What does this policy cover?

This notice describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it by and about riders as part of its anti- doping activities pursuant to Chapter (K) Anti-Doping of the Rules of Racing.

This notice also describes how the BHA will make use of the data provided to it about the “Responsible Persons” as part of its equine anti-doping activities pursuant to Chapter (K) Anti-Doping of the Rules of Racing.

This policy also describes your data protection rights, including a right to object to some of the processing that the BHA carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information do we collect?

We outsource our human urine and saliva anti- doping sampling and testing function to a third party, currently Abbott.

Abbott collect from you and provide to us the following information, in addition to the results of your anti- doping test:

• your name;
• your date of birth;
• your gender;
• details of medication you have taken in the recent past.

Where the BHA conducts any anti-doping sampling, we collect the following information, in addition to the results of your anti-doping test:

• your name;
• your date of birth;
• your gender;
• details of medication you have taken in the recent past.

In all cases, the photo submitted as part of a Jockey’s stable employee form will be used to verify your identity as part of the sample collection process.

Should you be subject to a positive test, further information may be gathered from you about the circumstances surrounding your alleged use of a Prohibited Substance, including any information you provide by way of defence or mitigation.

We also collect and process the name of the “Responsible Person” pursuant to the Chapter (K) Anti-Doping of the Rules of Racing. We may also, during an investigation into an equine anti-doping matter, collect relevant personal data of trainers and stable employees around the circumstances of a test, race or incident. In rare circumstances where there is a concern related to sample contamination, we may ask for and process medical samples of relevant individuals to confirm whether a sample has become contaminated.

What information do we receive from third parties?

Intelligence about alcohol or substance use/abuse may be received from the BHA Integrity Team. This information may be used to inform anti-doping testing strategy, generally or in relation to an individual rider. This is discussed in more detail in the Integrity Privacy Notice.

Where you choose to involve a third party, such as a lawyer, the Professional Jockey’s Association or independent experts, we may also receive information from them.

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:

• As required by the BHA to conduct our business and pursue our legitimate interests, in particular:
  • we will use your information to assess your conduct against the Rules of Racing and take any enforcement action as required under the Rules of Racing in order to maintain the integrity of the sport and the health and safety of yourself and other racing participants. Where this involves your sensitive data, this is also done on the basis of the BHA’s measures to carry out anti- doping activities in sport.
  • we will also, in the area of equine doping, use your information to assess the conduct of others against the Rules of Racing and to take any enforcement action as required under the Rules of Racing in order to maintain the integrity of the sport and the welfare of all its participants. Where this involves your sensitive data, this is done on the basis of the BHA’s measures in place to maintain the integrity of racing.
  • we will contact you in relation to any rules or other information you may require as a person licensed, permitted or registered under the Rules of Racing and any questions we may have in relation to your conduct or the conduct of others;
  • we will maintain records of our anti- doping activities, enforcing the Rules of Racing, including publishing our decisions in the event that you are sanctioned under the Rules of Racing;
  • we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation), such as maintaining intelligence on particular individuals of interest.
• For purposes which are required by law:
  • in response to requests by government or law enforcement authorities conducting an investigation, or in accordance with our statutory duties, including sharing information with the Gambling Commission and/or the police.
• Where you have given your consent:
  • We may share and receive information from other third parties you wish to involve in any investigation or charge, such as the Professional Jockey’s Association, an expert witness, a lawyer or relative.

Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above. You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.

Who will we share this data with, where and when?

We may share information (including your medical information) relating to you with foreign racing authorities so that they may determine your fitness to ride in those jurisdictions or where you wish to participate otherwise in horseracing in a different jurisdiction. Some of these regulators may be located outside of the UK.

We will share your information with the company that provides our sampling and testing function, currently Abbott.  Abbott is one of several data processors used by the BHA. Others provide IT services to the BHA from time to time for the limited purposes of hosting, supporting and maintaining their software.

You may choose to involve third parties in your response to a charge or investigation (in particular, you may choose to involve the Professional Jockey’s Association, external lawyers or relatives).

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

Where information is transferred outside the UK, and where this is to a stakeholder or vendor in a country that is not subject to UK adequacy regulations, data is adequately protected by appropriate safeguards.  A copy of the relevant mechanism can be provided for your review on request to the Head of Legal and Governance. In other circumstances, we might ask for your consent to share this data, where you have requested that we provide it to a foreign racing authority.

What rights do I have?

You have the right to ask us for a copy of your personal data and to correct, delete or restrict (stop any active) processing of your personal data.

In addition, you can object to the processing of your personal data in some circumstances where we don’t have to process the data to meet a contractual or other legal requirement.

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in both the UK GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us using the details set out below. If you have unresolved concerns, you have the right to complain to the Information Commissioner’s Office.

Information that is provided in order to comply with the Rules of Racing is mandatory. Failure to provide this information could result in a charge under the Rules of Racing.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, you can get in touch at [email protected].

How long will you retain my data?

We retain the results of our anti- doping sampling and testing for the following periods:

• the results of all breath, saliva and urine tests are retained for a period of five years from the date of the test, except negative saliva test records, which are held for one year from the date of the test. Where the case is the subject of disciplinary proceedings, details of positive results may also be published on our Judicial Panel microsite as part of the decisions and written reasons where they remain for seven years from the date of the decision, or in the case of sanctions lasting longer than seven years, for as long as the sanction is in place;
• we retain records of our human anti-doping investigations and retain intelligence around anti- doping in accordance with our Integrity Privacy Notice.

What does this policy cover?

This policy describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it by and about licensed, registered or permitted personnel and other participants in racing in relation to its Integrity processes.  Processing carried out as part of the licence, registration or permit application is handled in the relevant notice/form for your profession – please refer to the BHA website to find the appropriate notice.  Anti-doping activities are also covered elsewhere, in the BHA’s Anti-Doping Privacy Notice, also available on the BHA website.

This policy also describes your data protection rights, including a right to object to some of the processing which the BHA carries out.  More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information do we collect from you?

We collect and process personal data about you when you complete your initial licence, permit or registration application and any subsequent renewals.  This includes all the information you provide to us in the application forms and any attachments submitted alongside the form.

We collect and process personal data about you when you are subject to, or involved in, an investigation by the BHA Integrity Team.

We collect and process personal data about you when you provide any information pursuant to Rule (L)2.3 of the Rules of Racing. Where you are required to provide your communication device for data extraction, this process is carried out by a third-party service provider, CCL Solutions Group (“CCL”, our data processor) and the BHA has in place appropriate safeguards to ensure your extracted data is securely stored by CCL. BHA employees will not have direct access to the underlying extracted data. For more details as to how the BHA may receive data extracted from a communication device from CCL, through relevant search criteria, please refer to the Data Extraction Explanatory Guidance and FAQs, available from the Head of Integrity on request.

Where you are charged under the Rules of Racing, we will also receive any representation you make as part of our investigations or proceedings.

What information do we receive from third parties?

Sometimes, we receive information about you from third parties. In particular:

• we may receive information about potential incidents or concerns from members of the public through our RaceWISE hotline or a member of the public otherwise assisting in an integrity investigation;
• we may receive information about you from Racing Welfare, the British Racing School, the National Horseracing College, or the Scottish Racing Academy in relation to any safeguarding concerns/ investigations;
• we may receive information about you from our member organisations in relation to any safeguarding concerns/ investigations;
• we may receive information about you from foreign racing authorities in relation to relevant integrity matters;
• we may receive information about you from other licensed, permitted or registered personnel;
• we may collect information about you from publicly available sources such as the media and the internet;
• we may receive information about your integrity and discipline from racecourses and BHA and racecourse stewards, and in particular we may receive CCTV footage from racecourses;
• we may also receive information about you from sources such as the press, bookmakers, surveillance suppliers and from the BHA’s covert human intelligence sources in relation to any relevant integrity matters.

This will usually include information relating to your integrity, performance or actions or other corrupt practices, such as bets you have made or are planning to make, performances you have or will be involved in, or individuals you have been associating with.  It may, occasionally, include sensitive data such as your health, or information about criminal offences you are alleged to have committed or convictions that you have.

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:

• As required by the BHA to conduct our business and pursue our legitimate interests, in particular:
  • we will use your information to assess your conduct against the Rules of Racing, maintain intelligence and take any enforcement action as required under the Rules of Racing in order to maintain the integrity of the sport.  Where this involves your sensitive data or criminal records data, this is also done on the basis of the BHA’s measures to protect the integrity of horseracing.  We may also process such data to prevent or detect unlawful acts;
  • we will contact you in relation to any rules or other information you may require as a person licensed, permitted or registered under the Rules of Racing and any questions we may have in relation to your conduct or the conduct of others;
  • we will maintain records of our actions in investigating, maintaining intelligence and enforcing the Rules of Racing, including publishing our decisions in the event you are sanctioned under the Rules of Racing;
  • we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation), such as maintaining intelligence on particular individuals of interest.
• For purposes which are required by law:
  • in response to requests by government or law enforcement authorities conducting an investigation, or in accordance with our statutory duties, including sharing information with the Gambling Commission and/or the police.

Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above.  You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.

Who will we share this data with, where and when?

We will share information with the Gambling Commission and other relevant statutory bodies, bookmakers and/or the police where this is an appropriate course of action to help enforce the Rules of Racing or ensure that appropriate action is taken by a third party, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws as set out above.

We will share your information with foreign racing authorities as necessary to comply with our obligations under international commitments and to ensure you are appropriately managed and/or suspended under the Rules of Racing in other relevant jurisdictions.

We will share your information with Clue Computing Co. Ltd (Clue), our data processor, who provide investigation and intelligence management software and occasionally provide maintenance and support services for such software. Information is also shared with other third party service providers who provide services relevant to the purposes described above.

Where you are required to subject your communication device for data extraction, we will share your information with CCL, our data processor, who facilitate the data extraction process and securely retain all extracted data. The BHA will ask CCL to search the extracted data for particular key words, documents, numbers, or character strings that are pertinent to the aims and objectives of the investigation. The BHA will only be given access to data that responds to the search terms used. Any extracted data held by CCL may be shared, to the minimum extent necessary, with any competent authorities (e.g. the police) for law enforcement purposes.

We will share your information with Racing Welfare in relation to any safeguarding concerns or investigations.

