Privacy Policy

Last updated: 28 September 2026

Who we are

Oxford University Rifle Club is the controller of the personal information covered by this policy.

Contact the Club Secretary at secretary@ourc.org.uk.

You can also contact the IT Officer through the Committee page.

Information we collect

Eligibility and reporting information

We collect information needed to assess membership eligibility and meet firearms-club reporting requirements. This includes:

• Legal identity, contact details, address, and date and place of birth.
• Firearm and shotgun certificate details and status.
• A signed Section 21 declaration.
• Formal application, membership, and outcome records.

Membership administration

We may also collect:

• University, college, course, award, and attendance information.
• Joining enquiries, Taster bookings, and shooting experience.
• Membership application answers.
• Photographs and emergency contacts.
• Attendance, shooting, competition, and equipment records.
• Bank-account, payment-mandate, invoice, and other payment information relating to the Club.
• Account preferences and files provided to the Club.

Referees and medical information

We collect referee details, relationship information, declarations, and submitted references.

We collect limited medical information about safe participation and requested adjustments. This may include medical responses, supporting documents, and doctors' letters.

Website and security information

We collect session, request, IP address, browser, and security information needed to operate and protect the website.

Why we use it

We use personal information to:

• Create and secure website accounts.
• Register interest and send requested joining emails.
• Administer sessions.
• Assess applications, submitted references, eligibility, safe participation, and adjustments.
• Administer membership, invoices, payments, and Club activities.
• Maintain Club records.
• Meet legal requirements and the conditions of the Club's Home Office approval.
• Report required information to the police firearms licensing authority.
• Protect the website, investigate faults, and prevent misuse.

We do not make membership decisions solely by automated means.

Our legal bases

We use information needed to create an account, process an application, and administer membership because this is necessary to take requested steps before membership and to meet the requirements of Club membership.

We use information for Club administration, governance, safety, security, and record-keeping where this is necessary for OURC's legitimate interests and does not override the individual's rights.

We use information where necessary to meet legal obligations and the conditions attached to the Club's Home Office approval.

We send optional joining emails with consent. Consent can be withdrawn at any time by unsubscribing or contacting the Secretary.

Health information is special-category data. We process it with the individual's explicit consent to assess safe participation and adjustments. Consent can be withdrawn by contacting the Secretary. Withdrawal does not undo earlier lawful processing and may prevent OURC from assessing safe participation.

For Section 21 declarations, certificate refusals, certificate revocations, and related criminal-offence information, we rely on our legitimate interests in safe and lawful firearms-club operation. Our provisional conditions under Schedule 1 of the Data Protection Act 2018 are:

• Paragraph 12: regulatory requirements relating to unlawful acts.
• Paragraph 10 where processing or disclosure is necessary to prevent or detect unlawful acts.

OURC maintains the supporting data-protection and retention documentation required for this processing.

Who can access it

The President and Secretary can access formal applications, submitted references, medical information, member profiles, Taster and attendance records, and most other membership-administration records.

The Treasurer can access invoices, payments, waivers, and related financial information.

Other Committee members can access joining enquiries, ordinary member profiles, emergency contacts, photographs, attendance, shooting records, and other Club information needed for their responsibilities.

Submitted references may only be accessed by the President and Secretary.

Medical responses and doctors' letters are encrypted, and may only be accessed by the President and Secretary. The website logs each access.

Service providers and international transfers

Our IT infrastructure providers process information to provide website hosting, email, and file-storage services to OURC. They must apply appropriate security and confidentiality safeguards.

Some providers may process information outside the UK. We assess these arrangements and use the protections required by UK data-protection law, including recognised adequacy arrangements or approved contractual safeguards.

Contact the IT Officer through the Committee page for more information about the safeguards applying to international transfers.

Police reporting and other sharing

We will report relevant formal application and membership information to the police firearms licensing authority, as required.

Medical information, submitted references, and photographs are not included in police reports.

We may also share relevant information with the Home Office, the National Rifle Association of the United Kingdom (NRA), the National Smallbore Rifle Association (NSRA), Oxford University, and Oxford University Sports Federation (OUSF), where this is necessary to meet legal or contractual obligations, administer Club affiliations, or otherwise run the Club lawfully.

For match entries and Club affiliations, we may provide the receiving organisation with the information it needs, such as a member's date of birth, nationality, and contact number. We share only what is necessary for that purpose.

We may share information where required by law or where necessary to protect someone from serious harm.

We do not sell personal information.

Retention

Information still needed for an active member may be retained while membership continues.

For former members, the periods below start when their final membership ends. For applicants who do not become members, they start on withdrawal, refusal, rejection, or application expiry.

• Medical responses and doctors' letters: 90 days.
• Membership application photographs: 90 days.
• Submitted references: one year.
• Detailed application records: two years.

Joining-interest records that do not become accounts or applications are deleted after the following intake cycle, about one year later.

Abandoned applications expire at the end of their membership season so that their retention period can begin.

Finance, attendance, safety, governance, and statutory records are retained for as long as their relevant legal or Club purpose requires.

A minimal identity, outcome, and audit record may remain where needed for police reporting, governance, disputes, safeguarding, or security. It will not contain medical details, submitted references, photographs, or unnecessary free text.

Deletion includes live data and files controlled by OURC. Deleted information may remain in protected backups until those backups expire normally.

Required information

Fields marked as required are needed to provide the relevant account, application, Taster, or membership service.

An application may not proceed if OURC cannot collect the information needed to assess eligibility, safe participation, or compliance with firearms-club requirements.

Optional preferences can be changed without affecting membership eligibility.

Cookies and browser storage

The website uses an essential session cookie to keep users signed in. It lasts for up to four weeks and is protected with appropriate browser security settings.

A cookie records the cookie-banner choice for one year.

Browser storage may hold non-essential interface preferences, such as whether a section is expanded. It does not store medical identities or decrypted medical information.

Your rights

Depending on the legal basis, individuals may have rights to:

• Access their personal information.
• Correct inaccurate information.
• Request deletion or restricted use.
• Receive portable information.
• Object to particular uses.
• Withdraw consent.

You have the right to object to processing based on legitimate interests. Contact the Secretary to exercise this right.

OURC may need to retain information despite a request where a legal, regulatory, safety, or overriding governance requirement applies.

You can complain to the Information Commissioner's Office if you are unhappy with how OURC uses your information.

Changes to this policy

We publish a new dated edition when this policy changes materially. Earlier editions remain available where needed to identify the policy applying to a recorded acknowledgement or consent.