Atherstone Town Football Club Ltd ("the Club") is committed to protecting the privacy and personal data of its
members, shareholders, volunteers, players, coaches, supporters, contractors, and other stakeholders.This
policy sets out how the Club complies with the UK General Data Protection Regulation (UK GDPR), the Data
Protection Act 2018, and other applicable data protection legislation.

2. Scope

The policy covers all personal data held by the Club in electronic, paper, photographic, video, and audio formats
and applies to:
• Directors and officers
• Volunteers
• Coaches and team management
• Players
• Members and shareholders
• Contractors and third parties acting on behalf of the Club

3. Data Protection Principles

The Club will ensure personal data is:
3.1 Processed Lawfully, Fairly and Transparently
Personal data will only be collected and used where there is a lawful basis for doing so.
3.2 Collected for Specified Purposes
Data will only be used for legitimate Club purposes and not for unrelated activities.
3.3 Adequate, Relevant and Limited
The Club will only collect information necessary for its operations.
3.4 Accurate and Up to Date
Reasonable steps will be taken to keep records accurate and current.
3.5 Kept Only as Long as Necessary
Data will be retained in accordance with the Club's retention schedule.
3.6 Secure
Appropriate technical and organisational measures will be implemented to protect personal data from
unauthorised access, loss, destruction, or disclosure.
Document Title: Data Protection Policy Version: 1.0 Approved By: Board of Directors
Effective Date: 1st June 2026 Review Date: 31st May 2027
ATHERSTONE TOWN FOOTBALL CLUB LTD
3.7 Accountable
The Club will maintain records demonstrating compliance with data protection legislation.

4. Personal Data Collected

The Club may collect the following data, dependant on an individual’s role in the club:
• Name
• Address
• Email address
• Telephone number
• Membership number
• Shareholding records
• Payment information
• Date of birth
• Registration information
• Medical information where necessary
• Emergency contact details
• Performance and participation records
• Training records
• DBS information where applicable
• Ticketing information

5. Lawful Bases for Processing

The Club processes personal data under one or more of the following lawful bases:
• Consent
• Contractual necessity
• Legal obligation
• Legitimate interests
• Protection of vital interests
Special category data (such as medical information) will only be processed where additional legal conditions
are met.

6. Use of Personal Data

Personal data may be used for:
• Administering memberships and shareholdings
• Registering players and teams
• Managing competitions and fixtures
• Processing payments
• Communicating Club news and updates
• Organising events
• Safeguarding and welfare purposes
• Meeting legal and regulatory obligations
• Maintaining historical Club records
Document Title: Data Protection Policy Version: 1.0 Approved By: Board of Directors
Effective Date: 1st June 2026 Review Date: 31st May 2027
ATHERSTONE TOWN FOOTBALL CLUB LTD

7. Photography and Video

The Club may take photographs and videos during matches, training sessions, and events for:
• Club publications
• Social media
• Website content
• Promotional activities
Where required, consent will be obtained before images are used.
Special care will be taken when publishing images of children and vulnerable individuals.

8. Sharing Personal Data

The Club may share information with:
• Football governing bodies
• Leagues and competition organisers
• Affiliated football associations
• Professional advisers
• Payment service providers
• Regulatory authorities where legally required
The Club will never sell personal data to third parties.

9. Data Security

The Club will implement appropriate security measures including:
• Password-protected systems
• Restricted access to records
• Secure storage of paper files
• Regular software updates
• Secure disposal of confidential information
• Staff and volunteer awareness training
Any suspected data breach must be reported immediately to the Board of Directors.

10. Data Retention

The Club will retain personal data only for as long as necessary, for example:
Record Type Retention Period
Membership records 6 years after membership ends
Shareholder records Duration of ownership plus 6 years
Financial records 6 years
Player registrations 6 years

Document Title: Data Protection Policy Version: 1.0 Approved By: Board of Directors
Effective Date: 1st June 2026 Review Date: 31st May 2027

ATHERSTONE TOWN FOOTBALL CLUB LTD
Record Type Retention Period
Safeguarding records In accordance with FA guidance
Employment records 6 years after employment ends

11. Individual Rights

Individuals have the right to:
• Access their personal data
• Correct inaccurate information
• Request deletion of data where appropriate
• Restrict processing
• Object to processing
• Data portability where applicable
• Withdraw consent at any time
Requests should be made in writing to the Club Secretary.

12. Subject Access Requests

The Club will respond to Subject Access Requests within one month unless an extension is permitted by law.
Identity verification may be required before information is disclosed.

13. Data Breaches

Any personal data breach must be reported immediately to the Board of Directors.
The Club will:
1. Investigate the breach.
2. Assess the risks.
3. 4. 5. Notify the Information Commissioner's Office (ICO) where required.
Notify affected individuals where appropriate.
Record all breaches and actions taken.

14. Responsibilities

Board of Directors: The Board has overall responsibility for data protection compliance.
Club Secretary: The Club Secretary shall:
• Maintain data protection records
• Handle information requests
• Coordinate breach reporting
• Monitor compliance
Coaching Team, Players and Volunteers: All staff and volunteers must:
Document Title: Data Protection Policy Version: 1.0 Approved By: Board of Directors
Effective Date: 1st June 2026 Review Date: 31st May 2027

ATHERSTONE TOWN FOOTBALL CLUB LTD
• Follow this policy
• Keep information secure
• Report breaches promptly
• Complete any required training
15. Contact Details
For data protection matters, contact:
Club Secretary
Atherstone Town Football Club Ltd
Email: info@atcf.co.uk

16. Complaints

Individuals who are dissatisfied with how their personal data is handled may contact the Club Secretary in the
first instance.
They also have the right to lodge a complaint with the Information Commissioner's Office

17. Policy Review

This policy will be reviewed annually or sooner if required by changes in legislation, guidance, or Club operations.

Approved by the Board of Directors of Atherstone Town Football Club Ltd

Signed: ___________________________

Name: ____________________________
Position: Director

Date: ____________________________

Document Title: Data Protection Policy Version: 1.0 Approved By: Board of Directors