We will share your information with our member organisations and/ or racing participants in relation to any integrity threats or concerns.

We will share your information with the RSPCA in relation to any animal welfare concerns.

We will share your information with the Racecourse Association and/ or individual racecourses where you have been disqualified from racing in order to enforce access controls.

Where your information is used in regulatory proceedings, it will be shared with the BHA’s independent Judicial Panel.

Where information is transferred outside the UK, and where this is to a stakeholder or vendor in a country that is not subject to UK adequacy regulations, data is adequately protected using appropriate safeguards. A copy of the relevant mechanism can be provided for your review on request to the BHA Head of Legal and Governance. In other circumstances, we might ask for your consent to share this data, where you have requested that we provide it to a foreign racing authority.

What rights do I have?

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format and to ask us to share (port) this data to another controller.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.  Relevant exemptions are included in both the UK GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to the Information Commissioner’s Office.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data.  If you have any concerns about how we process your data, you can get in touch at [email protected].

How long will you retain my data?

Intelligence and investigations data:

We retain intelligence data for a period of seven years from the date of collection, unless such data forms part of a case file (see below). Intelligence data will be reviewed after 3 years to consider if there is a need to retain the data for the full seven-year period.

We retain investigations data and case files (produced where an investigation leads to a charge) for the period of the investigation plus twenty years from the date that the investigation is closed or for as long as you hold a licence, registration and/or permit (whichever the longer). Case files may be retained for a longer period where the requirement for retention outweighs the requirement for deletion.

Intelligence and investigations data is retained so that we maintain adequate records in the event that you return to horseracing in the same or another registered or licensed profession or otherwise remain a person of interest under the Rules of Racing, by remaining connected to other licensed personnel.

Judicial Panel decisions and written reasons:

We publish decisions and written reasons of the Judicial Panel on our website – these remain for seven years from the date of the decision, or in the case of sanctions lasting longer than seven years, for as long as the sanction is in place.  We retain the decisions and written reasons of the Judicial Panel internally for a period of twenty years following the expiry of the period of the sanction. If you are still a registered participant at this point, we may retain the Judicial Panel decision for as long as you remain registered by the BHA.

Data extracted from a communication device:

Data extracted from a communication device will be held and retained by CCL until the investigation has reached a conclusion.  At that point, if there are no proceedings that follow and the investigation or related investigations are closed with no further action, then your extracted data will be destroyed within 7 days.  If proceedings do follow, then the extracted data held by CCL will be retained securely and confidentially until the conclusion of the later of (i) the case and 7 days after the expiry of any potential appeal period or (ii) any other related investigations or proceedings.  Where any extracted data is provided to the BHA under a relevant search, this data will be retained in accordance with the investigations data provision above.

Summary of how the British Horseracing Authority (“The BHA”) uses your data

• The BHA processes information about participants in horseracing in order to safeguard its participants and ensure the welfare of both children and adults at risk. This involves both proactive checks (which may include such things as carrying out Disclosure and Barring Service (DBS) checks), and reactive work such as dealing with safeguarding matters that are referred to it (or of which it otherwise becomes aware) in accordance with the BHA’s Safeguarding Policy.
• The information processed by the BHA can involve sensitive and criminal records data where such data is relevant to a safeguarding investigation. This is processed on the basis of preventing and detecting unlawful activity, and for the purposes of safeguarding individuals at risk.
• Information may be obtained both directly from participants, and from third parties: such third parties include other horseracing stakeholders such as racecourses, stables or racing schools, from other individual participants or from other third parties that raise potential issues of abuse or other relevant matters or concerns. This can include other sports governing bodies, charities such as (for example) the NSPCC and ChildLine, statutory bodies, trade bodies such as the National Association of Racing Staff or Professional Jockeys Association, agencies such as the police or local authorities, or members of the wider public.
• Data is shared, where appropriate, with other stakeholders who may come into contact with or have a role in dealing with participants who pose a risk of harm to children or adults at risk in racing or other environments, such as Local Education Authorities, the police, racing stakeholders and other sports governing bodies. Further information as to how the BHA shares data is contained within the BHA’s Safeguarding Policy.
• Our privacy notice below describes your data protection rights, including a right to object to some of the processing which the BHA carries out.

What does this notice cover?            

This notice describes how the BHA will make use of data – whether that data relates to a child, adult at risk, parents or carers or someone who interacts with such individuals – in order to carry out its safeguarding functions. Other important policies that may be relevant to how the BHA processes your data in other circumstances can be found by reviewing our main website privacy notice or the notices relevant to any licence or registration application.

This notice describes your data protection rights, including a right to object to some of the processing which the BHA carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information does the BHA collect about me?

The BHA collects information you provide as part of your registration or licence application with the BHA as a participant. Information may also be provided directly to the BHA in response to requests for representations, or where you make a communication about a safeguarding matter.

What information is provided by third parties about you?

Information may be obtained from third parties where the BHA becomes aware of alleged behaviour that raises safeguarding issues/concerns that involve you or in relation to which you might hold relevant information (for example, because an allegation has been made against you, you are an alleged victim, or you are a possible witness).

This information may be obtained both directly from participants, and from third parties: such third parties include other horseracing stakeholders such as racecourses, stables or racing schools, from other individual participants or from other third parties that raise potential issues of abuse or other relevant matters or concerns. This can include other sports governing bodies, charities such as (for example) the NSPCC and ChildLine, statutory bodies, trade bodies such as the National Association of Racing Staff or Professional Jockeys Association, agencies such as the police or local authorities, or members of the wider public.

Information may be obtained through DBS checks for participants where this is relevant for their role.

How does the BHA use this information, and what is the legal basis for this use?

The BHA will use this information for the following purposes:

• As required by the BHA to conduct its business and pursue its legitimate interests, in particular:
  • communicating with you or about you where necessary to administer and implement the BHA’s Safeguarding Policy, and relevant regulations in place to ensure the welfare of individuals at risk;
  • administering its systems holding safeguarding data; and
  • collecting, sharing and retaining evidence and intelligence in relation to safeguarding and enforcing applicable Rules of Racing and regulations regarding safeguarding, including the processing of criminal offence and potentially sensitive data provided by you to prevent and detect unlawful activity and where necessary to protect children and adults at risk from neglect or physical, mental or emotional harm or to protect their physical, mental or emotional wellbeing.
• For purposes which are required by law:
  • in response to requests by government or law enforcement authorities conducting an investigation.

How is data shared, where and when?

Data is shared, where appropriate, with other stakeholders who may come into contact with or have a role in dealing with participants who pose a risk of harm to children or adults at risk in racing or other environments, such as Local Education Authorities, the police, racing stakeholders and others sports governing bodies.

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legal or legitimate interests in compliance with applicable laws.

We will share your information with Racing Welfare in relation to any safeguarding concerns or investigations.

We will share your information with Clue Computing Co. Ltd (Clue), our data processor, who provide investigation and intelligence management software and occasionally provide maintenance and support services for such software. Information is also shared with other third-party service providers who provide services relevant to the purposes described above.

Where your information is used in regulatory proceedings, it will be shared with the BHA’s independent Judicial Panel.

Where information is transferred outside the UK, and where this is to a stakeholder or vendor in a country that is not subject to UK adequacy regulations, data is adequately protected using appropriate safeguards. A copy of the relevant mechanism can be provided for your review on request to the BHA Head of Legal and Governance. In other circumstances, we might ask for your consent to share this data, where you have requested that we provide it to a foreign racing authority.

What rights do I have?

You have the right to ask the BHA for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where one of the data controllers doesn’t have to process the data to meet a contractual or other legal requirement, or where it is using the data for direct marketing).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where it would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.  Relevant exemptions are included in both the UK GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, you can get in touch with the BHA – or its data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to the Information Commissioner’s Office.

Where relevant, information that is provided in order to carry out a DBS check so that you can receive a licence or take up a relevant role is mandatory. If relevant data is not provided, it may be that you cannot be registered in certain roles. Other information you provide is optional, although where you are asked to provide information and refuse to do so, where relevant to an investigation into a safeguarding matter, this may have consequences in relation to relevant enforcement action that will be explained at the time of the investigation.

How do I get in touch with the BHA, or its data protection officer?

The BHA hopes that it can satisfy queries you may have about the way it processes your data. If you have any concerns about how your data is processed by the BHA, you can get in touch at [email protected].

How long will you retain my data?

Intelligence and investigations data:

Information relating to intelligence gathered in relation to safeguarding matters, and details of any actions taken by the BHA and any decisions taken to bar participants from participation on Safeguarding grounds or to enforce BHA Regulations will be reviewed every 7 years. If the BHA considers that ongoing retention is justified, it will continue to retain relevant information until at least the next review. We will also review the information we hold about you at the end of any investigation or case to ensure this remains relevant. Given the importance of ensuring that participants’ welfare is safeguarded, details may be retained for up to 75 years from the date that we receive intelligence, or commence an investigation. For particularly serious cases, we may inevitably hold information for the duration of this period, but this will remain subject to regular review.

Information relating to any DBS checks is retained for the duration of any investigation or case.

Judicial Panel decisions and written reasons:

We publish decisions and written reasons of the Judicial Panel on our website – these remain for seven years from the date of the decision, or in the case of sanctions lasting longer than seven years, for as long as the sanction is in place.  We retain the decisions and written reasons of the Judicial Panel internally for a period of twenty years following the expiry of the period of the sanction. If you are still a registered participant at this point, we may retain the Judicial Panel decision for as long as you remain registered by the BHA.

Summary of how we use your data

• The British Horseracing Authority uses the data you provide in the licence/ permit application form and any attachments, and that you might provide at other occasions, such as during a stable inspection or in response to enquiries, to administer your licence or permit application, administer and regulate horseracing in Great Britain and to ensure the safety and welfare of your horses and staff.
• The British Horseracing Authority may also gather information about you from third party sources, particularly in relation to our integrity activities. More details on the information we collect from third party sources such as the public, the media and publicly available information, BHA and racecourse officials, the press and bookmakers are set out in the Integrity Privacy Notice (available on the BHA website).
• The British Horseracing Authority asks you to provide information in relation to your unspent criminal records history. This information will be processed to ensure the integrity of the sport, and we will be entitled to retain this information for this purpose.
• The British Horseracing Authority may share information relating to you with foreign racing authorities in relation to your licence or permit history. Some of these authorities may be located outside of the European Economic Area. We may also share information we receive from or about you with other third parties as set out in more detail below.

