ESKA – Norfolk's Premier Karate Club

Privacy Notice

Organisation: ESKA Norfolk LLP

Date: 11/09/2026

Review Date: 10/09/2027

Introduction

ESKA Norfolk LLP (“ESKA”, “we”, “us”, “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Notice explains how we collect, use, store, share and protect personal data when you:

visit our website;

enquire about or join ESKA;

attend classes, gradings, competitions, events, courses or other activities;

purchase products or services from us;

volunteer or work with us; or

otherwise interact with ESKA.

Who We Are

Controller: ESKA Norfolk LLP

Address: The Dojo Norwich, 3 Burton Road, Norwich, NR6 6AX

Email: office@eska.co.uk

Telephone: 01603 418751

Website: https://eska.co.uk

For most membership, participation, administration, safeguarding and event-related processing, ESKA Norfolk LLP is the data controller.

What Personal Data We Collect

Depending on how you interact with ESKA, we may collect and use the following categories of personal data.

3.1 Identity and Contact Data

This may include:

name;

title;

date of birth;

address;

email address;

telephone number;

emergency contact details;

parent/carer details where relevant.

3.2 Membership and Participation Data

This may include:

class bookings;

attendance records;

membership status;

grading history;

competition or event entries;

training and participation records;

communications relating to participation.

3.3 Transaction and Payment Data

This may include:

billing information;

payment history;

membership fee records;

product or service purchase details;

invoice and account information.

Payment card and bank details may also be processed by our payment providers where necessary to take or manage payments.

3.4 Technical and Website Usage Data

If you use our website or digital systems, we may collect:

IP address;

browser and device information;

website usage data;

cookie-related data;

account or login information where relevant.

3.5 Communications Data

This may include:

emails;

messages;

enquiry forms;

customer support communications;

forms and other correspondence.

3.6 Safeguarding and Incident Data

Where relevant, we may process:

safeguarding concern records;

incident and accident reports;

disclosure records;

conduct concerns;

low-level concerns;

complaint or disciplinary records.

3.7 Health and Medical Data

Where necessary for safe participation, we may process limited health or medical information, for example:

allergies;

asthma;

diabetes;

epilepsy;

injuries;

disabilities or additional needs;

medical conditions relevant to participation or emergencies;

emergency medication or treatment information.

3.8 Photo, Video and Consent Data

Where relevant, we may process:

photo and video consent choices;

images or recordings taken for approved club purposes;

records of consent being granted or withdrawn;

other activity-specific consent forms, such as lift-sharing consent forms.

3.9 DBS and Suitability Information

Where relevant to a role within ESKA, we may process information relating to Disclosure and Barring Service (DBS) checks and other suitability checks.

This may include:

whether a DBS check has been completed;

the type and level of check;

certificate details necessary for verification;

DBS Update Service status;

barred-list information where applicable;

the outcome of suitability checks.

ESKA will only process criminal offence information where there is a lawful basis and an appropriate condition under applicable data protection law.

Access to this information is restricted and ESKA will only retain the minimum information necessary for the relevant purpose.

Children’s Data

ESKA works with children and young people as part of its ordinary club activities, so we do process children’s personal data where necessary for membership, participation, safeguarding, communication and administration.

Where appropriate, ESKA will collect information from a parent or carer.

We will also seek to provide relevant privacy information to children and young people in a clear and age-appropriate way where necessary.

Special Category Data and Sensitive Information

Some types of personal data need additional protection.

For ESKA, this may include:

health or medical information;

disability-related information needed for access, safety or reasonable adjustments;

safeguarding-related information which includes special category data;

in some cases, information revealing protected characteristics where this arises in safeguarding, complaints or inclusion contexts.

We will only process this type of information where it is necessary, appropriate and lawful.

Where we process special category personal data, such as health, disability or certain safeguarding information, we will identify both:

an appropriate lawful basis under Article 6 UK GDPR; and

an appropriate condition under Article 9 UK GDPR and the Data Protection Act 2018 where applicable.

Criminal offence information, including certain information arising from DBS checks, is subject to separate legal requirements and will only be processed where ESKA has an appropriate lawful basis and condition for doing so.

How We Collect Your Personal Data

We may collect personal data:

directly from you;

from a parent or carer;

through membership or registration forms;

through enquiries and communications;

through bookings, purchases and participation records;

through incident, safeguarding or complaint reporting;

through website and digital systems;

from third parties where relevant, for example payment providers, event organisers, governing bodies or statutory agencies.

Why We Use Your Personal Data

We use personal data only where we have a lawful basis to do so.

Depending on the situation, those lawful bases may include:

Contract, where processing is necessary to provide membership, classes, events, gradings or other services.

