Desborough Town Football Club (“DTFC”, “the Club”, “we”, “us” or “our”) is committed to protecting the personal information entrusted to us by players, parents and guardians, members, volunteers, coaches, committee members, officials, supporters and other individuals who interact with the Club.

This Data Protection Policy explains how DTFC manages and protects personal data and the responsibilities of people who have access to personal information as part of their role within the Club.

The Club aims to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection legislation.

2. Scope

This policy applies to personal data handled by or on behalf of DTFC, whether the information is held:

Electronically;
On computers, phones or tablets;
Through online systems;
In email accounts;
On Club social media accounts;
In paper records;
In registration forms;
In Club databases;
In photographs or video;
Through CCTV or other security systems.

It applies to committee members, officers, coaches, managers, volunteers, welfare officers and any other person who has access to personal information because of their role within the Club.

3. What is personal data?

Personal data is information relating to an identified or identifiable individual.

Examples include:

Name;
Address;
Telephone number;
Email address;
Date of birth;
Emergency contact details;
Parent or guardian details;
Player registration information;
Photographs and video;
IP addresses and certain online identifiers;
Membership information;
Records of communications;
Safeguarding and welfare information.

Some information is considered particularly sensitive under data protection law. This may include health information, safeguarding information and other special category data.

Such information must receive additional protection.

4. Data protection principles

DTFC will seek to ensure that personal data is:

Lawful, fair and transparent

Personal information will only be collected and used where the Club has a lawful basis for doing so, and individuals will be given appropriate information about how their information is used.

Collected for specific purposes

Personal information will only be collected for legitimate and clearly defined purposes.

Adequate and relevant

The Club will only collect information that is reasonably necessary for the purpose for which it is being used.

Accurate

Reasonable steps will be taken to ensure that personal information is accurate and kept up to date where necessary.

Kept for no longer than necessary

Personal information will not be retained indefinitely without a legitimate reason.

Secure

Appropriate technical and organisational measures will be used to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

5. Responsibilities within DTFC

Everyone who handles personal information on behalf of DTFC has a responsibility to protect it.

Committee members, coaches, managers, welfare officers and volunteers must:

Only access information necessary for their role;
Keep personal information confidential;
Not share information with unauthorised individuals;
Use secure passwords and appropriate security measures;
Take care when sending emails containing personal information;
Avoid storing Club personal information on unsecured or shared devices;
Keep paper records secure;
Report suspected data breaches promptly;
Follow the Club's safeguarding procedures;
Follow the Club's Privacy Policy and other relevant policies.

Personal information must not be used for personal purposes or for any purpose unrelated to the individual's Club role.

6. Children's data

DTFC has junior players and therefore handles personal information relating to children.

The Club recognises that children require particular care and protection when their personal information is processed.

Where appropriate, information will be obtained through a parent or legal guardian.

The Club will only collect and use information about children that is reasonably necessary for legitimate Club activities, including:

Player registration;
Team administration;
Fixture and training arrangements;
Emergency contacts;
Safeguarding;
Welfare;
Health and safety;
Football governing body requirements;
Communication with parents and guardians.

Children's information must not be shared publicly or with third parties unless there is a lawful basis for doing so.

7. Parents and guardians

Parents and guardians may be required to provide personal information when registering or supporting a junior player.

They are responsible for providing accurate information and informing the Club when important details change, such as:

Telephone numbers;
Email addresses;
Emergency contacts;
Relevant consent information.

The Club may communicate with parents or guardians regarding their child's participation in Club activities.

8. Special category and sensitive information

Some information requires additional protection.

This may include:

Health information;
Medical information;
Disability information;
Safeguarding information;
Welfare information;
Information relating to certain incidents or allegations.

Access to such information will be restricted to individuals who have a legitimate reason to receive it.

It must not be discussed or shared casually with other players, parents, supporters, volunteers or Club members.

Where required, DTFC will ensure that an appropriate legal basis and additional condition for processing special category data exists.

9. Sharing information

Personal information may only be shared where there is a legitimate and lawful reason.

This may include sharing information with:

Football governing bodies;
Affiliated leagues and competitions;
Coaches and authorised Club officials;
Safeguarding and welfare personnel;
Medical or emergency services;
Professional advisers;
Technology and service providers;
Public authorities or law enforcement agencies where legally required or appropriate.

Information must not be passed to another person simply because they request it.

Where there is uncertainty about whether information can be shared, the matter should be referred to an appropriate Club officer before the information is disclosed.

10. Email and electronic communications

Club officials should take reasonable care when sending emails containing personal information.

Where an email contains personal information about multiple individuals, appropriate measures should be used to avoid unnecessarily disclosing recipients' email addresses.

Sensitive information should not normally be sent through unsecured or inappropriate communication channels.

Club email accounts and systems should be protected with appropriate passwords and security measures.

11. Phones and personal devices

Where Club information is accessed through a personal phone, tablet or computer, the individual must take reasonable steps to protect the information.