What does this policy cover?

This policy describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it by and about trainers, particularly as part of the licence or permit application process. It does not describe the processing carried out by the BHA in relation to its integrity activities, which are covered in the Integrity Privacy Notice (available on the BHA website).

This policy also describes your data protection rights, including a right to object to some of the processing which the BHA carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information do we collect?

We collect and process personal data about you when you complete your initial licence or permit application and subsequent renewals; when you register any non- training services pursuant to the Rules of Racing; during stable inspections and otherwise during the course of your licence or permit. This includes all the information you provide to us in the application forms and in any attachments submitted alongside the form.

We may also generate information about you in order to help you complete your applications and help regulate and manage horseracing and ensure your welfare. In particular, we may hold and use information on whether you need particular assistance with completing your applications, on stable inspection reports and on stewards’ reports.

What information do we receive from third parties?

Sometimes, we receive information about you from third parties. In particular:

• we may receive information about you from foreign racing authorities in relation to your licence, permit or registration history and conduct;
• we may receive information about you from training providers in relation to both your own training and that of your employees and any safeguarding concerns or investigations;
• we may receive information about you from our member organisations in relation to any safeguarding concerns or investigations;
• we may receive information about you from Racing Welfare in relation to any safeguarding concerns or investigations;
• we receive information about you from our appointed awarding organisation in relation to your qualifications;
• we may receive information about you from other licensed, registered or permitted personnel;
• we may seek information about you and your suitability and requirements for licensing or permit from publicly available sources, such as through internet searches and director checks;
• we may receive information about your performance and conduct from racecourses and BHA and racecourse officials;
• we may collect some information for integrity purposes from a variety of sources such as the public, the media and publicly available information, the press, bookmakers and the stewards– this is discussed in more detail in the Integrity Privacy Notice (available on the BHA website).

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:

• As required by the BHA to conduct our business and pursue our legitimate interests, in particular:
  • we will use your information to process your application for a new or renewed licence or permit and ensure your suitability and requirements for licensing in accordance with  measures we take to ensure the integrity of the sport;
  • we use your criminal records data, provided as part of the licence or permit application, to ensure the integrity of the sport;
  • we will contact you in relation to any rules or other information you may require as a licensed or permitted trainer;
  • we will maintain records of horseracing results and share results with third party publishers of results;
  • we will monitor compliance with the Rules of Racing to ensure that breaches of the Rules are upheld and sanctioned (for more details, see our Integrity Privacy Notice);
  • we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation); and
  • we use data of some trainers to invite them to take part in industry research.

• Where you give your consent:
  • in other circumstances where we rely on your consent, and have explained the use of data at that time, including email marketing as set out in the trainer licence or permit application.

• For purposes which are required by law:
  • in response to requests by government or law enforcement authorities conducting an investigation, including the Gambling Commission.

Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above. You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.

Withdrawing consent or objecting to direct marketing

Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes. You have an absolute right to opt- out of direct marketing, or profiling we carry out for direct marketing, at any time. You can do this by following the instructions in the communication where this is an electronic marketing message, or by contacting us using the details set out below.

Who will we share this data with, where and when?

We will share your information with foreign racing authorities when you wish to participate in horseracing in a different jurisdiction or in order that they may contact you to request your assistance in an investigation.  Some of these authorities may be located outside of the European Economic Area.

We will share your information with Weatherbys Limited, our data processor, who administer our racing database and provide racing related services to the BHA.

We will share your information with Racing Digital Limited, our data processor, who are developing a racing administration system for the sport of horseracing.

We will share your information with training providers in relation to your training and any safeguarding concerns or investigations.

We will share your information with Racing Welfare in relation to any safeguarding concerns or investigations.

We will share your information with our member organisations in relation to any safeguarding concerns or investigations.

We will share limited information with other licensed, permitted or registered personnel in relation to your standing as a trainer.

We will share your information with Jockey Club Estates in relation to your use of their training facilities.

We will share your information with the Point to Point Authority, where necessary, to assist with their regulated activities.

We will share your information with the National Trainers’ Federation (“NTF”) so that they can represent your interests as a licensed or permitted trainer.  They will also use this information for the administration of the Racing Industry Accident Benefit Scheme (RIABS), the Stable Employees Life Assurance Scheme and the Stable Employees’ Pension Plan.   More details on how the NTF handle your information can be sought directly from the NTF.

We will share your information with the National Association of Racing Staff so that they can monitor stable staff length of service with particular trainers, trainer retention rates and gain up to date information about their members.

We will share information with the RCA and/ or racecourses in relation to entries, including any integrity concerns.

We will share your information with Great British Racing Limited to assist them in validating your details where you nominate an owner to join the GBRI Members’ Club.

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

Personal data will also be shared with third party service providers, who will process it on behalf of the BHA for the purposes identified above.  Such third parties include providers of website and system hosting for our licensing teams.

Where information is transferred outside the UK, and where this is to a stakeholder or vendor in a country that is not subject to UK adequacy regulations, data is adequately protected using appropriate safeguards. A copy of the relevant mechanism can be provided for your review on request to the BHA Head of Legal and Governance. In other circumstances, we might ask for your consent to share this data, where you have requested that we provide it to a foreign racing authority.

What rights do I have?

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format and to ask us to share (port) this data to another controller.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in both the UK GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to the Information Commissioner’s Office.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, or would like to opt out of direct marketing, you can get in touch at [email protected].

How long will you retain my data?

Where we process paper versions of licence or permit data, we do this for up to ten years from the date of the relevant document. We periodically review paper versions of hard copy data we hold on you within such ten year period to assess the continued relevance to the BHA.

Where we process licence and permit data electronically, we do this for as long as you hold a licence/permit (as applicable) and for up to ten years thereafter. We periodically review the electronic data we hold on you within the ten years post expiry or termination of your licence/ permit to assess its continued relevance to the BHA.

We retain top level data recording your name and dates of licence/ permit indefinitely in order to keep a record of the sport.

Where we maintain records of racing results, we hold this information indefinitely in order to keep a record of the sport.

Where we hold case files in relation to breaches of the Rules of Racing by registered, licensed or permitted personnel, we hold these for the period of the investigation plus twenty years from the date that the investigation is closed or for as long as you hold a licence, registration and/or permit (whichever the longer) so that we maintain adequate records in the event that you return to horseracing in the same or another registered or  licensed profession or otherwise remain a person of interest under the Rules of Racing, by remaining connected to other licensed personnel. In exceptional circumstances, we may retain case files for a longer period where the requirement for retention outweighs the requirement for deletion.

We publish decisions and written reasons of our Judicial Panel on our website – these remain for seven years from the date of the decision, or in the case of sanctions lasting longer than seven years, for as long as the sanction is in place.  We retain the decisions and written reasons of the Judicial Panel internally for a period of twenty years following the expiry of the period of the sanction. If you are still a licensed or permitted trainer at this point, we may retain the Judicial Panel decision for as long as you remain licensed or permitted by the BHA.

Summary of how we use your data

• The British Horseracing Authority uses the data you provide in the licence application form, the medical attachments and otherwise during the term of your licence/ permit to administer your licence or permit application, administer and regulate horseracing in Great Britain and to ensure your health and welfare when racing in Great Britain.
• In order to ensure that your information can be provided to: BHA registered Racecourse Medical Officers; doctors and nurses employed by the racecourses; physiotherapists; other healthcare professionals; and concussion testing centres and neuropsychologists that we engage to provide such services to assess your care, we ask that you consent to the sharing of your medical information with such third parties. This consent is required for us to share your confidential medical records.  The BHA uses your data otherwise for the purposes of occupational medicine. If you fail to provide this consent, or withdraw it in the future, we may still retain your data and may be required and entitled to prevent you from racing on safety grounds.
• The British Horseracing Authority also asks that you consent to our retention of relevant medical data to allow the creation of a research database to study the effects of concussion and other occupational health issues that may be experienced by jockeys. This database will be accessed only by British Horseracing Authority doctors, although records may be shared with third parties with your consent or in anonymous form. You are entitled to opt out of this research at any time. Our legal basis for the processing is the carrying out of scientific research, which is in our legitimate interest. We do not process our research data with the purpose of taking decisions on particular jockeys.

• The British Horseracing Authority asks you to provide information in relation to your unspent criminal records history. This information will be processed to ensure the integrity of the sport and we will be entitled to retain this information for this purpose.
• The British Horseracing Authority may also gather information about you from third party sources, particularly in relation to our integrity activities. More details on the information we collect from third party sources such as the public, the media and publicly available information, BHA and racecourse officials, the press and bookmakers are set out in the BHA’s Integrity Privacy Notice, available on the BHA website.
• The British Horseracing Authority may share information in relation to your licence or permit history (including your medical information) with foreign racing authorities in other countries. Some of these authorities may be located outside of the EEA.
• We may also share information we receive from or about you with other third parties as set out in more detail below.
• The British Horseracing Authority uses a number of different information systems. One of these systems, used to carry out concussion screening activities, is currently based in Canada. We take steps to ensure your data is adequately protected whenever it is transferred outside the UK.

What does this policy cover?

This policy describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it by and about jockeys as part of the licence or permit application process and, more generally, during the term of your licence or permit. It does not describe the processing carried out by the BHA in relation to its integrity or anti-doping activities, which are covered in the BHA’s Integrity Privacy Notice and Anti-Doping Privacy Notice, both of which are available on the BHA website.

This policy also describes your data protection rights, including a right to object to some of the processing which the BHA carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information do we collect?

We collect and process personal data about you when you: complete your initial licence or permit application and subsequent renewals; complete your pre-licence skills and fitness assessment form; complete your declaration of health/provide your medical report; provide information via any athlete software application endorsed by the BHA Medical Department; take part in concussion screening activities; report an injury or illness to the BHA Medical Department; contact the BHA Medical Department for support and guidance regarding illness or injury; and when you register any non- riding interests pursuant to the Rules of Racing.  This includes all the information you provide to us in the application forms and in the medical attachments submitted alongside the form.

