Privacy Policy and Safeguarding Responsibility Statement

Policy Version: 2026.09.16

Privacy Policy and Safeguarding Responsibility Statement

1. About this application

The Competition Management application supports competitions and events organised within the Catholic Syro-Malabar Eparchy of Great Britain (CSMEGB), including activities organised at Eparchy, regional, parish, mission or other authorised organisational level.

The application may be used for registration, participant management, competition administration, stage management, judging, timing, results, appeals, certificates, event-day coordination and related administrative activities.

The application is an administrative tool. It does not replace the Eparchy's safeguarding policies, data protection requirements, safer recruitment procedures, DBS checks, training, supervision, event rules or other legal and organisational responsibilities.

2. Data Controller and administration

Where the competition or event is organised under the authority of the Catholic Syro-Malabar Eparchy of Great Britain, personal information is processed within the Eparchy's data protection framework.

Catholic Syro-Malabar Eparchy of Great Britain
Registered Charity No. 1173537

Regional, parish, mission and event administrators may process information through this application only when authorised to do so and only for legitimate Eparchy or event purposes.

Administrators are responsible for using the system according to the permissions given to them, the competition rules, Eparchy policies and applicable data protection and safeguarding requirements.

3. Information we may process

Depending on the competition and the person's role, the application may process:

• participant name and date of birth;
• age or competition category;
• parish, mission, region or other organisational unit;
• registration number and chest/start number;
• competition items and participation details;
• group or team membership;
• parent or guardian details;
• emergency contact information;
• relevant medical, allergy, accessibility or health information where required;
• photography or video preferences and permissions;
• judge, coordinator, time keeper, volunteer and administrator information;
• competition marks and judging records;
• timing and performance records;
• rankings and results;
• appeals and decisions;
• certificate information;
• uploaded documents or files;
• user account and access information; and
• system, security and audit records.

Only information reasonably required for an authorised purpose should be collected.

4. Why information is used

Personal information may be used to:

• register participants;
• confirm eligibility and competition categories;
• allocate competition items, stages and schedules;
• issue registration or chest numbers;
• manage group and team participation;
• communicate essential event information;
• coordinate event-day activities;
• manage judges, coordinators, time keepers and authorised volunteers;
• record marks and timings;
• calculate rankings and results;
• publish approved competition results;
• process appeals;
• prepare and distribute certificates;
• provide emergency or safeguarding support where necessary;
• investigate errors or unauthorised activity;
• maintain appropriate audit records; and
• protect the fairness, security and integrity of the competition.

Information must not be used for unrelated purposes without an appropriate legal basis and authorisation.

5. Lawful basis and special-category information

Personal information must be processed under an appropriate lawful basis in accordance with the UK GDPR and Data Protection Act 2018.

The appropriate lawful basis depends on the purpose for which the information is being used and may include legitimate interests, contractual or participation arrangements, legal obligations, consent, vital interests or another lawful basis that applies to the particular processing activity.

Some information processed in connection with an Eparchy competition may be special-category personal data.

This may include information concerning:

• religious belief or affiliation;
• health, medical conditions, allergies or disability;
• racial or ethnic origin where relevant; or
• other information defined as special-category data by data protection law.

For example, information identifying a participant's parish, mission or involvement in a religious organisation may reveal information about religious belief.

Where special-category data is processed, an appropriate lawful basis and an applicable special-category processing condition must be identified and documented.

Consent should only be relied upon where it is genuinely appropriate and valid. Safeguarding information may, in appropriate circumstances, need to be processed or shared without consent where this is necessary and lawful to protect a child or person at risk.

6. Children and young people

Many competition participants may be children or young people. Their personal information must receive particular protection.

Information relating to children must be collected and used only where necessary for the competition, administration, safeguarding or another authorised purpose.

Parents or guardians should receive appropriate privacy information where required.

Access to children's information must be limited according to the user's role.

Information such as the following must not appear on public result pages, general event displays or public-facing screens:

• full date of birth;
• home address;
• personal telephone number;
• personal email address;
• parent or guardian contact details;
• emergency contact information;
• medical or health information; or
• safeguarding information.

7. Medical, allergy and emergency information

Medical, allergy, accessibility and emergency information should only be collected where there is a genuine event, health, safety or safeguarding need.

Access must be restricted to people who require the information for their authorised role.

Emergency information may be used or shared where reasonably necessary to protect the health, safety or life of a participant or another person.

It must not be included in public results, certificates, general competition screens or other public displays.

8. Photography, video and livestreaming

The application may record photography or video preferences or permissions.

Photography, filming, livestreaming and publication must follow the applicable Eparchy safeguarding, privacy and media requirements.

A consent or preference recorded in the application is an administrative record and does not remove the need for event organisers and authorised personnel to follow the applicable photography and safeguarding procedures.

