Privacy Policy

Introduction 

This privacy notice provides important information about how Orb X, GEL and British Gymnastics ("we", “our” or "us") collect and use information that relates to you (your personal data) in connection with this Website and explains the applicable rights under the UK General Data Protection Regulation (UK GDPR). 

Orb X International Limited (“ORB”) is a company registered in Scotland under company registration number SC631438 and whose registered office is at The Orion Building Broomloan Place, Ibrox Business Park, Glasgow, Scotland, G51 2JR. ORB’s VAT registration number is 327 9894 44. 

ORB is contracted by Gymnastics Enterprises Limited (“GEL”) to manage and run the online shop website available at https://store.british-gymnastics.org/ (“Website”). GEL isa wholly owned subsidiary of The British Amateur Gymnastics Association (“British Gymnastics”).   

ORB, GEL and British Gymnastics are the data controllers, which means we are responsible for determining how and why your personal data is used.  

This privacy notice relates only to this Website. Please see British Gymnastics website privacy notice for information about the British Gymnastics websites (https://www.british-gymnastics.org/privacy-policy) 

This Website may contain links to third-party websites, plug-ins, and applications. We are not responsible for the content of such third-party content, or their privacy statement. If you provide any information to the third party, then you should check the third-party website to find the applicable privacy policy. 

As this Website is an online shop, we do not expect to collect the personal data of anyoneunder 13 years old.If you are aware that someone under 13 years old has used the Website, please let us know us so that we can delete that data.  

If you provide us personal data about any other individual, you must have appropriate authority to do so. 

If you have any questions, then please contact below:  

Orb X International Ltd 

By email: britishgymnastics@weareorbx.com  

 

Gymnastics Enterprises Limited 

By post: Gymnastics Enterprises Limited 

Lilleshall NSC 

Nr Newport 

Shropshire 

TF10 9AT 

By email: data.protection@british-gymnastics.org  

 

What personal data do we collect? 

We collect information directly from you when you: 

• contact us by email or post or via our website or social media platforms; 
• create an account with us; 
• purchase products from us; 

• provide information for identity verification purposes; 
• provide feedback or reviews to us; and/or 
• respond to a survey or questionnaire or enter a promotion or competition, 

This information includes: 

• Contact Data such as your email address, telephone number and address.  
• Identity Data: such as your first name, last name, username, date or birth or similar identifiers. 
• Financial Data: such as your payment details and billing address.  
• Transaction Data: details ofthe services and goods you have purchased. 

• Customer Profile Data: such as your preferences in receiving marketing communications from us, your age, gender and interests. 
• Communications and Feedback Data: such as any information about you contained in communications, surveys of other interaction with us. 

Sometimes you can choose whether to provide your personal data but, in some circumstances, this information is mandatory for example if you purchase products from us, we need your personal data to fulfil your order. We shall make it clear to you at the point of collection what personal data is optional. 

We may also collect and store the following personal data when you access our website:  

• Technical Data: such as internet protocol (IP) address, your login data, browser type and version, cookies, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website and any communications we may send to you. 
• Website Usage Data: such as information about your visit to our website, including the full Uniform Resource Locators (URL) clickstream to and through, pages you viewed or searches you made, page response times, download errors, length of visit, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page. 

 

Cookies and similar technologies  

A cookie is a small text file that is placed on your electronic device (e.g. your computer or mobile phone) when you use our website. Cookies help us to recognise your device and store some information about your preferences and past interaction with the website.  

Please see our Cookies Policy for information about the types of cookies and similar tracking technologies, when we need your consent and how to control them. 

 

How and why we use your personal data 

We will only use your personal data where we have a lawful reason to do so, such as: 

• you have given your consent;  
• to perform our contract(s) with you or to take steps to enter into a contract(s) with you; 
• to comply with legal requirements; or 
• for our legitimate interests (or those of a third party), providing that these interests are not overridden by your rights, freedom or interests. 

If you purchase services or goods from us, we shall use your personal data to take steps necessary to enter the contract with you, such as any age and identity verification checks and to perform our contract with you in accordance with our applicable terms and conditions. 

We also use your personal data for the following legitimate interests, providing that our business and commercial interests are not overridden by your own rights and interests:   

• to conduct checks to identify you and verify your identity. 

• to help prevent and detect fraud against you or us.  
• to communicate with you about your order and respond to any questions or comments you raise. 
• to undertake market research and seek customer feedback about our products and services. 
• to customise our marketing communications and website content based on your profile and interactions with us. 
• to contact you about changes to this Privacy Notice or any other relevant terms and conditions. 

• to deal with any complaints, defend claims and enforce rights.  
• in connection with, or during negotiations of, any merger, sale of assets, consolidation or restructuring, financing, or acquisition of all or a portion of our business by or into another company. 

We may from time to time need to use your personal data to comply with any legal obligations, demands or requirements, for example, as part of anti-money laundering processes or to protect a third party’s rights, property, or safety. 