We may also generate information about you in order to help you complete your applications and help regulate and manage horseracing and ensure your welfare. In particular, we may hold and use information on whether you need particular assistance with completing your applications, need to be permitted to take specific medications or should be prevented from racing whilst recovering from an illness or injury.

What information do we receive from third parties?

Sometimes, we receive information about you from third parties. In particular:

• we receive information about you from training providers in relation to your training and performance and any safeguarding concerns or investigations;
• we may receive information about you from our member organisations in relation to any safeguarding concerns or investigations;
• we may receive information about you from Racing Welfare in relation to any safeguarding concerns or investigations;
• we receive information about you from our appointed awarding organisation in relation to your qualifications;
• we may receive information about you from foreign racing authorities in relation to your performance in that jurisdiction, your registration, permit and licensing history and conduct and also your medical records in relation to your fitness to ride;
• we may receive information about your performance and conduct from racecourses and BHA and racecourse officials;
• we may receive information about you from other licensed, registered or permitted personnel;
• we receive, where you have given your consent to the appropriate health professional, assessments or details of your health as part of your medical attachments and otherwise during the course of your licence or permit;
• we may seek information about you and your suitability and requirements for licence or permit from publicly available sources, such as through internet searches;
• we may collect some information for integrity purposes from a variety of sources such as the public, the media and publicly available information, the press, bookmakers, BHA and racecourse officials and the BHA’s integrity systems– this is discussed in more detail in the Integrity Privacy Notice.

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:

• As required by the BHA to conduct our business and pursue our legitimate interests, in particular:
  • we will use your information to process your application for a new or renewed licence or permit and ensure your suitability and requirements for licensing or permitting in accordance with measures we take to ensure the integrity of the sport;
  • we conduct appropriate occupational health assessments of you and your ability to race throughout the licence or permit period – as this involves sensitive data, this is also based on the BHA’s need to perform occupational medicine to ensure the working capacity and safety of jockeys;

• we may use your health data to produce a research database to study the effects of concussion and other occupational health issues that may be experienced by jockeys. As this involves sensitive data, this is also based on the BHA’s scientific research purposes. This database will be accessed only by British Horseracing Authority doctors, although records may be shared with your consent or in anonymous form. We do not process our research data with the purpose of taking decisions on particular jockeys.

• • we use your criminal records data, provided as part of the licence or permit application, to ensure the integrity of the sport;
  • we will contact you in relation to any Rules or other information you may require as a licensed or permitted jockey;
  • we will maintain records of horseracing results and share results with third party publishers of results;
  • we will monitor compliance with the Rules of Racing to ensure that breaches of the Rules are upheld and sanctioned (for more details, see our Integrity Privacy Notice and Anti-Doping Privacy Notice);
  • we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation), such as selecting individuals for anti-doping testing; and
  • we use data of some jockeys to invite them to take part in industry research.
• Where you give your consent:
  • we will share information with third parties with whom you would like us to share data, such as medical specialists to assess an injury you have suffered;

• in other circumstances where we rely on your consent and have explained the use of data at that time, including taking part in research or email marketing as set out in the jockey licence or permit application.

• For purposes which are required by law:

• in response to requests by government or law enforcement authorities conducting an investigation, including the Gambling Commission.

Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above. You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.

Withdrawing consent or objecting to direct marketing or research

Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes – in particular, whilst we seek your consent for sharing with and obtaining data from third party medical staff, we process medical data in order to ensure that you are fit to race and withdrawing consent may result in your being excluded from racing for safety reasons. You have an absolute right to opt-out of research processing, and of direct marketing, or profiling we carry out for direct marketing, at any time. You can do this by following the instructions in the communication where this is an electronic marketing message, or by contacting us using the details set out below.

Who will we share this data with, where and when?

We may share information (including your medical information) relating to you with foreign racing authorities so that they may determine your fitness to ride in those jurisdictions or where you wish to participate otherwise in horseracing in a different jurisdiction or in order that they may contact you to request your assistance in an investigation.  Some of these authorities may be located outside of the EEA.

We will share your information with Weatherbys Limited, our data processor, who administer our racing database and provide racing related services to the BHA.

We will share your information with Racing Digital Limited, our data processor, who are developing a racing administration system for the sport of horseracing.

We will share your information with Weatherby Bank Limited so that they can administer payments to your account.

Your information will be shared with our medical database provider, which is used to ensure that relevant registered staff can access your medical records where required on racecourses.

We will share your information with the training providers in relation to any safeguarding concerns or investigations.

We will also share your information with the training providers in relation to your training and performance and to allow training providers (at which you have previously studied) to track industry retention and career retention of their alumni.

We may share your information with our member organisations in relation to any safeguarding concerns or investigations.

We will share your information with Racing Welfare and JETS in relation to your licensing/ permit history and any safeguarding concerns or investigations.

We will share your information with the Professional Jockeys Association (PJA) so that they can represent your interests as a licensed jockey.   More details on how the PJA handle your personal data can be sought directly from the PJA.

We will share your information with the Amateur Jockeys Association (AJA) so that they can represent your interests as a permitted jockey. More details on how the AJA handle your personal data can be sought directly from the AJA.

We will share limited information with other licensed, permitted, or registered personnel in relation to your standing as a jockey.

We may share your information with the Point-to-Point Authority to confirm your eligibility to ride.

We will share your information with the Injured Jockeys Fund so that they can provide you with physiotherapy services and offer support through the IJF almoner.

We will share your information with the Professional Riders Insurance Scheme to allow you to claim financial assistance in the event of an injury or illness that prevents you from working.

For amateur jockeys, we will share your information with our amateur jockeys insurance scheme service provider so that they can administrate claims.

We will share your information with external medical professionals for the purposes of your baseline and annual concussion testing and otherwise, where required, such as physiotherapists in order that they may provide you with medical treatment.

We will share your information with data processors that provide IT services to the BHA such as jockey performance management software, for the limited purpose of hosting, supporting, and maintaining their software.

We will share information with the RCA and/ or racecourses in relation to entries, including any integrity concerns.

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

Where information is transferred outside the UK, and where this is to a stakeholder or vendor in a country that is not subject to UK adequacy regulations, data is adequately protected using appropriate safeguards. A copy of the relevant mechanism can be provided for your review on request to the BHA Head of Legal and Governance. In other circumstances, we might ask for your consent to share this data, where you have requested that we provide it to a foreign racing authority.

What rights do I have?

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine-readable format and to ask us to share (port) this data to another controller.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we are carrying out research, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in both the UK GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to the Information Commissioner’s Office.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, or would like to opt out of direct marketing, you can get in touch at [email protected].

How long will you retain my data?

Where we process paper versions of licence or permit data, we do this for up to ten years from the date of the relevant document. We periodically review paper versions of hard copy data we hold on you within such ten year period to assess the continued relevance to the BHA.

Where we process licence and permit data electronically, we do this for as long as you hold a licence/permit (as applicable) and for up to ten years thereafter. We periodically review the electronic data we hold on you within the ten years post expiry or termination of your licence/ permit to assess its continued relevance to the BHA.

We retain top level data recording your name and dates of licence/ permit indefinitely in order to keep a record of the sport.

Where we maintain records of racing results, we hold this information indefinitely in order to keep a record of the sport.

Where we hold case files in relation to breaches of the Rules of Racing by registered, licensed or permitted personnel, we hold these for the period of the investigation plus twenty years from the date that the investigation is closed or for as long as you hold a licence, registration and/or permit (whichever the longer) so that we maintain adequate records in the event that you return to horseracing in the same or another registered or  licensed profession or otherwise remain a person of interest under the Rules of Racing, by remaining connected to other licensed personnel. In exceptional circumstances, we may retain case files for a longer period where the requirement for retention outweighs the requirement for deletion.

We publish decisions and written reasons of our Judicial Panel on our website – these remain for seven years from the date of the decision, or in the case of sanctions lasting longer than seven years, for as long as the sanction is in place.  We retain the decisions and written reasons of the Judicial Panel internally for a period of twenty years following the expiry of the period of the sanction. If you are still a licensed or permitted jockey at this point, we may retain the Judicial Panel decision for as long as you remain licensed or permitted by the BHA.

Where we hold copies of your medical records, we hold these until your 75^th birthday. We will, where we can contact you, ask if you would like to have your records shared with a relevant medical professional responsible for your ongoing care prior to deleting records.

Where your information is being held for research purposes as described above, relevant medical data will be retained for up to fifty years following the date that your licence or permit expires or is otherwise terminated. The reason for this retention period is so that we can retain data on the possible long-term effects of concussion and other occupational health issues experienced by jockeys.

Summary of how the British Horseracing Authority (“BHA”) uses your data

• The BHA uses the data you provide in the owner registration form to administer your ownership registration, to administer and regulate horseracing in Great Britain and to ensure the welfare of your horses.
• The BHA asks you to provide information in relation to your unspent criminal records history. This information will be processed to ensure the integrity of the sport, and we will be entitled to retain this information for this purpose.
• The BHA may also gather information about you from third party sources, particularly in relation to our integrity activities. More details on the information we collect from third party sources such as the public, the media and publicly available information, BHA and racecourse officials, the press and bookmakers are set out in the BHA’s Integrity Privacy Notice, available on the BHA website.

• The BHA may share information relating to you with foreign racing authorities in other countries in relation to your registration and licensing history. Some of these authorities may be located outside of the European Economic Area.
• We may also share information we receive from or about you with other third parties as set out in more detail below.
• The BHA may, as part of its suitability checks, carry out a credit reference check with its chosen credit referencing agency, Equifax. More information on your credit history and status can be sought directly from Equifax. Where the BHA makes a search, this may in itself affect your credit history.

What does this policy cover?

This policy describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it by and about owners, particularly as part of the registration process. It does not describe the processing carried out by the BHA in relation to its integrity and safeguarding activities, which are covered in separate privacy notices on this page.

This policy also describes your data protection rights, including a right to object to some of the processing which the BHA carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information do we collect?

We collect and process personal data about you when you complete your ownership registration and more generally throughout the course of your ownership registration.  This includes all the information you provide to us in the registration form and any attachments submitted alongside the form.

What information do we receive from third parties?