Photos or videos must not be published or used outside the authorised purpose simply because they are accessible to an administrator.

9. Access to personal information

Access to the application must be based on the person's authorised role.

Users should only be able to access information necessary for their responsibilities.

Roles may include:

• Eparchy or event administrators;
• registration teams;
• regional or parish administrators;
• stage coordinators;
• judges;
• time keepers;
• certificate teams;
• appeal reviewers;
• safeguarding personnel; and
• authorised technical administrators.

Having a user account does not give permission to access information unrelated to the user's assigned duties.

Users must not attempt to bypass access restrictions or use another person's account.

10. Public results and event displays

The application may provide approved competition information for result pages, programme displays, announcement screens or other public event displays.

Only information authorised for public display should be published.

Depending on the competition rules, this may include limited information such as:

• participant name;
• registration or chest number;
• parish, mission or region;
• competition item;
• category;
• rank, position or award; and
• approved results.

Administrators must review results before publication wherever the competition workflow requires approval.

Confidential, safeguarding, health and private contact information must never be displayed through public result systems.

11. Safeguarding

All competitions and activities involving children, young people or adults at risk must operate in accordance with the applicable safeguarding policies and procedures of the Catholic Syro-Malabar Eparchy of Great Britain.

The application does not determine whether a person is suitable to work with children or adults at risk.

Before assigning safeguarding-relevant roles, the appropriate organisation must complete any required:

• safer recruitment process;
• DBS check;
• safeguarding training;
• references or suitability checks;
• role approval;
• supervision arrangements; and
• other requirements specified by Eparchy safeguarding procedures.

Recording a person as a judge, coordinator, volunteer, administrator or other user within the application is not evidence of safeguarding clearance.

Any safeguarding concern must be handled through the appropriate Eparchy safeguarding procedure and must not be dealt with solely through the competition application.

12. Sharing information for safeguarding and emergencies

Information may be disclosed where necessary and lawful to protect a child, young person, adult at risk or another individual.

Depending on the circumstances, appropriate information may need to be shared with authorised safeguarding personnel, Eparchy leadership, statutory safeguarding bodies, healthcare professionals, emergency services, police or another competent authority.

Only relevant information should be shared, and access or disclosure should be limited to what is necessary for the particular situation.

Safeguarding information must not be placed in ordinary competition notes or general-access fields where this could expose it to users who do not require access.

13. Responsibilities of application users

Every authorised user must:

• use the application only for authorised purposes;
• access only information required for their role;
• keep usernames, passwords and authentication details secure;
• never allow another person to use their account;
• avoid discussing confidential information in public areas;
• not copy, photograph, screenshot, download or export information without an authorised reason;
• use approved devices and systems where required;
• protect exported information from unauthorised access;
• report suspected data breaches or unauthorised access promptly;
• report safeguarding concerns through the approved safeguarding route; and
• follow relevant Eparchy and event policies.

Access may be restricted or removed when a person's role ends or where access is no longer required.

14. Information sharing and disclosure

Personal information may be shared internally with authorised Eparchy, regional, parish, mission or event personnel where access is necessary for the person's role.

Information may also be shared with approved service providers that support the operation, security, hosting or communication functions of the application, where appropriate safeguards are in place.

Personal information must not be sold or disclosed for unrelated commercial purposes.

Information may be disclosed where required by law, regulatory obligation, safeguarding requirement, court order or another lawful authority.

15. Information security

Reasonable technical and organisational measures must be used to protect personal information from:

• unauthorised access;
• accidental loss;
• inappropriate disclosure;
• alteration;
• misuse; and
• destruction.

Security measures may include role-based access, authentication controls, secure hosting, encrypted communications, audit logging, backups and administrative controls.

Users must promptly report suspected unauthorised access, lost credentials, accidental disclosure or other security incidents through the appropriate event or Eparchy reporting route.

16. Data retention and deletion

Personal information must only be retained for as long as it is required for the purpose for which it was collected or for another legitimate legal, safeguarding, administrative, audit or organisational requirement.

Different types of information may require different retention periods.

Registration records, results, appeals, certificates, safeguarding information, financial information, audit records and technical logs should therefore be managed according to the applicable Eparchy retention requirements and legal obligations.

When information is no longer required, it should be securely deleted, anonymised or archived in accordance with the applicable retention policy.

Safeguarding information must not be deleted simply because a competition or event has finished where safeguarding retention requirements require it to be preserved.

17. Data accuracy

Reasonable steps should be taken to ensure personal information used by the application is accurate and up to date.

Participants, parents or guardians should notify the appropriate event administrator when relevant information changes or is incorrect.

Administrators should correct verified errors without unnecessarily changing historical judging, audit or safeguarding records.

Where corrections affect competition eligibility, results, certificates or appeals, they must be handled through the appropriate competition process.

