Privacy Notice
What does this notice cover?
UK Anti-Doping (‘UKAD’, ‘we’ and ‘us’) has two main privacy notices, this General Privacy Notice and our Anti-Doping Privacy Notice.
| How UKAD uses your data to fulfil its regulatory functions under the World Anti-Doping Code, UK National Anti-Doping Policy and the UK Anti-Doping Rules | Not covered by this notice–see our Anti-Doping Privacy Notice |
| How UKAD uses your data otherwise collected through its websites and through online and offline communications (and other interactions) with us | This General Privacy Notice |
You have rights and choices regarding UKAD’s use of your data, including a right to object to certain processing. More information is provided in Your choices and rights below.
Summary of how and why we use your data
- UKAD uses your personal data to allow you to use the features on our website; to administer your online and offline relationships with us; to comply with our legal obligations; and to communicate with you. Such information may be provided by you, generated by UKAD and / or provided by third parties.
- Our websites may provide interactive features that engage with social media sites, such as Facebook and X (formerly Twitter). If you use these features, these sites will send us personal data about you. We also use cookies and other tracking technologies to personalise content and advertising and to make our content function better. You can manage these on our cookie preferences page.
- Where we rely on your consent, such as for marketing or research purposes, or to place cookies, you can withdraw this consent at any time.
What categories of personal data do we collect?
We collect and process personal data about you, including when you interact with us (such as through our websites and social media pages); when you purchase any products or training from us; where you visit our premises; when we carry out market research; and when you deal with us as a supplier or an employee of a supplier or stakeholder. Such data will typically be provided directly by you (including in registration forms or emails).
The details provided by you will be made clear in any forms you complete or will usually be chosen directly by you in volunteering information in communications or content you provide to us. This includes any of the following information:
| Category | Details |
|---|---|
| Identification Information | Your name, gender and age/date of birth |
| Contact Information | Your personal and work address, email address and phone number |
| Marketing Information | Your marketing preferences, including any consents you have given us |
| Payment Information | Billing account and payment card details, such as billing address, billing contact and products or services for which you are making a purchase |
| Device And Interaction Information | Information related to the browser or device you use to access our website and tools made available on our website, and your use of our website This may include the device type, manufacturer, model, operating system, IP address, browser type, internet service provider, and unique identifiers associated with you, your device, or your network (including, for example, a persistent device identifier or advertising ID), and information about the site from which you came, the site to which you are going when you leave our site, how frequently you access our site, whether you open emails or click the links contained in emails, whether you access our site from multiple devices, and other browsing behaviour and actions you take on our site |
| Sport-related Information | Details of your involvement with the relevant sport, or connection with a relevant athlete’s sport, including (as appropriate) information about your discipline, level of participation, your employer and sporting affiliations |
| Health Information | Information related to specific forms and tools available on our website (including the Asthma Inhaler Threshold Calculator, on which you may provide, for example, details of your inhaler dosage and contents), or that you provide in relation to reports you make to us relating to your own conduct |
| Correspondence Information | Conversation history related to communications between you and us, including as shared by email or through any tool on our website (including, for example, WhistleBot) |
| User-generated Information | Results of, or any other information generated as a result of, the responses or proactive contributions provided via any of the online forms or tools on our website |
| Criminal Offence Information | Details related to criminal convictions or offences, including allegations of criminal activity, or apparent evidence of criminal activity |
If you are an athlete, and any data provided with the categories above relate to anti-doping, see our Anti-Doping Privacy Notice.
We also receive information about you from third parties. In an online context, much of this is set out in our Cookie Policy. In addition, we receive information about attendees on our education courses when they are booked by a third party and from time-to-time also make use of third-party partners to assist us in payment processing and in fraud detection.
Our lawful bases for processing
We are required to have a lawful basis to process your data. Our lawful bases are:
| Lawful Basis | Description |
| Main lawful bases | |
| Consent | Sometimes we ask for your consent to use your data |
| Contract | If we have an agreement in place with you, we may process your data where it is necessary for us to meet our obligations or enforce our rights under the contract |
| Legitimate Interest | We can process your data when this is necessary for us to achieve a legitimate business purpose, or where this is necessary for someone else to achieve a legitimate purpose. This may include recognised legitimate interests as included in the UK General Data Protection Regulation (UK GDPR) |
| Public Task | We process most data we receive due to the necessity of that processing for furthering our public task (the elimination of doping in sport) |
| Legal Obligation | We have obligations to comply with legal and regulatory requirements under various applicable laws. In certain cases, we may have to use your data to meet these obligations |
| Further lawful bases (required if we process your criminal offence or special category data – such as information relating to your health, biometric data(that may identify you), your ethnicity, your religion, your sex life or sexual orientation, trade union membership or political opinion | |
| Substantial public interest, as set out in law | The law may make special provision for our processing, in particular for the purpose of eliminating doping in sport |
| Establishment, exercise or defence of legal claims | We are entitled to process special category data where this is necessary to establish, exercise or defend our legal rights |
| Prevent, detect or investigate crime | We may process data where it is necessary for purposes relating to the prevention, detection or investigation of crime, including sharing information with the necessary criminal authorities |
| Compliance with employment law | Processing of special category data may be required where necessary for compliance with relevant laws, such as health and safety legislation where injuries on our premises need to be recorded |
How do we use this information, and what is the legal basis for this use?