Sometimes, we receive information about you from third parties. In particular:

• we may receive information about you from foreign racing authorities in relation to your licensing and registration history and conduct;
• we may receive information about you from our member organisations in relation to any safeguarding concerns or investigations;
• we may receive information about you from Racing Welfare in relation to any safeguarding concerns or investigations;
• we may receive information about you from other licensed, registered or permitted personnel;
• we may seek information about you and your suitability and requirements for registration from publicly available sources, such as through internet searches and director checks and through vetting checks carried out by or with third parties, such as credit referencing checks;
• we may receive information about your performance and conduct from racecourses and BHA and racecourse officials. 

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:

• As required by the BHA to conduct our business and pursue our legitimate interests, in particular:
  • we will use your information to process your registration to become an owner and ensure your suitability in accordance with measures we take to ensure the integrity of the sport;
  • we use your criminal records data, provided as part of your registration, to ensure the integrity of the sport;
  • we will contact you in relation to any rules or other information you may require as a registered owner;
  • we will maintain records of horseracing results and share results with third party publishers of results;
  • we will carry out a credit check to confirm your responses to financial questions and suitability for ownership;
  • we will monitor compliance with the Rules of Racing to ensure that breaches of the Rules are upheld and sanctioned (for more details, see our Integrity Privacy Notice); and
  • we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation).
• Where you give your consent:
  • in other circumstances where we rely on your consent, and have explained the use of data at that time, including email marketing as set out in the owner registration.
• required by law:
  • in response to requests by government or law enforcement authorities conducting an investigation, including the Gambling Commission. 

Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above. You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice. 

Withdrawing consent or objecting to direct marketing

Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes. You have an absolute right to opt-out of direct marketing, or profiling we carry out for direct marketing, at any time. You can do this by following the instructions in the communication where this is an electronic marketing message, or by contacting us using the details set out below.

Who will we share this data with, where and when?

We will share your information with Weatherbys Limited, our data processor, who administer our racing database and provide racing related services to the BHA such as weight adding.

We will share your information with Racing Digital Limited, our data processor, who are developing a racing administration system for the sport of horseracing.

We will share your information with Weatherbys Bank Limited, who provide racing related services to the BHA in respect of owners such as administering payments to gallop authorities and administering payments to and from foreign racing authorities when horses are racing overseas.  We also share your information with Weatherbys Bank Limited where you choose Weatherbys Bank as your VAT return service provider.

We may share your information with our member organisations in relation to any safeguarding concerns or investigations.

We will share your information with Racing Welfare in relation to any safeguarding concerns or investigations.

If you are already a member or have opted to become a member of the Racehorse Owners Association (ROA), we will share your information with this organisation so that they can represent your interests as a registered owner. More information on how the ROA process your personal data can be sought directly from the ROA.

We will share your information with the RCA and/ or racecourses in relation to entries, including any integrity concerns.

Where you have a horse entered to run at a particular raceday, your contact details will also be shared with the relevant racecourse so that they can contact you regarding raceday requirements and, following the raceday, contact you regarding your horse’s performance and arrange for the distribution of trophies or mementos from the day.

For owners domiciled overseas, we will share your information with Great British Racing Limited in order that they can validate your ownership interests in the event that you are nominated by to join the GBRI Members’ Club by your trainer.

We will share your information with data processors that provide IT services to the BHA, for the limited purpose of hosting, supporting and maintaining their software.

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

Where information is transferred outside the UK, and where this is to a stakeholder or vendor in a country that is not subject to UK adequacy regulations, data is adequately protected using appropriate safeguards. A copy of the relevant mechanism can be provided for your review on request to the BHA Head of Legal and Governance. In other circumstances, we might ask for your consent to share this data, where you have requested that we provide it to a foreign racing authority.

What rights do I have?

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format and to ask us to share (port) this data to another controller.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in both the UK GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to the Information Commissioner’s Office.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, or would like to opt out of direct marketing, you can get in touch at [email protected].

How long will you retain my data?

Where we process paper versions of registration data, we do this for up to ten years from the date of the relevant document. We periodically review paper versions of hard copy data we hold on you within such ten year period to assess the continued relevance to the BHA.

Where we process registration data electronically, we do this for as long as you hold a registration and for up to ten years thereafter. We periodically review the electronic data we hold on you within the ten years post expiry or termination of your registration to assess its continued relevance to the BHA.

We retain top level data recording your name and dates of registration indefinitely in order to keep a record of the sport.

For information regarding retention periods applicable to any data we process about you in relation to regulatory investigations and proceedings, please refer to our Integrity Privacy Notice, Safeguarding Privacy Notice and / or our Anti-Doping Privacy Notice.

Summary of how we use your data

• The British Horseracing Authority uses the data provided by your employer in the Stable Employee Application Form to administer and regulate horseracing in Great Britain and to ensure your safety and welfare.
• The British Horseracing Authority may also gather information about you from third party sources, particularly in relation to our integrity activities. More details on the information we collect from third party sources such as the public, the media and publicly available information, BHA and racecourse officials, the press and bookmakers are set out in the Integrity Privacy Notice, available on the BHA website.

• The British Horseracing Authority may share information relating to you with foreign racing authorities in relation to your registration history. Some of these authorities may be located outside of the European Economic Area. We may also share information we receive from or about you with other third parties as set out in more detail below.

What does this policy cover?

This policy describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it by and about stable employees. It does not describe the processing carried out by the BHA in relation to its integrity activities, which are covered in the Integrity Privacy Notice, available on the BHA website.

This policy also describes your data protection rights, including a right to object to some of the processing which the BHA carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information do we collect?

We collect the following personal data about you when your employer completes the Stable Employee Application Form:

1. Title
2. All Forenames
3. Surname
4. Any previous surnames
5. Date of Birth
6. Gender
7. Nationality
8. NI Number
9. Country
10. Postcode
11. Address
12. Telephone
13. Mobile Phone
14. Email
15. Next of Kin
16. Name
17. Telephone
18. Email

We also collect your name and photograph when you apply for a Racehorse Attendants Pass Card.

We may also generate information about you in order to help regulate and manage horseracing and ensure your welfare.

What information do we receive from third parties?

Sometimes, we receive information about you from third parties. In particular:

• we receive information about you from training providers in relation to your training and any safeguarding concerns or investigations;
• we may receive information about you from our member organisations in relation to any safeguarding concerns or investigations;
• we may receive information about you from Racing Welfare in relation to any safeguarding concerns or investigations;
• we receive information about you from our appointed awarding organisation in relation to your qualifications;
• we may collect some information for integrity purposes from a variety of sources such as the public, the media and publicly available information, the press, bookmakers and the stewards– this is discussed in more detail in the Integrity Privacy Notice;
• we may receive information about you from foreign racing authorities in relation to your licensing and registration history and conduct;
• we may receive information about you from other licensed, registered or permitted personnel;
• we may receive information about your performance and conduct from racecourses and BHA and racecourse officials.

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:

• As required by the BHA to conduct our business and pursue our legitimate interests, in particular:
  • we will use your information to process your trainer’s application for you to join the Register of Stable Employees;
  • we will contact you in relation to any rules or other information you may require as a registered stable employee;
  • we will maintain records of horseracing results and share results with third party publishers of results;
  • we will monitor compliance with the Rules of Racing to ensure that breaches of the Rules are upheld and sanctioned (for more details, see our Integrity Privacy Notice); and
  • we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation).
• Where you give your consent:
  • in circumstances where we rely on your consent and have explained the use of data at that time, such as for email marketing.
• For purposes which are required by law:
  • in response to requests by government or law enforcement authorities conducting an investigation, including the Gambling Commission.

Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above. You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.

Withdrawing consent

Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes.

Who will we share this data with, where and when?

We will share your information with Weatherbys Limited, our data processor, who administer our racing database and provide racing related services to the BHA.

We will share your information with Racing Digital Limited, our data processor, who are developing a new racing administration system for the sport of horseracing.

We will share your information with the training providers in relation to any safeguarding concerns or investigations.

We will also share your information with the training providers to assist with your training and to allow training providers (at which you have previously studied) to track industry retention and career retention of their alumni.

We will share your information with our member organisations in relation to any safeguarding concerns or investigations.

We will share your information with Racing Welfare in relation to any safeguarding concerns or investigations.

We will share information with the RCA and/ or racecourses in relation to entries, including any integrity concerns.

We will share your information with foreign racing authorities when you wish to participate in horseracing in a different jurisdiction or in order that they may contact you to request your assistance in an investigation.  Some of these authorities may be located outside of the European Economic Area.

We will share limited information with other licensed, permitted or registered personnel in relation to your standing as a stable employee.

We will share your information with the National Association of Racing Staff so that they can represent your interests as a registered stable employee.

We will share your information with the National Trainers Federation in order that they can administrate the stakeholder pension scheme, the Racing Industry Accident Benefit Scheme and the Death in Service Benefit Scheme on behalf of their member trainers.

We will share your information with registered or permitted trainers in relation to your employment history.

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

Personal data will also be shared with third party service providers, who will process it on behalf of the BHA for the purposes identified above.  Such third parties include providers of website and system hosting for our licensing teams.

Where information is transferred outside the UK, and where this is to a stakeholder or vendor in a country that is not subject to UK adequacy regulations, data is adequately protected using appropriate safeguards. A copy of the relevant mechanism can be provided for your review on request to the BHA Head of Legal and Governance. In other circumstances, we might ask for your consent to share this data, where you have requested that we provide it to a foreign racing authority.

What rights do I have?

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format and to ask us to share (port) this data to another controller.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. Relevant exemptions are included in both the UK GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to the Information Commissioner’s Office.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data. If you have any concerns about how we process your data, or would like to opt out of direct marketing, you can get in touch at [email protected]

How long will you retain my data?

Where we process paper versions of registration data, we do this for up to five years from the date of the relevant document. We periodically review paper versions of hard copy data we hold on you within such ten year period to assess the continued relevance to the BHA.

Where we process registration data electronically, we do this for as long as you hold a registration and for up to five years thereafter. We periodically review the electronic data we hold on you within the five years post expiry or termination of your registration to assess its continued relevance to the BHA.

We retain top level data recording your name and dates of registration indefinitely in order to keep a record of the sport.

