which allows us to collect and store data which is needed in order to stage our events - this is usually data which you would normally expect to be asked for, and we are not required to ask for your consent to collect and process such data.

In a few special cases, we might wish to ask you for other data which might not be necessary in order to run an event, but which might help to enhance the event. We collect that data under the lawful basis of consent where we ask you to give your permission for us to collect the data. You do not have to consent to that and your refusal to consent cannot debar you from taking part in any activity.

Please read a guide to the GDPR which explains how it works relating to schools sports activities, and also explains the special meanings of key words.

Cookies, tracking your usage, and data retention times

Data which is entered by teachers or pupils via this website are recorded on the ESAA website in encrypted files. County team managers have access to previous year's team entries which include pupils names, schools, and the town of each school. However, we specifically DO NOT supply them with pupils dates of birth, they must request that directly from pupils each time the information is required.

For the Schools Cup Competitions, we ask teachers to create squads of pupils. These contain the names and dates of birth of pupils and the data is stored for the full duration of a pupil's time at school. The data is used only to enable teachers to quickly select their teams. Dates of birth are only visible to pupils' teachers and the website administrators and are changed so that only the month and year is stored.

From 2011, there is a facility for pupils to register themselves online to become available for County Team selection. The data submitted in this registration will include all the following data types, but will exist only for the year in which the registration is made. All pupil self-registered data will be deleted at the end of July each year. If pupils wish to continue to be available for County and National Team selection they will need to re-register each year - this is the way we will ensure that data is kept up to date at all times.

The ESAA does not use cookies in any data transfer on the internet.

What do we do with your data?

The data we ask teachers and pupils to give will only be used as follows:

  • Your Name and Sex
    These might be published in an event programme, on tee-shirts, and will appear in the results of events, both in printed form and online. Results may be sent to newspapers or magazines for wider distribution, or published in a brochure printed on behalf of the event organisers which may be mailed to each participant in any event. This data may also appear on TV where events are televised.
  • Your Address
    This will only be used by County, Regional, and National Team Managers to send you the details necessary to enable you to participate in the event you are selected for, and to receive any subsequent post-event certificates, results, or other 'goodies' provided by the event organisation or sponsors of each event. While any such mailing might contain sponsor's advertising material, this will be controlled by the event organisers. 

    Your address will NOT be made available to sponsors, unless you specifically give us your permission. If sponsors wish to communicate with you, this will be controlled by the ESAA.

    Your town, school, and County, might be published in event results and might be shared with your local newspapers so that they can feature specific pupils in specific events. Any disclosure to the press is accompanied by the requirement that they use this information only in order to report on the activities of school pupils relating to ESAA events and that they will not use the information for any other purpose.

    Your town, County, or Postcode might be used to provide sponsors with aggregate data about how many entries come from different regions. This information will not contain any specific data about you or any other identifiable person.
  • Your age
    The ESAA needs to know your approximate date of birth in order to verify which age group you belong to. Whenever possible we will only ask for your Month and Year of birth, it is not necessary for the ESAA to know the actual day except in special cases such as filling in documents for overseas travel where it might be a legal requirement. We consider this to be sensitive personal information and this information will not be disclosed to anyone other than Team Managers and the organisers of each event. The ESAA will never publish dates of birth online or in any other form.

    Age data will be used and published in the results of events at the most general level possible - eg. age group not actual age
  • Your team or school
    For many events this information is required to determine team competition prizes. This data will appear in published event programmes, tee-shirts, results, and perhaps on TV at televised events. If this causes a problem for you, you are advised to notify your team manager and appropriate steps will be taken to anonymise such information.
  • Phone numbers
    We might ask you to disclose one or more phone numbers. They will only be used by team managers and event organisers to contact you in case of difficulty processing your details, or if the organiser needs to inform you of any last-minute change to arrangements already sent to you by mail. Your phone numbers will never be sent to anyone other than team managers and event organisers without your explicit permission, and under no circumstances will they be used for tele-marketing or any other purpose not directly connected to the event you are involved with
    .
  • Email address
    You may be asked to give us your email address. This might be used to send you confirmation of team selection and might also be used by the event organiser to inform you about any last-minute changes to the event. Event organisers might wish to email you next year to inform you of details of events. These are the only times your email address will be used without your explicit permission. However, event organisers may also wish to be able to offer you further information, including that from their sponsors, and might also have a regular news-letter they would like to send you from time to time. In these cases, you will be offered the option to include yourself in these mailing activities, and each mailing from them will include instructions on how to remove your address from their mailing list.

    You will never automatically be included in any mailing list.
  • Other data
    Event organisers may request that you supply other non-sensitive data such as tee-shirt size, shoe size etc. You may also wish to request details of other facilities they may be providing for you. Your responses will be treated as if they were sensitive data and will be given the same level of protection as defined (above) for your phone numbers and email address.

Third party websites

The ESAA website also uses facilities running under dufferent domain names and their own privacy policies apply as follows. Those operated by Joe Lee (the ESAA website host and data controller) have the same policies as outlined on this page:
  • sendentry.com - owned and operated by Joe Lee, this provides facilities to handle secure card payments online for ESAA events and the award scheme.
  • schoolsathletics.net - owned and operated by Joe Lee, this provides facilities to run his own business software for event data entry and results systems. Other similar domains are schoolsathletics.org, schoolsathetics.online, schoolathletics.uk - each of these could be used to provide slightly different services.
  • esaa.website - managed by Joe Lee, this runs on a physically separate webserver which is operated by a different web hosting provider. This is used to provide a geographically separate backup facility for the esaa.net webaite.
  • englishschoolsathletics.com / englishschoolsathletics.org - operated by Joe Lee providing backup emailing facilities, and to spread the considerable email loading across multiple webservers.
  • google.com - some activities make use of Google Forms to allow ESAA officials to set up their own data input facilities. These might be run under various domain names owned by Google. Such uses are checked by Joe Lee to ensure that they comply with the GDPR and this ESAA policy, but the terms of use and data protection policies of Google also apply - links to those appear at the bottom of any Google page.
Web pages running under these domain names are opened in a new tab in your browser so that you can see they are distinctly different from esaa.net web pages.

Changing your data

Once your details have been entered into an event by yourself or by a teacher or team manager, any changes to your details must be notified to the person responsible for entering your details into the ESAA website systems. In the case where you register yourself online into the ESAA website systems, it is your responsibility to keep the information you register up to date. The ESAA cannot accept any responsibility for any failure in communicating with you if you fail to update your registered details correctly.

Under the GDPR you have the right to be forgotten. If you are a child, or an adult who submitted data when you were a child, we have an obligation to act on any request to delete your data, subject to a few exceptions. You can read more about your rights in the guide to the GDPR .


Data Controller

The Data Controller for ESAA data is Joe Lee, registered number Z2405585 who operates under the terms of this registration as a consultant providing services to the ESAA. You can find further information about the GDPR, and find contact details for registered data controllers at www.ico.gov.uk