18. Individual data protection rights

Individuals have rights concerning their personal information under applicable data protection law. Depending on the circumstances, these may include rights relating to:

• access to personal information;
• correction of inaccurate information;
• deletion;
• restriction of processing;
• objection to processing;
• data portability;
• withdrawal of consent where processing is based on consent; and
• making a complaint about the use of personal information.

These rights are not absolute and may depend on the reason the information is being processed and any applicable legal, safeguarding or organisational requirements.

Requests relating to personal information should be made through the appropriate event organiser, parish/mission administration or Eparchy data protection route.

19. AI-assisted development

Artificial intelligence tools may have been used during the development, review, testing or improvement of parts of this application, including software code, documentation, design or administrative content.

AI-generated or AI-assisted material must be subject to appropriate human review before being relied upon for operational use.

AI tools do not determine safeguarding suitability, participant eligibility, competition rules, final judging decisions, appeal outcomes or legal compliance.

Personal or confidential information must not be entered into unauthorised AI services.

20. Technical system and administrative decisions

The application applies the rules and information configured within it. Technical processing cannot guarantee that information entered by users is accurate or that an administrative decision is correct.

Important decisions—including participant eligibility, safeguarding decisions, disqualifications, appeal outcomes and publication of results—must follow the applicable competition and organisational procedures.

Where a technical error is suspected, authorised administrators should investigate the issue and preserve relevant records where necessary before making corrective changes.

21. Concerns, data incidents and complaints

Privacy or personal-data concerns

Questions concerning the collection, use, correction, access or protection of personal information should be raised through the event organiser, appropriate parish/mission administration or the Eparchy's data protection route.

Safeguarding concerns

Safeguarding concerns relating to a child, young person or adult at risk should be reported promptly and must not be dealt with solely through the Competition Management application.

For safeguarding matters connected with an Eparchy competition or event, individuals should normally contact the Safeguarding Contact, Safeguarding Representative, Parish Priest or other designated safeguarding person for their respective Parish, Mission or Proposed Mission.

Participants, parents, guardians, volunteers and event personnel may contact their respective Parish / Mission / Proposed Mission Coordinator to obtain the current safeguarding contact details for their local community.

Where appropriate, concerns may also be escalated through the safeguarding arrangements of the Catholic Syro-Malabar Eparchy of Great Britain.

A person does not need to wait for permission from an event administrator, parish, mission or Eparchy representative before contacting statutory authorities or a national safeguarding service where they believe this is necessary.

National safeguarding and emergency contacts

Immediate danger or emergency — Police / Emergency Services
Call 999 if a child, young person or another person is in immediate danger or requires urgent emergency assistance.

Police — non-emergency
Call 101 to report a non-emergency crime or concern to the police. Calls to 101 and 999 are free.

NSPCC Helpline — adults concerned about a child
0808 800 5000
Adults can contact the NSPCC for advice if they are worried about the safety or wellbeing of a child.

Childline — children and young people
0800 1111
Childline provides free and confidential support for children and young people.

NSPCC Whistleblowing Advice Line
0800 028 0285
This service can provide advice where someone has concerns about how an organisation is dealing with child protection or safeguarding matters.

Individuals may also contact the Children's Social Care/Safeguarding Team of the relevant local authority directly if they believe a child may be at risk. A person does not need proof that abuse has occurred before reporting a genuine concern.

Important safeguarding principle

If someone believes that a child, young person or adult at risk may be in immediate danger, they should not delay contacting emergency or statutory services while attempting to contact the competition organiser, parish, mission or Eparchy first.

Safeguarding concerns should be shared only with people or authorities who need the information for safeguarding purposes. They should not be discussed in general competition WhatsApp groups, public forums, ordinary competition notes or with individuals who have no safeguarding responsibility.

The Competition Management application must not be treated as a safeguarding reporting system unless a specific safeguarding reporting function has been formally authorised for that purpose.

Data breaches or security incidents

Suspected loss, accidental disclosure, unauthorised access or misuse of personal information must be reported promptly to the appropriate administrator so that the incident can be assessed and escalated where necessary.

Competition and technical issues

Registration errors, result queries, appeals, certificate issues and technical problems should be raised with the appropriate competition or event administrator.

22. Changes to this policy

This policy may be reviewed or updated when the application, competition processes, Eparchy requirements, safeguarding procedures or applicable data protection requirements change.

The current policy version should be made available through the application.

Continued use of the application does not remove any legal rights held by participants, parents, guardians or other individuals.

Acknowledgement by authorised users

By accessing the Competition Management application, an authorised user confirms that they will:

• use the system only for their authorised role;
• protect confidential and personal information;
• comply with applicable privacy and safeguarding requirements;
• follow Eparchy and event procedures;
• report safeguarding concerns through the proper safeguarding route; and
• report suspected data protection or security incidents promptly.

System access is provided for authorised competition and Eparchy purposes and may be withdrawn when access is no longer required.