Where we hold case files in relation to breaches of the Rules of Racing by registered, licensed or permitted personnel, we hold these for the period of the investigation plus twenty years from the date that the investigation is closed or for as long as you hold a licence, registration and/or permit (whichever the longer) so that we maintain adequate records in the event that you return to horseracing in the same or another registered or  licensed profession or otherwise remain a person of interest under the Rules of Racing, by remaining connected to other licensed personnel. In exceptional circumstances, we may retain case files for a longer period where the requirement for retention outweighs the requirement for deletion.

We publish decisions and written reasons of our Judicial Panel on our website – these remain for seven years from the date of the decision, or in the case of sanctions lasting longer than seven years, for as long as the sanction is in place.  We retain the decisions and written reasons of the Judicial Panel internally for a period of twenty years following the expiry of the period of the sanction. If you are still a registered stable employee at this point, we may retain the Judicial Panel decision for as long as you remain registered by the BHA.

Summary of how we use your data

• The British Horseracing Authority uses the data you provide in the licence application form and that you might provide at other occasions during the term of your licence to administer your licence application and regulate and administer horseracing in Great Britain.
• The British Horseracing Authority asks you to provide information in relation to your unspent criminal records history.  This information will be processed to ensure the integrity of the sport, and we will be entitled to retain this information for this purpose.
• The British Horseracing Authority may also gather information about you from third party sources, particularly in relation to our integrity activities.   More details on the information we collect from third party sources such as the public, the media and publicly available information, BHA and racecourse officials, the press and bookmakers are set out in the Integrity Privacy Notice, available on the BHA website.

• The British Horseracing Authority may collect and share information relating to you with foreign racing authorities in relation to your licensing history. Some of these authorities may be located outside of the European Economic Area. We may also share information we receive from or about you with other third parties as set out in more detail below.

What does this policy cover?

This policy describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it by and about riders’ agents, particularly as part of the licence application process.  It does not describe the processing carried out by the BHA in relation to its integrity activities, which are covered in the Integrity Privacy Notice, available on the BHA website.

This policy also describes your data protection rights, including a right to object to some of the processing which the BHA carries out.  More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information do we collect?

We collect and process personal data about you when you complete your initial licence application and subsequent renewals or as otherwise provided to us during the course of your licence.  This includes all the information you provide to us in the application forms and any further information submitted alongside the form.

We may also generate information about you in order to help you complete your applications and help regulate and manage horseracing and ensure your welfare.  In particular, we may hold and use information on whether you need particular assistance with completing your applications.

What information do we receive from third parties?

Sometimes, we receive information about you from third parties.  In particular:

• we receive information about you from training providers in relation to the riders that you represent and any safeguarding concerns or investigations about you;
• we may receive information about you from Racing Welfare in relation to any safeguarding concerns or investigations about you;
• we may receive information about you from our member organisations in relation to any safeguarding concerns or investigations about you;

• we may seek information about you and your suitability and requirements for a licence from publicly available sources, such as through internet searches and director checks;
• we may collect some information for integrity purposes from a variety of sources such as the public, the media and publicly available information, the press, bookmakers and stewards– this is discussed in more detail in the Integrity Privacy Notice;
• we may receive information about you from foreign racing authorities in relation to your licensing and registration history and conduct;
• we may receive information about you from other licensed, registered or permitted personnel;
• we may receive information about your performance and conduct from racecourses and BHA and racecourse officials.

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:

• As required by the BHA to conduct our business and pursue our legitimate interests, in particular:
  • we will use your information to process your application for a new or renewed licence and ensure your suitability in accordance with  measures we take to ensure the integrity of the sport;
  • we use your criminal records data, provided as part of the licence application, to ensure the integrity of the sport;
  • we will contact you in relation to any rules or other information you may require as a licensed riders’ agent;
  • we will maintain records of horseracing results and share results with third party publishers of results;
  • we will monitor compliance with the Rules of Racing to ensure that breaches of the Rules are upheld and sanctioned (for more details, see our Integrity Privacy Notice);
  • we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation).
• Where you give your consent:
  • in other circumstances where we rely on your consent, and have explained the use of data at that time, including email marketing as set out in the riders’ agent licence application.
• For purposes which are required by law:
  • in response to requests by government or law enforcement authorities conducting an investigation, including the Gambling Commission.

Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above.  You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.

Withdrawing consent or objecting to direct marketing

Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes.  You have an absolute right to opt- out of direct marketing, or profiling we carry out for direct marketing, at any time.  You can do this by following the instructions in the communication where this is an electronic marketing message, or by contacting us using the details set out below.

Who will we share this data with, where and when?

We will share your information with foreign racing authorities when you wish to participate in horseracing in a different jurisdiction or in order that they may contact you to request your assistance in an investigation.  Some of these authorities may be located outside of the European Economic Area.

We will share your information with Weatherbys Limited, our data processor, who administer our racing database and provide racing related services to the BHA.

We will share your information with Racing Digital Limited, our data processor, who are developing a racing administration system for the sport of horseracing.

We will share your contact details with third parties regarding the jockeys that you represent and with jockeys that would like you to represent them.

We will share your information with the training providers in relation to the training and performance of the jockeys that you represent and any safeguarding concerns or investigations we may have about you.

We will share your information with Racing Welfare in relation to any safeguarding concerns or investigations.

We will share your information with our member organisations in relation any safeguarding concerns or investigations.

We will share limited information with other licensed, permitted or registered personnel in relation to your standing as a rider’s agent.

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

Personal data will also be shared with third party service providers, who will process it on behalf of the BHA for the purposes identified above.  Such third parties include providers of website and system hosting for our licensing teams.

Where information is transferred outside the UK, and where this is to a stakeholder or vendor in a country that is not subject to UK adequacy regulations, data is adequately protected using appropriate safeguards. A copy of the relevant mechanism can be provided for your review on request to the BHA Head of Legal and Governance. In other circumstances, we might ask for your consent to share this data, where you have requested that we provide it to a foreign racing authority.

What rights do I have?

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format and to ask us to share (port) this data to another controller.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.  Relevant exemptions are included in both the UK GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to the Information Commissioner’s Office.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data.  If you have any concerns about how we process your data, or would like to opt out of direct marketing, you can get in touch at [email protected].

How long will you retain my data?

Where we process paper versions of licence data, we do this for up to ten years from the date of the relevant document. We periodically review paper versions of hard copy data we hold on you within such ten year period to assess the continued relevance to the BHA.

Where we process licence data electronically, we do this for as long as you hold a rider’s agent licence and for up to ten years thereafter. We periodically review the electronic data we hold on you within the ten years post expiry or termination of your licence to assess its continued relevance to the BHA.

We retain top level data recording your name and dates of licence indefinitely in order to keep a record of the sport.

Where we maintain records of racing results, we hold this information indefinitely in order to keep a record of the sport.

Where we hold case files in relation to breaches of the Rules of Racing by registered, licensed or permitted personnel, we hold these for the period of the investigation plus twenty years from the date that the investigation is closed or for as long as you hold a licence, registration and/or permit (whichever the longer) so that we maintain adequate records in the event that you return to horseracing in the same or another registered or  licensed profession or otherwise remain a person of interest under the Rules of Racing, by remaining connected to other licensed personnel. In exceptional circumstances, we may retain case files for a longer period where the requirement for retention outweighs the requirement for deletion.

We publish decisions and written reasons of our Judicial Panel on our website – these remain for seven years from the date of the decision, or in the case of sanctions lasting longer than seven years, for as long as the sanction is in place.  We retain the decisions and written reasons of the Judicial Panel internally for a period of twenty years following the expiry of the period of the sanction. If you are still a licensed riders’ agent at this point, we may retain the Judicial Panel decision for as long as you remain licensed by the BHA.

Summary of how we use your data

• The British Horseracing Authority uses the data you provide in the licence application form and any attachments and that you might provide at other occasions during your licence such as in response to enquiries to administer your licence application, administer and regulate horseracing in Great Britain and to ensure the safety and welfare of horses.
• The British Horseracing Authority may also gather information about you from third party sources, particularly in relation to our integrity activities. More details on the information we collect from third party sources such as the public, the media and publicly available information, BHA and racecourse officials, the press and bookmakers are set out in the Integrity Privacy Notice, available on the BHA website.
• The British Horseracing Authority asks you to provide information in relation to your unspent criminal records history. This information will be processed to ensure the integrity of the sport, and we will be entitled to retain this information for this purpose.
• The British Horseracing Authority may share information relating to you with foreign racing authorities in relation to your licence history. Some of these authorities may be located outside of the European Economic Area. We may also share information we receive from or about you with other third parties as set out in more detail below.

What does this policy cover?

This policy describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it by and about valets as part of the licence application process and generally throughout the term of your licence. It does not describe the processing carried out by the BHA in relation to its integrity activities, which are covered in the Integrity Privacy Notice, available on the BHA website.

This policy also describes your data protection rights, including a right to object to some of the processing which the BHA carries out. More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information do we collect?

We collect and process personal data about you when you complete your initial licence application and subsequent renewals or as otherwise provided to us during the course of your licence.  This includes all the information you provide to us in the application forms and in any attachments submitted alongside the form.

What information do we receive from third parties?

Sometimes, we receive information about you from third parties. In particular:

• we may receive information about you from foreign racing authorities in relation to your licensing history and conduct;
• we may receive information about you from our member organisations in relation to any safeguarding concerns or investigations;
• we may receive information about you from Racing Welfare in relation to any safeguarding concerns or investigations;
• we may receive information about you from other licensed, registered or permitted personnel;
• we may seek information about you and your suitability and requirements for a licence from publicly available sources, such as through internet searches and director checks;
• we may receive information about your performance and conduct from racecourses and BHA and racecourse officials;
• we may collect some information for integrity purposes from a variety of sources such as the public, the media and publicly available information, the press, bookmakers and the stewards– this is discussed in more detail in the Integrity Privacy Notice.

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:

• As required by the BHA to conduct our business and pursue our legitimate interests, in particular:
  • we will use your information to process your application for a new or renewed licence and ensure your suitability and requirements for licensing in accordance with  measures we take to ensure the integrity of the sport;
  • we use your criminal records data, provided as part of the licence application, to ensure the integrity of the sport;
  • we will contact you in relation to any rules or other information you may require as a licensed valet;
  • we will monitor compliance with the Rules of Racing to ensure that breaches of the Rules are upheld and sanctioned (for more details, see our Integrity Privacy Notice);
  • we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation).