Legitimate interests, where processing is necessary for ESKA’s legitimate interests in running the club, maintaining appropriate records, communicating with members, improving services, protecting participants and managing concerns, provided those interests are not overridden by your rights and interests.

Legal obligation, where processing is necessary to comply with legal, regulatory, safeguarding, health and safety, accounting or other statutory obligations.

Vital interests, where processing is necessary to protect someone’s life or in a medical emergency.

Consent, where we rely on consent for specific activities, such as certain marketing communications and certain uses of photography and video.

Where we process special category data or criminal offence data, we will also rely on any additional lawful condition required by applicable data protection law.

Purposes for Which We Use Personal Data

We may use personal data:

to respond to enquiries;

to administer membership and participation;

to manage classes, gradings, events and competitions;

to manage licences, affiliations and related governing body requirements;

to process payments and maintain financial records;

to issue invoices, send payment reminders and deal with payment queries;

to communicate with members, parents/carers, volunteers and staff;

to manage health and safety, first aid and emergency response;

to provide appropriate support, access arrangements and reasonable adjustments;

to manage safeguarding, welfare, incident, complaint, grievance, disciplinary and conduct matters;

to assess the suitability of staff, instructors and volunteers where relevant;

to maintain records and governance processes;

to operate the website and digital systems;

to use photography or video for approved purposes where lawful;

to send marketing communications where permitted;

to comply with legal and regulatory obligations;

to establish, exercise or defend legal claims where necessary.

Club Systems and Service Providers

ESKA uses third-party service providers to help operate the club.

These currently include:

ClubManager, as the club management platform provider;

Stripe, for payment processing;

GoCardless, for payment processing;

Xero, for invoicing, bookkeeping, payment reminders and occasional customer statements relating to payment queries.

We may also use other IT, communication, professional and administrative service providers where necessary for the operation of ESKA.

These providers may process personal data on ESKA’s behalf or act as independent controllers in relation to certain aspects of their services.

Where a provider processes personal data on our behalf, we expect appropriate contractual and security arrangements to be in place.

Marketing

We may send marketing or promotional communications by email, text or other electronic messaging where:

you have consented to receive them; or

we are otherwise permitted to do so under applicable data protection and electronic communications law.

Where legally permitted, this may include communications to existing customers about similar ESKA products, services, events or activities.

You can opt out of marketing communications at any time by:

using the unsubscribe option provided where available; or

contacting us at office@eska.co.uk.

Where we rely on your consent for marketing, you may withdraw that consent at any time.

Essential service communications relating to membership, classes, bookings, safety, safeguarding, licences, payments or other administrative matters are not the same as marketing and may still be sent where necessary.

Photography, Video and Media

Where ESKA uses photography or video, this will be managed in line with ESKA’s Digital and Media Safety arrangements and any consent processes in place.

This may include:

obtaining consent where required;

recording relevant consent choices;

limiting who may capture images;

restricting use to approved purposes;

removing media from future use where consent is withdrawn, where appropriate.

Withdrawal of consent does not necessarily require ESKA to recall or remove material that has already been lawfully published or distributed where this is not reasonably possible, but we will take appropriate steps in relation to future use.

Who We Share Personal Data With

We may share personal data where necessary with:

authorised staff, instructors and personnel within ESKA on a need-to-know basis;

ClubManager;

Stripe;

GoCardless;

Xero, where necessary for invoicing, bookkeeping, payment reminders and occasional customer statements;

TSKUK, for members where this is necessary for licensing, affiliation, governance and related club activity;

DBS processing or identity verification providers where relevant;

insurers, advisers, accountants or professional service providers where required;

schools, venues or event organisers where necessary for a particular activity and where there is an appropriate lawful basis;

statutory agencies such as the Police, Children’s Services, CADS, Adult Social Services, LADO or the DBS where relevant;

regulators, courts or law enforcement where required.

We only share personal data where there is a lawful and appropriate reason to do so and will seek to share only the information that is necessary for the purpose.

Safeguarding Information Sharing

Where there is a safeguarding concern, ESKA may need to share information without consent where necessary to protect a child, an adult at risk or another person, or where required or permitted by law.

Safeguarding records are handled separately from general club records and are shared only on a need-to-know basis.

The welfare and safety of children and adults at risk will be an important consideration when deciding whether information should be shared.

CCTV

CCTV operates at The Dojo Norwich for safety, security, incident management and the protection of people and property.

CCTV footage from The Dojo Norwich will normally be retained for 30 days, unless it is required for an incident, investigation, safeguarding concern, crime report, insurance matter or other legitimate reason.

Where footage is required for one of these purposes, it may be retained for longer until the relevant matter is concluded or there is no longer a lawful reason to retain it.

