Skip to content

Privacy Policy

Last updated: 7 September 2020

The Whyte Review ('the Review') is an independent review commissioned following allegations about mistreatment within the sport of gymnastics. The Review will consist of an investigation into the nature and volume of complaints received by British Gymnastics including allegations of mistreatment, sexual, mental (emotional and neglect) and physical abuse, bullying, harassment and discrimination, the approach taken to resolving complaints, the reasons for any delays in complaints being raised, adherence to safeguarding and complaints procedures, and the culture and practices of British Gymnastics, including its registered clubs. The Review has been Commissioned by Sport England and UK Sport ('the Commissioning Organisations'). The Review will report to the Commissioning Organisations and make recommendations. The Review is the data controller for your personal information. The scope and terms of reference of the Review are set out on our website

This Privacy Policy explains how the Review will use personal information about you, who it may be shared with and how you can exercise your privacy rights. If you have any questions or concerns about our use of your personal information, then please contact us using the contact details provided at the bottom of this Privacy Policy.

What personal information does the Review collect and what is the legal basis for doing so?

Purposes of collection of personal information

The purposes for which the Review collects and processes your personal information are to investigate and report on the matters set out in its Terms of Reference.

The Review is issuing a call for evidence asking for information (in oral or written form) from individuals or organisations which is relevant to the Terms of Reference. The Review will invite information from current and former members of British Gymnastics (and their parents, carers and guardians), the British Athlete's Commission, the Child Protection in Sport Unit, British Gymnastics, the English Institute of Sport, the Department for Digital, Culture, Media and Sport, United Kingdom Anti-Doping, the Commissioning Organisation and the Ann Craft Trust as well as any other individual or organisation which may wish to make a submission in respect of the Terms of Reference. The call for evidence will be published on the Whyte Review website.

This Review is not a statutory inquiry. The Review has no power to summon witnesses if they do not wish to appear or submit evidence.

The Review is intending to use personal information in a number of ways. For example, the Review will collect and examine information submitted to it in the call for evidence, seek interviews with relevant witnesses, communicate with individuals and provide updates on the progress of the Review, including producing an interim report for the Commissioning Organisations and publishing a final report. Following the interim report the Terms of Reference may be amended.

Personal information may also be used by the Review to comply with the law.

Personal information collected during the course of the Review may be published in the final report. Where the Review considers that it will assist the purpose of the Review, as set out in the Terms of Reference, it may wish to publish personal information of those who have submitted information as part of the call for evidence or it may wish to publish the content of interviews with witnesses. Where possible, information included in the final report will be included on an anonymous basis. We do not intend to name individuals in the report unless it is necessary in order to deliver the Outcomes set out in the Terms of Reference. If we believe it is necessary to name an individual in the report in order to deliver the Outcomes, they will be notified and given chance to comment prior to publication. Individuals who are under 18 will not be named in the final report.

Personal information collected

Personal information is collected, recorded and organised by the Review. Personal information may be requested by the Review from relevant individuals or submitted in response to the Review's call for evidence.

Personal information processed by the Review can comprise the personal information of:

  • Any individual providing evidence in respect of our Terms of Reference;
  • Individuals who are identified or identifiable in the final report.

The categories of personal information which will be processed in relation to the Review's investigation and report into the matters in the Terms of Reference include:

  • Biographical personal information such as name, date of birth, contact details, job description, job history, disciplinary records and findings; and
  • Special category personal information such as information relating to physical or mental health, sex life or sexual orientation, as well as data revealing racial or ethnic origin. Data relating to criminal allegations may also be processed.

Legal basis

The primary legal basis relied on for lawful processing by the Review is Article 6(1)(f) of the General Data Protection Regulation ('GDPR')*, processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

The legitimate interests in this context include:

  • The ability of the Review to examine and to produce an evidence-based, balanced analysis of the matters relating to the Terms of Reference;
  • The ability of the Review to make robust recommendations in relation to the steps which should be taken so as to ensure that in the future gymnasts' wellbeing and welfare is at the centre of the culture of British Gymnastics, that safeguarding concerns and complaints in the sport of gymnastics are raised with the appropriate authority and appropriately resolved in a timely manner and that gymnasts have appropriate pathways and the necessary support to raise concerns and complaints;
  • Where applicable, personal information may be processed on the basis of the consent of the data subject under Article 6(1)(a) of the GDPR.

