The Mountain Training Trust (MTT) is the Data Controller. Plas y Brenin (PyB) is MTT’s operating name. Mountain Training Limited (MTL) is the whollyowned trading subsidiary of MTT. MTL is included in this Privacy Policy when it processes personal data on behalf of, or jointly with, MTT/PyB.

Data Protection Lead: Head of Governance

Email: governance@pyb.co.uk

We collect personal data relating to participants, including under‑18s (with appropriate parental/guardian permissions), donors/supporters, website users, staff, and contractors. This may include:

• Contact details
• Booking and participation information
• Medical information
• Emergency contacts
• Preferences
• Training/qualification records
• Donation history
• Device and cookie data (see Cookie Notice)

Children’s data

We collect children’s data only where necessary for course delivery, safety management, or safeguarding, and always with the appropriate parental or guardian permissions. We do not use children’s data for marketing.

We process data for:

• Course and accommodation administration
• Safety management and safeguarding
• Customer support and communications
• Donor stewardship and Gift Aid
• HR and payroll
• Website operation and analytics
• Meeting legal and regulatory obligations

Marketing communications

We may send marketing communications about courses, events, news, or opportunities to support MTT/PyB where we have your consent or rely on legitimate interests (for example, for previous customers or B2B contacts, in line with PECR requirements). You can opt out of marketing emails at any time by clicking “unsubscribe” in any email or by contacting governance@pyb.co.uk

We rely on one or more of the following lawful bases:

• Contract
• Legitimate interests
• Legal obligation
• Consent
• Vital interests (for emergencies)

Where we rely on legitimate interests, we balance our interests against your rights and freedoms and only proceed where appropriate.

We only process special category data (e.g., medical, or safeguarding information) where necessary and proportionate, and where an appropriate Article 9 condition applies (such as:

• employment or social protection law,
• substantial public interest, or vital interests).

We share data with approved third‑party processors acting on our documented instructions (e.g., booking platform providers, payment providers, IT support, payroll/HR providers).

Where required, we also share data with:

• Regulators
• Insurers
• Police
• Other statutory bodies

All processors are subject to data processing terms, security requirements, and incident reporting obligations.

We do not sell your personal data under any circumstances.

If personal data is transferred outside the UK, we use an appropriate safeguard such as:

• a UK adequacy regulation, or
• the International Data Transfer Agreement (IDTA)/UK Addendum to the EU Standard Contractual Clauses.

We conduct a Transfer Risk Assessment where required.

We keep personal data only as long as necessary for the stated purpose and then dispose of it securely.

Key periods are set out in our Data Protection Policy and retention schedule (e.g., course records 6 years; safeguarding records up to 25 years).

You have the following rights under UK GDPR:

• Right of access to your personal data
• Right to rectification of inaccurate or incomplete data
• Right to erasure in certain circumstances
• Right to restrict processing in certain circumstances
• Right to object to processing based on legitimate interests or for direct marketing
• Right to data portability where processing is based on consent or contract
• Right to withdraw consent at any time where we rely on consent (withdrawal does not affect the lawfulness of processing before withdrawal)
• Right not to be subject to decisions based solely on automated processing, including profiling, which have legal or significant effects (we do not currently carry out such processing; if this changes, you will be informed and may request human review)

To exercise your rights, contact governance@pyb.co.uk We will respond within one month and may extend by up to two further months for complex requests.

We apply appropriate technical and organisational measures, including:

• Access control and least‑privilege principles
• Microsoft 365 secure storage with encryption at rest and in transit
• MFA for remote/cloud access
• Device management and patching
• Secure transfer practices
• Certified destruction of paper/media

Please see our Cookie Notice for details of the cookies and similar technologies used on the PYB website, including how to manage your preferences.

If you have concerns about our handling of your personal data, contact: governance@pyb.co.uk

You also have the right to complain to the Information Commissioner’s Office (ICO):
www.ico.org.uk

This Privacy Policy should be read in conjunction with:

• • Cookie Notice – how we use cookies and analytics on the website
  • Data Protection Policy – our principles, lawful bases, retention, and security measures
  • Data Breach Procedure – how we identify, respond to and report personal data breaches

We may update this Privacy Policy from time to time to reflect changes in law or our processing. The “last updated” date will appear at the top of the page. Significant changes will be highlighted on our website where appropriate.