• Where you give your consent:
  • in other circumstances where we rely on your consent and have explained the use of data at that time.

• For purposes which are required by law:
  • in response to requests by government or law enforcement authorities conducting an investigation, including the Gambling Commission.

Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above.  You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.

Withdrawing consent

Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes.

Who will we share this data with, where and when?

We will share your information with foreign racing authorities when you wish to participate in horseracing in a different jurisdiction.

We will share your information with Weatherbys Limited, our data processor, who administer our racing database and provide racing related services to the BHA.

We will share your information with Racing Digital Limited, our data processor, who are developing a racing administration system for the sport of horseracing.

We will share your information with Racing Welfare in relation to any safeguarding concerns or investigations.

We will share your information with our member organisations in relation to any safeguarding concerns or investigations.

We will share limited information with other licensed, permitted or registered personnel in relation to your standing as a valet.

We will share information with the RCA and/ or racecourses in relation to entries, including any integrity concerns.

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

Personal data will also be shared with third party service providers, who will process it on behalf of the BHA for the purposes identified above.  Such third parties include providers of website and system hosting for our licensing teams.

Where information is transferred outside the UK, and where this is to a stakeholder or vendor in a country that is not subject to UK adequacy regulations, data is adequately protected using appropriate safeguards. A copy of the relevant mechanism can be provided for your review on request to the BHA Head of Legal and Governance. In other circumstances, we might ask for your consent to share this data, where you have requested that we provide it to a foreign racing authority.

What rights do I have?

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format and to ask us to share (port) this data to another controller.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.  Relevant exemptions are included in both the UK GDPR and in the Data Protection Act 2018.  We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to the Information Commissioner’s Office.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data.  If you have any concerns about how we process your data, you can get in touch at [email protected].

How long will you retain my data?

Where we process paper versions of licence data, we do this for up to ten years from the date of the relevant document. We periodically review paper versions of hard copy data we hold on you within such ten year period to assess the continued relevance to the BHA.

Where we process licence data electronically, we do this for as long as you hold a valet’s licence and for up to ten years thereafter. We periodically review the electronic data we hold on you within the ten years post expiry or termination of your licence to assess its continued relevance to the BHA.

We retain top level data recording your name and dates of licence indefinitely in order to keep a record of the sport.

Where we maintain records of racing results, we hold this information indefinitely in order to keep a record of the sport.

Where we hold case files in relation to breaches of the Rules of Racing by registered, licensed or permitted personnel, we hold these for the period of the investigation plus twenty years from the date that the investigation is closed or for as long as you hold a licence, registration and/or permit (whichever the longer) so that we maintain adequate records in the event that you return to horseracing in the same or another registered or  licensed profession or otherwise remain a person of interest under the Rules of Racing, by remaining connected to other licensed personnel. In exceptional circumstances, we may retain case files for a longer period where the requirement for retention outweighs the requirement for deletion.

We publish decisions and written reasons of our Judicial Panel on our website – these remain for seven years from the date of the decision, or in the case of sanctions lasting longer than seven years, for as long as the sanction is in place.  We retain the decisions and written reasons of the Judicial Panel internally for a period of twenty years following the expiry of the period of the sanction. If you are still a licensed valet at this point, we may retain the Judicial Panel decision for as long as you remain licensed by the BHA.

Summary of how we use your data

• The British Horseracing Authority uses the data you provide in the licence application form and any attachments, and that you might provide at other occasions, such as during an equine swimming pool inspection or in response to enquiries, to administer your licence application, administer and regulate horseracing in Great Britain and to ensure the safety and welfare of the horses using your facility.
• The British Horseracing Authority may also gather information about you from third party sources, particularly in relation to our integrity activities.  More details on the information we collect from third party sources such as the public, the media and publicly available information, BHA and racecourse officials, the press and bookmakers are set out in the BHA’s Integrity Privacy Notice, available on the BHA website.
• The British Horseracing Authority may share information relating to you with foreign racing authorities in relation to your licensing history. Some of these authorities may be located outside of the European Economic Area.  We may also share information we receive from or about you with other third parties as set out in more detail below.

What does this policy cover?

This policy describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it by and about equine swimming pools as part of the licence application process and, more generally, during the term of your licence.  It does not describe the processing carried out by the BHA in relation to its integrity activities, which are covered in the Integrity Privacy Notice, available on the BHA website.

This policy also describes your data protection rights, including a right to object to some of the processing which the BHA carries out.  More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information do we collect?

We collect and process personal data about you when you complete your initial licence application and subsequent renewals and at other occasions, such as during an equine swimming pool inspection or in response to enquiries.  This includes all the information you provide to us in the application forms and in any attachments submitted alongside the form.

What information do we receive from third parties?

Sometimes, we receive information about you from third parties. In particular:

• we may receive information about you from foreign racing authorities in relation to your licensing history and conduct;
• we may receive information about you from other licensed, registered or permitted personnel;
• we may seek information about you and your suitability and requirements for licensing from publicly available sources, such as through internet searches and director checks;
• we may receive information about your performance and conduct from racecourses and BHA and racecourse officials;
• we may collect some information for integrity purposes from a variety of sources such as the public, the media and publicly available information, the press, bookmakers and the stewards– this is discussed in more detail in the Integrity Privacy Notice.

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:

• As required by the BHA to conduct our business and pursue our legitimate interests, in particular:
  • we will use your information to process your application for a new or renewed  licence and ensure your suitability and requirements for licensing in accordance with  measures we take to ensure the integrity of the sport;
  • we will contact you in relation to any rules or other information you may require as a licensed equine swimming pool;
  • we will monitor compliance with the Rules of Racing to ensure that breaches of the Rules are upheld and sanctioned (for more details, see our Integrity Privacy Notice);
  • we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation).

• Where you give your consent:
  • in other circumstances where we rely on your consent and have explained the use of data at that time such as where you consent to the BHA publishing your contact details on the BHA website.

• For purposes which are required by law:
  • in response to requests by government or law enforcement authorities conducting an investigation, including the Gambling Commission. 

Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above. You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.

Withdrawing consent

Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes.

Who will we share this data with, where and when?

We will share your information with foreign racing authorities when you wish to participate in horseracing in a different jurisdiction.

We will share your information with Weatherbys Limited, our data processor, who administer our racing database and provide racing related services to the BHA.

We will share your information with Racing Digital Limited, our data processor, who are developing a racing administration system for the sport of horseracing.

We will share limited information with other licensed, permitted or registered personnel in relation to your standing as an equine swimming pool.

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

Personal data will also be shared with third party service providers, who will process it on behalf of the BHA for the purposes identified above.  Such third parties include providers of website and system hosting for our licensing teams.

Where information is transferred outside the UK, and where this is to a stakeholder or vendor in a country that is not subject to UK adequacy regulations, data is adequately protected using appropriate safeguards. A copy of the relevant mechanism can be provided for your review on request to the BHA Head of Legal and Governance. In other circumstances, we might ask for your consent to share this data, where you have requested that we provide it to a foreign racing authority.

What rights do I have?

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format and to ask us to share (port) this data to another controller.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.  Relevant exemptions are included in both the UK GDPR and in the Data Protection Act 2018.  We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to the Information Commissioner’s Office.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data.  If you have any concerns about how we process your data, you can get in touch at [email protected].

How long will you retain my data?

Where we process paper versions of licence data and equine swimming pool inspection reports, we do this for up to ten years from the date of the relevant document. We periodically review paper versions of hard copy data we hold on you within such ten year period to assess the continued relevance to the BHA.

Where we process licence data and equine swimming pool inspection report data electronically, we do this for as long as you hold a licence and for up to ten years thereafter. We periodically review the electronic data we hold on you within the ten years post expiry or termination of your licence to assess its continued relevance to the BHA.

We retain top level data recording your name and dates of licence indefinitely in order to keep a record of the sport.

Where we hold case files in relation to breaches of the Rules of Racing by registered, licensed or permitted personnel, we hold these for the period of the investigation plus twenty years from the date that the investigation is closed or for as long as you hold a licence, registration and/or permit (whichever the longer) so that we maintain adequate records in the event that you return to horseracing in the same or another registered or  licensed profession or otherwise remain a person of interest under the Rules of Racing, by remaining connected to other licensed personnel.. In exceptional circumstances, we may retain case files for a longer period where the requirement for retention outweighs the requirement for deletion.

We publish decisions and written reasons of our Judicial Panel on our website – these remain for seven years from the date of the decision, or in the case of sanctions lasting longer than seven years, for as long as the sanction is in place.  We retain the decisions and written reasons of the Judicial Panel internally for a period of twenty years following the expiry of the period of the sanction. If you are still a licensed equine swimming pool at this point, we may retain the Judicial Panel decision for as long as you remain licensed by the BHA.

Summary of how we use your data

• The British Horseracing Authority (“BHA”) uses the data you provide in this form in order to carry out a suitability assessment on all individuals holding key roles within a racecourse business (“Relevant Persons”, as defined in the Applications for a Racecourse Licence Suitability Policy) to administer and regulate horseracing in Great Britain.
• The British Horseracing Authority may also gather information about you from third party sources, particularly in relation to our integrity activities. More details on the information we collect from third party sources such as the public, the media and publicly available information, BHA and racecourse officials, the press and bookmakers are set out in the Integrity Privacy Notice (available on the BHA website).
• The British Horseracing Authority asks you to provide information in relation to your unspent criminal records history. This information will be processed to ensure the integrity of the sport, and we will be entitled to retain this information for this purpose.

What does this policy cover?

This policy describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it by and about Relevant Persons, particularly as part of the racecourse licence application process. It does not describe the processing carried out by the BHA in relation to its integrity activities, which are covered in the Integrity Privacy Notice (available on the BHA website).

This policy also describes your data protection rights, including a right to object to some of the processing which the BHA carries out.  More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section. Defined terms used in this Policy reflect those used in the BHA’s Applications for a Racecourse Licence Suitability Policy.

What information do we collect from you?

We collect and process personal data about you via the Applications for a Racecourse Licence Suitability Questions and from information contained within public registers, for example, records held by Companies House and the Insolvency Register, or from information available publicly and from other regulatory bodies or statutory agencies. This includes all the information you provide to us in the racecourse licence application form (e.g. name, contact details etc.) and any attachments submitted alongside the form.