Personal information may also be processed on the basis that it is necessary to comply with a legal obligation under Article 6(1)(c) of the GDPR.

In relation to special category personal information and personal information relating to criminal allegations, the additional legal bases for processing under Article 9 and 10 of the GDPR and section 10 of the Data Protection Act 2018 include:

  • Processing is necessary for the purposes of the prevention or detecting of an unlawful act (see paragraph 10 of Schedule 1 to the Data Protection Act 2018);
  • Processing is necessary for the purposes of complying with, or assisting other persons to comply with a regulatory requirement (see paragraph 12 of Schedule 1 to the Data Protection Act 2018);
  • Processing is necessary for protecting an individual from neglect or physical, mental or emotional harm or protecting the physical, mental or emotional well-being of an individual (see paragraph 18 of Schedule 1 to the Data Protection Act 2018);
  • Processing is necessary for the purposes of measures designed to eliminate doping which are undertaken by or under the responsibility of a body or association that is responsible for eliminating doping in sport or for the purposes of providing information about doping or suspected doping to such a body or association (see paragraph 27 of Schedule 1 to the Data Protection Act 2018); or
  • (where applicable and appropriate) the data subject has given explicit consent to the processing.

Who we share your personal information with and why

We will protect your personal information, including removing identifiers and redacting details which could be used to identify you, to ensure that only data necessary for the Review's performance of its functions will be disclosed outside the Review. The Review will have responsibility for managing the way in which information is processed and for ensuring that it is fair and lawful. In order to reflect the Terms of Reference, it will be necessary to process the information that we receive from you in a way that enables the Reviewer to produce a meaningful and balanced report whilst carefully considering the interests of, and impact on, those providing information. Should you have any concerns or further questions about what this means in your individual case, you should contact the Whyte Review at

During the course of the Review your personal information may be shared with the following groups of individuals:

  • The Reviewer and the two expert advisors appointed to support the Reviewer, as well as the Secretariat to the Review;
  • Other witnesses to the Review, where this is important to examine the evidence and to make relevant findings of fact;
  • Third party processors (such as providers of IT infrastructure or services) who are providing services to the Review and who will be subject to confidentiality and data protection agreements;
  • The public via the final report (please see above for more details about how your information may be included in the final report); and
  • Any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your safety and vital interests or those of any other person.

Data retention

Your personal information will be held by the Review until its conclusion. At the end of the Review, your personal information will be retained until any relevant limitation periods in relation to the Review have expired. It will then be deleted.

International Transfers

Your data will not be transferred overseas.

Your data protection rights

You have the following data protection rights:

  • If you wish to access, correct, update or request deletion of your personal information, you can do so at any time by contacting us using the contact details provided under the “How to contact us” heading below.
  • In addition, you can object to processing of your personal information, ask us to restrict processing of your personal information or request portability of your personal information. Again, you can exercise these rights by contacting us using the contact details provided under the “How to contact us” heading below.
  • Similarly, if we have collected and processed your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
  • You have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact the Information Commissioner's Office at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Tel: 0303 123 1113. Email:

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.


This website has not set any cookies and we will not be tracking, analysing or monitoring traffic in any way. No personal information will be stored following your visit to this website.

Updates to this Privacy Policy

We may update this Privacy Policy from time to time. When we update our Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Policy changes if and where this is required by applicable data protection laws.

You can see when this Privacy Policy was last updated by checking the "last updated" date displayed at the top of this Privacy Policy.

How to contact us

If you have any questions or concerns about our use of your personal information, please contact us using the following details:

The data controller of your personal information is the Whyte Review which is registered with the Information Commissioner's Office.

* In this Policy, references to the GDPR should be read after the transition period has ended as references to the UK GDPR as incorporated into domestic law under section 3 of the European Union (Withdrawal) Act 2018

Top of the page