We will collect, use and store your personal data for the purposes and lawful bases set out below:
| Purpose | Lawful Basis |
|---|---|
Allowing you to register and create an account n any of our websites or apps and providing you with related services, such as through our Clean Sport Hub or 100% me Clean Sport App, including processing any payment in connection with such services Relevant Data: Identification Information, Contact Information, Sport-related Information, and Payment Information | Contract |
Managing our relationship with you, providing communications you have requested and responding to any comments or complaints you may send to us Relevant Data: Contact Information and Correspondence Information | Public Task |
Monitoring our websites and services, including to prevent, investigate and/or report fraud, terrorism, misrepresentation, security incidents or crime, in accordance with applicable law Relevant Data: Identification Information, Contact Information, Device and Interaction Information, Sport-related Information, Correspondence Information, User-generated Information and Criminal Offence Information | Public Task or our recognised legitimate interest in preventing, detecting, or investigating a crime |
Sending you promotional communications about relevant services, content or events that UKAD offers Relevant Data: Identification Information, Contact Information and Marketing Information | Consent |
Placing cookies and use similar technologies in accordance with our Cookies Policy (see below) and the information provided to you when those technologies are used Relevant Data: Device and Interaction Information | Consent |
Inviting you to take part in and manage customer surveys, reviews and other market research activities carried out by us and by other organisations on our behalf Relevant Data: Identification Information, Marketing Information and Contact Information | Legitimate interests Carrying out market research |
Facilitating the use and functionality of WhistleBot – a chatbot tool developed to help people understand where and how to report anti-doping concerns to UKAD (any specific information subsequently provided through UKAD’s available reporting channels is covered by the Anti-Doping Privacy Notice) Relevant Data: Identification Information, Contact Information, Sport-related Information, Correspondence Information and User-generated Information | Public Task WhistleBot does not ask for users to provide special category data but, in the event such data is processed, it would be processed for the purposes of measures designed to eliminate doping in sport |
Facilitating the use and functionality of the other UKAD tools, including:
Relevant Data: Identification Information, Contact Information, Sport-related Information, Health Information and User-generated information | Public Task These tools will process special category data on the basis that it is not retained or identifiable to UKAD; UKAD’s limited processing of this data is based on the processing necessary for the purposes of measures designed to eliminate doping in sport |
Protecting our interests and legal rights, including use in connection with legal claims, compliance, regulatory, auditing, investigative and disciplinary purposes (excluding anti-doping related purposes covered in our Anti-Doping Privacy Notice) and uses necessary to protect the security of our premises, assets, systems and intellectual property, as well as to enforce UKAD’s policies and assist the regulatory investigations of other public authorities Relevant Data: Any data category listed above | Legitimate interests Ensures UKAD and its premises, personnel and services are safe, secure and compliant with regulatory requirements (or, where relevant, a recognised legitimate interest listed in UK law, such as sharing data with other public authorities) Where we process your special category data or criminal offence data for these purposes, we will typically rely on our need to establish, exercise or defend ourselves from legal claims |
Processing required by law, such as where required by specific obligations (such as maintaining health and safety records and details of our relationships with suppliers), responding to mandatory requests from government or law enforcement or responding to requests under the Freedom of Information Act 2000 (and not otherwise exempt) Relevant Data: Any data category listed above | Legal Obligation Where we process your special category data or criminal offence data, this may be required by employment law, or may otherwise be necessary to establish, exercise or defend ourselves from legal claims or to prevent, detect or investigate crime |
Withdrawing consent and processing on the basis of legitimate interests
Wherever we rely on your consent, including explicit consent, you will always be able to withdraw that consent. This will not undermine the legitimacy of any processing carried out prior to your consent being withdrawn. If you withdraw consent this may, in some cases, impact your ability to access certain services or events as explained above.
As a public body, UKAD primarily relies on its public task in eliminating doping in sport rather than on a legitimate interest. However, there are instances where we have a legitimate interest to use your data. Our legitimate interest will vary depending on what we use your data for, and we explain above what the interest is and how it relates to the processing operations that we carry out.