 

Marketing 

With your consent we will send you marketing email messages, about us and our products and services that we think will eb of interest to you.  

You can choose to no longer receive marketing emails from us by contacting us or clicking unsubscribe from a marketing email. Please note that it may take us a few days to update our records to reflect your request. 

If you ask us to remove you from our marketing list, we shall keep a record of your name and email address to ensure that we do not send to you marketing information. We will still contact you as necessary about any services or goods that you have purchased from us or may purchase in the future. 

 

Whom do we share your data with?  

For our legitimate interests, we routinely share your personal data with service providers, sub-contractors and agents who perform functions on our behalf and in accordance with our instructions, including IT and website service providers, delivery companies, fulfilment houses and payment providers. 

We only engage other organisations to handle your personal data if we are satisfied that they will take appropriate measures to protect your personal data. We also impose contractual obligations on them to ensure they can only use your personal data for the purposes we have authorised. 

Occasionally we need to disclose your personal data as follows:  

• to statutory authorities and regulatory bodies to comply with a legal or regulatory obligation, for example, as part of anti-money laundering processes or to protect a third party’s rights, property, or safety; 
• to professional advisors and auditors 
• If we choose to merge, sell, or transfer assets, including this Website, consolidate or restructure, finance, or sell all or a portion of our business by or into another company then the new owners may use your personal data in the same way that we do as set out in this Privacy Notice. 

 

Retention of personal data 

We will retain your personal data only for as long as is necessary for the purpose it is used. 

If your account has been inactive for 3 years, we shall either delete or anonymise your account data unless we have a lawful reason to retain your personal data.   

We need to retain personal data to comply with legal, auditory or statutory requirements, including requirements of HMRC in respect of financial documents and for insurance and claims purposes.  

As the reason for retaining certain types of information varies, the retention periods can vary significantly. Please contact our Data Protection Officer (DPO) if you require any further information about specific retention periods. 

 

Transferring your personal data outside the UK 

Some organisations who provide services on our behalf are based outside the UK. Under data protection laws, we can only transfer your personal data to a country outside the UK where: 

• the UK government has decided a particular country ensures an adequate level of protection of personal data (Adequacy) 
• there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for you; (Appropriate Safeguards) or 
• a specific exception applies under data protection law. 

The locations outside the UK to which your personal data is transferred and the applicable safeguards are set out below. 

Location	Recipient	Service provided	Lawful safeguard
Canada	Shopify	Website hosting platform	Appropriate Safeguard (approved standard data protection clauses under Article 46(2) of the UK GDPR)
United States of America	James Cargo	Warehouse management and Fulfilment Services	Appropriate Safeguard (approved standard data protection clauses under Article 46(2) of the UK GDPR)
United States of America	Zen desk	Marketing /Electronic Communication services	Appropriate Safeguard (approved standard data protection clauses under Article 46(2) of the UK GDPR)
United States of America	Guest Manager	Events and Ticket sales	Appropriate Safeguard (approved standard data protection clauses under Article 46(2) of the UK GDPR)
United States of America and Canada	Wholesale pricing now	Credit sales accounts	Appropriate Safeguard (approved standard data protection clauses under Article 46(2) of the UK GDPR)

If you would like further information about data transferred outside the UK, please contact our Data Protection Officer. 

 

Security 

We shall process your personal data in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage. In particular, access is restricted to employees who need to know your personal data, and we use appropriate access protection measures and appropriate strong encryption electronic measures within our electronic data management systems. 

We have procedures in place to deal with any suspected security breaches that help ensure any risk of harm is minimised and that incidents are reported to the regulator and to affected individuals when we are legally required to do so.  

 

Your rights 

You have the important rights in respect of your personal data: In summary these include: 

• To be informed about how your information is processed 
• To access any personal data held about you 
• To have your data rectified if it is inaccurate or incomplete 

• To have your data deleted (except if there is a valid lawful reason to retain it) 
• To have your information restricted or blocked from processing 
• To portability (the right to transfer your data to another provider) 
• To object to: 
• Any processing we undertake based on legitimate interests  

• Any automated decision-making including profiling i.e. decisions taken by a computer without human intervention 
• Your personal information being used for direct marketing activities  

Some of the above rights are only applicable in specific circumstances.   

Further information about your rights and when they apply can be found here your rights 

If you have any complaints in relation to this Privacy Notice or otherwise in relation to our processing of your personal data, please tell us. We shall review and investigate your complaint and try to get back to you within a reasonable time. You also have the right to complain to the UK data protection authority about our collection and use of your personal information. For more information, please contact the Information Commissioner's Office at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Tel: 0303 123 1113. Email: Casework@ico.org.uk. 

Changes to this Privacy Notice 

We may update this Privacy Policy from time to time. If we do so, and the changes substantially affect your rights or obligations, we shall notify you if we have your email address. Otherwise, you are responsible for regularly reviewing this Privacy Policy so that you are aware of any changes to it. 

 

Last updated:  Dec 2022