What information do we receive from third parties?

Sometimes, we receive information about you from third parties. In particular:

• we may receive information about you from our member organisations in relation to any safeguarding concerns or investigations;
• we may receive information about you from Racing Welfare in relation to any safeguarding concerns or investigations;
• we may receive information about you from other licensed, registered or permitted personnel;
• we may seek information about you and your suitability and requirements for licensing or permit from publicly available sources, such as through internet searches and director checks;
• we may receive information about your performance and conduct from racecourses and BHA and racecourse officials;
• we may collect some information for integrity purposes from a variety of sources such as the public, the media and publicly available information, the press, bookmakers and the stewards– this is discussed in more detail in the Integrity Privacy Notice (available on the BHA website).

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:

• As required by the BHA to conduct our business and pursue our legitimate interests, where your interests and fundamental rights do not override those interests, in particular:
  • we will use your information to conduct your suitability assessment and any requirements for licensing in accordance with measures we take to ensure the integrity of the sport;
  • we use your criminal records data, provided as part of the racecourse licence or permit application, to ensure the integrity of the sport;
  • we will use your information to respond to any comments or complaints you may send us;
  • we will contact you in relation to any rules or other information you may require in your role as a Relevant Person;
  • we will monitor compliance with the Rules of Racing to ensure that breaches of the Rules are upheld and sanctioned (for more details, see our Integrity Privacy Notice);
  • we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation).

• For purposes which are required by law:
  • in response to requests by government or law enforcement authorities conducting an investigation, or in accordance with our statutory duties, including sharing information with the Gambling Commission and/or the police.
• We may also use your personal data in other ways and will provide specific notice at the time of collection and obtain your consent where necessary.

Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above.  You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.

Who will we share this data with, where and when?

We will share information with your employer racecourse and/or the Racecourse Association in relation to any integrity concerns.

We will share your information with Racing Welfare in relation to any safeguarding concerns or investigations.

We will share your information with our member organisations in relation to any safeguarding concerns or investigations.

We will share your information with Weatherbys Limited, our data processor, who administer our racing database and provide racing related services to the BHA.

We will share limited information with other licensed, permitted or registered personnel in relation to your standing as a Relevant Person.

Personal data may be shared with government authorities and/or law enforcement officials if required for the purposes above, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws.

Personal data will also be shared with third party service providers, who will process it on behalf of the BHA for the purposes identified above.  Such third parties include providers of website and system hosting for our licensing teams.

Where information is transferred outside the EEA, and where this is to a stakeholder or vendor in a country that is not subject to an adequacy decision by the EU Commission, data is adequately protected by EU Commission approved standard contractual clauses, an appropriate Privacy Shield certification or a vendor’s Processor Binding Corporate Rules.  A copy of the relevant mechanism can be provided for your review on request.

What rights do I have?

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format and to ask us to share (port) this data to another controller.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.  Relevant exemptions are included in both the GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to an EU data protection authority where you live, work or where you believe a breach may have occurred.  This is likely to be the Information Commissioner’s Office in the UK.

For the purposes of the Relevant Person suitability test, the provision of information is mandatory: if relevant data is not provided, then we will not be able to process the test and you will not be able to hold the Relevant Position.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy queries you may have about the way we process your data.  If you have any concerns about how we process your data, you can get in touch at [email protected].

How long will you retain my data?

Where we process licence application data, we do this for as long as you hold a Relevant Position and for ten years after this.

Where we hold case files in relation to breaches of the Rules of Racing by registered, licensed or permitted personnel or entities, we hold these for ten years following the date of the hearing or, if there is no hearing, for ten years from the date that the investigation is passed over from the BHA Integrity Team to the BHA Regulatory Team.  In exceptional circumstances, we may retain case files for a longer period where the requirement for retention outweighs the requirement for deletion.

We publish decisions of our Judicial Panel on our website- these remain for seven years from the date of the decision, or in the case of disqualifications lasting longer than seven years, for as long as the disqualification is in place.  We retain the written reasons of the Judicial Panel and top level details of the decision indefinitely in order to keep a record of the sport.

What does this policy cover?

This policy describes how the British Horseracing Authority Limited (also referred to as “the BHA”, “we” or “us”) will make use of data provided to it by and about you as an unregulated person (an individual who is not licensed, registered or permitted by the BHA) in relation to its integrity and safeguarding processes.

This policy also describes your data protection rights, including a right to object to some of the processing the BHA carries out.  More information about your rights, and how to exercise them, is set out in the “What rights do I have?” section.

What information do we collect from you?

We collect and process personal data about you when you are subject to, or involved in, an investigation by the BHA Integrity Team. Information may be provided directly to the BHA in response to requests for representations, or where you make a communication about a matter that requires investigation. Information may also be obtained from third parties regarding alleged behaviour that raises integrity and/or safeguarding concerns that involve you or in relation to which you might hold relevant information.

We may also collect and process personal data about you when you provide information pursuant to a production order (a request for information) from the BHA. If this is relevant to you, you will receive details relating to the specific information requested from you separately.

What information do we receive from third parties?

Sometimes, we receive information about you from third parties. In particular:

• we may receive information about potential incidents or concerns from members of the public through our RaceWISE hotline or a member of the public otherwise assisting in an integrity and/or safeguarding investigation;
• we may receive information about you from Racing Welfare, the British Racing School, the National Horseracing College, or the Scottish Racing Academy in relation to any safeguarding concerns/ investigations;
• we may receive information about you from our member organisations in relation to any safeguarding and/or integrity concerns/ investigations;
• we may receive information about you from foreign racing authorities in relation to relevant integrity and/or safeguarding matters;
• we may receive information about you from our licensed, permitted or registered personnel;
• we may collect information about you from publicly available sources such as the media and the internet;
• we may receive information about your integrity and discipline from racecourses and BHA and racecourse stewards, and in particular we may receive CCTV footage from racecourses;
• we may also receive information about you from sources such as the press, bookmakers and surveillance suppliers, in relation to any relevant integrity and/or safeguarding matters.

The information we receive from third parties usually includes information relating to your integrity, performance or actions or other corrupt practices, such as bets you have made or are planning to make, performances you have or will be involved in, or individuals you have been associating with.  It may, occasionally, include sensitive data such as information about criminal offences you are alleged to have committed or convictions that you have.

How do we use this information, and what is the legal basis for this use?

We process this personal data for the following purposes:

• As required by the BHA to conduct our business and pursue our legitimate interests, in particular:
  • we will use your information to maintain intelligence and take any enforcement action as required under the Rules of Racing in order to maintain the integrity of the sport.  Where this involves your sensitive data or criminal records data, this is also done on the basis of the BHA’s commitment to protect the integrity of horseracing.  We may also process such data to prevent or detect unlawful acts;
  • we will contact you in relation to any questions we may have in relation to your conduct or the conduct of others;
  • we will maintain records of our actions in the course of investigating, maintaining intelligence and enforcing the Rules of Racing;
  • we will use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation), such as maintaining intelligence on particular individuals of interest.
• For purposes which are required by law:
  • in response to requests by government or law enforcement authorities conducting an investigation, or in accordance with our statutory duties, including sharing information with the Gambling Commission and/or the police.

Any information you provide to the BHA will be recorded and may be used in BHA disciplinary proceedings involving you or other people. Please be aware that if the information you provide is used in disciplinary proceedings involving others, it may be shared with such parties, their legal representatives, professional advisers and the BHA’s independent Judicial Panel as necessary for the performance of the BHA’s disciplinary and/or licensing functions.

Relying on our legitimate interests

We have carried out balancing tests for all the data processing we carry out on the basis of our legitimate interests, which we have described above.  You can obtain information on any of our balancing tests by contacting us using the details set out later in this notice.

Who will we share this data with, where and when?

Where you are subject to an exclusion order we will publish your name, together with certain address details (your town/city, county and partial postcode) on the BHA website.

We will share information with the Gambling Commission and other relevant statutory bodies, bookmakers and/or the police where this is an appropriate course of action to help enforce the Rules of Racing or ensure that appropriate action is taken by a third party, if mandated by law or if required for the legal protection of our legitimate interests in compliance with applicable laws as set out above.

We will share your information with Clue Computing Co. Ltd (Clue), our data processor, which provides investigation and intelligence management software and occasionally provide maintenance and support services for such software. Information is also shared with other third-party service providers who provide services relevant to the purposes described above.

We may share your information with Racing Welfare in relation to any safeguarding concerns or investigations.

We will share your information with our member organisations and/or racing participants in relation to any integrity and/or safeguarding threats or concerns.

We will share your information with the RSPCA in relation to any animal welfare concerns.

We will share your information with the Racecourse Association and/or individual racecourses where you have been excluded from racing in order to enforce access controls.

Where your information is used in regulatory proceedings, it will be shared with the BHA’s independent Judicial Panel.

Where information is transferred outside the UK, and where this is to a stakeholder or vendor in a country that is not subject to UK adequacy regulations, data is adequately protected using appropriate safeguards. A copy of the relevant mechanism can be provided for your review on request to the BHA Head of Legal and Governance. In other circumstances, we might ask for your consent to share this data, where you have requested that we provide it to a foreign racing authority.

What rights do I have?

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine-readable format and to ask us to share (port) this data to another controller.

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where they would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.  Relevant exemptions are included in both the UK GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us – or our data protection officer – using the details set out below. If you have unresolved concerns, you have the right to complain to the Information Commissioner’s Office.

How do I get in touch with you, or your data protection officer?

We hope that we can satisfy any queries you may have about the way we process your data.  If you have any concerns about how we process your data, you can get in touch at [email protected].

How long will you retain my data?

We retain intelligence data for a period of seven years from the date of collection, unless such data forms part of a case file (see below). Intelligence data will be reviewed after 3 years to consider if there is a need to retain the data for the full seven-year period.

We retain investigations data and case files, which may contain information relating to unregulated individuals (produced where an investigation leads to a charge) for the period of the investigation plus twenty years from the date that the investigation is closed or for as long as the relevant individual holds a licence, registration and/or permit (whichever the longer). Case files may be retained for a longer period where the requirement for retention outweighs the requirement for deletion.

We retain information received pursuant to a production order request in line with our retention periods for case files (as above) in relation to breaches of the Rules of Racing by registered, licensed or permitted personnel.