Where we process personal data on the basis of a legitimate interest, unless this is a ‘recognised legitimate interest’ under the UK GDPR, we carry out a ‘balancing test’ to document our interest(s), consider what the impact of the processing will be on individuals and determine whether individuals’ interests outweigh our interest(s) in the processing taking place.
How we share your personal data
We may share your data with the following categories of recipients:
| Personal Data Category | Category of Recipient | Why? |
| All Data Categories | Third party service providers | We employ other companies and individuals to perform functions on our behalf. Examples include website hosting and maintenance, security services, payment processing software hosting and support, and market research |
Identification Information Sport-related Information Health Information User-generated information | Law enforcement, other regulatory authorities and fraud prevention agencies | To prevent, investigate and/or report fraud, terrorism, misrepresentation, security incidents or crime, in accordance with applicable law In the UK, this is a recognised legitimate interest when we do this to prevent, detect, or investigate a crime |
Identification Information Sport-related Information Health Information User-generated information | Relevant Anti-Doping Organisations and other regulators and agencies such as national governing bodies, international federations, law enforcement agencies, WADA, major event organisers and other sports stakeholders | Performance of our public task (elimination of doping in sport) |
| All Data Categories (unless exempt) | Publication | Compliance with obligations under the Freedom of Information Act 2000, where not otherwise exempt |
What cookies and/or tracking technologies does UKAD use?
When you visit one of our websites, we may also collect, process and use information about you and your use of the website, including any forums you visit and how you arrived at our site. Such information may be collected through ‘traffic data’ and may entail the use of ‘cookies’ or other tracking technologies, IP addresses or other numeric codes used to identify your computer. For more information on cookies see our Cookie Policy.
Apple iOS and Android Devices
By accessing a UKAD application from these devices you consent to cookies being stored on your device (and other tracking technologies being used to read data from your device) to keep you logged in; ensure that an appropriate version of content is presented; and analytics. Many of these cookies and technologies are essential to the operation of the application. It is not currently possible to opt out or remove these cookies (or prevent use of these technologies) from the device without deleting the application.
Where we transfer your personal data
Personal data that we collect from you may be transferred to and stored at a destination outside the UK, for example with stakeholders, regulatory bodies and vendors outlined above. These include WADA and Anti-Doping Organisations that are located outside of the UK.
Where these locations do not provide an adequate level of data protection, we ensure appropriate safeguards are in place to protect the transfer of your personal data to these countries, such as through use of UK Standard Contractual Clauses, unless the transfer is exempt, for example because the transfer is required for matters in the substantial public interest, such as anti-doping purposes.
A copy of the relevant mechanism can be obtained for your review on request by using the contact details below.
Your choices and rights
You have the right to:
- ask us for a copy of your personal data;
- ask us to correct, delete or restrict (stop any active) processing of your personal data;
- obtain the personal data you provide to us for a contract or with your consent in a structured, machine-readable format;
- object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing).
These rights may be limited, for example if fulfilling your request would reveal personal data about another person, where it would infringe the rights of a third party (including our rights) or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests to keep. Relevant exemptions are included in both the UK GDPR and in the Data Protection Act 2018. We will inform you of relevant exemptions we rely on when responding to any request you make.
To exercise any of these rights, you can get in touch with us – or our data protection officer – using the details below. If you have unresolved concerns, you have the right to complain to us, using these same contact details. You can also complain to the Information Commission.
Wherever we rely on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. We may, however, have other legal grounds for processing your data.
Data that is mandatory is indicated on the relevant forms that you complete. Where the provision of information is mandatory, if relevant data is not provided, we will not be able to fulfil your requests to register, obtain a service or otherwise engage with UKAD. The provision of all other information is optional.
How long we retain your personal data
We will retain details of intelligence we obtain from you in accordance with our Anti-Doping Privacy Notice.
Where we process personal data for marketing purposes or with your consent, we process the data until you ask us to stop and for a short period after this (to allow us to implement your requests).
Where we process personal data in connection with performing a contract, we may keep your data for up to seven (7) years from your last interaction with us or from when the contract ends.
Where we process personal data to meet legal requirements, we hold this for as long as the law requires.
Updates to this notice
We reserve the right to update this General Privacy Notice at any time, and we will provide you with a new notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.
Contact us
The controller for your personal data is UKAD. If you have questions about this General Privacy Notice or wish to contact us for any reason in relation to our personal data processing, you can get in touch with our data protection officer at ukad@ukad.org.uk or by writing to Data Protection Officer, UKAD, SportPark, 3 Oakwood Drive, Loughborough LE11 3QF.
Last updated: January 2026