Other ESKA venues are hired externally and may operate their own CCTV systems and privacy arrangements. Those systems are not normally controlled by ESKA.

International Transfers

ESKA does not routinely transfer personal data outside the UK itself.

However, some service providers may process personal data outside the UK or use infrastructure that involves international transfers.

Where this happens, ESKA will ensure that appropriate safeguards are in place in accordance with applicable data protection law.

Data Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure or destruction.

These measures may include:

password protection and access controls;

restricted access based on role or need;

use of secure systems and storage;

separate safeguarding record storage;

limiting access to health, safeguarding and DBS information;

minimising storage on personal devices;

secure deletion and disposal practices;

appropriate backup and recovery arrangements;

staff awareness and data protection procedures.

Data Retention

We will keep personal data only for as long as necessary for the purposes for which it was collected, taking into account legal, safeguarding, accounting, insurance and operational requirements.

Our current retention periods include:

General enquiries where no membership is taken up: 12 months from the last meaningful contact.

Member and parent/carer account records: 6 years after membership ends.

Payment and accounting records: 6 years after the end of the relevant financial year.

Consent forms, including lift-sharing consent: while the arrangement is active, plus 24 months after it ends.

Low-level incidents with no ongoing concern: 6 years.

Safeguarding concerns and incidents: until the individual is 25 years old, or 7 years after the last report, whichever is longer.

Accident or incident records not forming part of a safeguarding record: retained for as long as necessary in line with ESKA’s health and safety and legal obligations, taking account of the nature of the incident and the age of the individual involved.

DBS and suitability records: retained only for as long as necessary in accordance with ESKA’s safeguarding, recruitment and DBS procedures. Copies of DBS certificates will not normally be retained longer than necessary for checking and verification.

Photo/video consent records: while relevant to current use and for a reasonable period afterwards to evidence consent history.

Images and video used for club purposes: reviewed periodically and deleted when no longer required or where consent is withdrawn, unless continued retention is justified by another lawful basis.

CCTV footage from The Dojo Norwich: normally 30 days unless required for an active matter.

Where a record is relevant to an ongoing safeguarding matter, complaint, disciplinary issue, insurance issue, investigation or legal claim, it may be retained for longer where reasonably necessary.

ESKA may periodically review and update its retention periods to reflect legal, regulatory or operational requirements.

Your Rights

Under data protection law, you may have rights including:

the right to be informed about how your personal data is used;

the right of access to personal data we hold about you;

the right to rectification of inaccurate or incomplete information;

the right to erasure in certain circumstances;

the right to restrict processing in certain circumstances;

the right to object to processing in certain circumstances;

the right to data portability in certain circumstances;

rights relating to automated decision-making and profiling where applicable;

where processing is based on consent, the right to withdraw your consent at any time.

These rights are not absolute and may be limited in some circumstances, particularly where information must be retained or processed for legal, safeguarding, public interest or other legitimate reasons.

Your Right to Object

Where we rely on legitimate interests as our lawful basis, you may have the right to object to our use of your personal data.

You also have the right to object to the use of your personal data for direct marketing at any time.

If you object to direct marketing, we will stop using your personal data for that purpose.

Automated Decision-Making

ESKA does not currently use solely automated decision-making or profiling that produces legal or similarly significant effects on individuals.

If this changes in the future, we will update this Privacy Notice and provide the information required by data protection law.

How to Exercise Your Rights

If you want to exercise any of your rights, please contact:

Privacy Contact: ESKA Norfolk LLP

Email: office@eska.co.uk

Address: The Dojo Norwich, 3 Burton Road, Norwich, NR6 6AX

We may need to verify your identity before responding to a request.

We will respond within the timescales required by applicable data protection law.

Complaints

If you have concerns about how we collect, use or protect your personal data, please contact ESKA first so we can try to resolve the issue.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection.

Information about making a complaint is available at:

www.ico.org.uk

Cookies and Website Analytics

ESKA’s website uses a cookie notice and consent system.

Where cookies or similar technologies are used on the website, they will be managed through the website’s cookie arrangements and related notices where applicable.

Non-essential cookies, including certain analytics, tracking or marketing cookies, will only be used where permitted by applicable law and, where required, after appropriate consent has been obtained.

Information about the cookies currently used by the website should be available through the website’s cookie settings or cookie notice.

Changes to This Notice

We may update this Privacy Notice from time to time to reflect changes in:

our activities or services;

the systems and providers we use;

legal or regulatory requirements;

our data protection and safeguarding arrangements.

The latest version will be published on our website and, where appropriate, otherwise made available to members, parents/carers, staff and volunteers.

The date at the top of this notice will show when the current version took effect.

Privacy Policy