This includes:

Using a password, PIN or biometric security;
Keeping the device updated;
Using secure connections where possible;
Preventing other people from accessing Club information;
Not leaving personal information visible or unattended;
Reporting loss or theft where Club information may have been exposed.

Personal devices should not be used to retain Club information unnecessarily.

12. Paper records

Paper records containing personal information must be kept secure and should not be left unattended in public areas.

When paper records are no longer required, they should be securely destroyed rather than placed in ordinary rubbish or recycling where personal information could be accessed.

13. Photographs and video

Photographs and video may be taken at DTFC matches, training sessions and events.

The Club will follow its applicable consent, safeguarding and photography procedures when taking and publishing images.

Particular care will be taken when photographs or video involve children.

Individuals should not use photographs or video obtained through their Club role for personal or commercial purposes without appropriate permission.

14. CCTV

Where CCTV is operated at Club premises, it will be used for legitimate purposes such as:

Safety and security;
Protecting Club property;
Preventing and investigating crime;
Investigating incidents;
Supporting safeguarding where appropriate.

CCTV recordings will be treated as personal data and access will be restricted.

CCTV footage must not be copied, shared, published or distributed without appropriate authorisation and a lawful reason.

The Club will maintain appropriate information and signage concerning its CCTV arrangements.

15. Data breaches

A data breach can include:

Personal information being sent to the wrong person;
Loss or theft of a device containing personal information;
Unauthorised access to Club records;
Personal information being accidentally published;
Loss of paper records;
Unauthorised disclosure of information;
A compromised Club email or online account.

Any suspected or actual data breach must be reported to the appropriate Club officer as soon as possible.

Individuals should not attempt to conceal a suspected breach.

The Club will assess the incident and take appropriate action, including determining whether notification to the Information Commissioner's Office (ICO) or affected individuals is required.

Where a breach is likely to result in a risk to individuals' rights and freedoms, the Club will consider the applicable statutory reporting requirements.

16. Data retention

DTFC will retain personal information only for as long as it is reasonably required for the purpose for which it was collected, unless there is a legal, regulatory or other legitimate reason to retain it for longer.

Different categories of information may have different retention periods.

The Club will periodically review information held and securely delete or destroy information that is no longer required.

17. Individual rights

Individuals have rights under UK data protection law, subject to certain legal conditions and exemptions.

These may include the right to:

Request access to personal information held about them;
Request correction of inaccurate information;
Request deletion of information where applicable;
Request restriction of processing;
Object to certain processing;
Withdraw consent where consent is the lawful basis;
Request data portability in applicable circumstances.

Requests should be made to the Club using the contact details published on the DTFC website.

The Club may need to verify the identity of the person making a request.

18. Confidentiality

Information obtained through a person's role at DTFC must be treated as confidential where it is not intended for public disclosure.

This is particularly important for:

Safeguarding matters;
Welfare concerns;
Children's information;
Medical information;
Disciplinary matters;
Personal contact information;
Complaints;
Sensitive Club matters.

Confidential information must not be discussed in public places, on social media, in group chats or with people who do not have a legitimate need to know.

19. Social media and messaging groups

DTFC may use social media platforms and messaging services to communicate with players, parents, coaches, volunteers and supporters.

Personal information must not be posted in public or group communications unless there is a legitimate reason and appropriate authority to do so.

Club officials should take particular care when communicating about children and safeguarding matters.

Sensitive or confidential matters should not be discussed in general team or supporters' groups.

20. Third-party systems

DTFC may use third-party systems and services to administer football activities, communications, payments, registrations, website functions or other Club activities.

Where personal information is processed by a third party on behalf of the Club, DTFC will take reasonable steps to ensure that appropriate data protection arrangements are in place.

Third-party providers may have their own privacy policies and terms which also apply to their services.

21. Data protection training and awareness

People who have regular access to personal information as part of their DTFC role should understand their responsibilities under this policy.

The Club may provide guidance or training where appropriate, particularly to individuals involved in:

Safeguarding;
Player registration;
Welfare;
Administration;
Committee activities;
Website management;
CCTV;
Communications.
22. Breach of this policy

Failure to follow this Data Protection Policy may result in the Club taking appropriate action.

Where a breach involves serious misconduct, deliberate misuse or unauthorised disclosure of personal information, the Club may take disciplinary or other appropriate action.

Nothing in this policy prevents the Club from reporting matters to the appropriate authorities where required.

23. Complaints

If you believe that DTFC has mishandled your personal information, please contact the Club in the first instance.

The Club will consider the concern and take appropriate steps to investigate it.

Individuals also have the right to complain to the Information Commissioner's Office (ICO) where they believe their personal information has not been handled in accordance with data protection law.

24. Review of this policy

This policy will be reviewed periodically and may be updated to reflect:

Changes in legislation;
Changes to Club activities;
Changes in technology;
Changes to football governing body requirements;
Changes to the way DTFC processes personal information.

The latest version will be published on the DTFC website.

25. Contact

For questions about data protection, privacy or the handling of personal information, please contact:

Desborough Town Football Club
VPK Stadium
Desborough
Northamptonshire
United Kingdom

Policy last updated: 17 September 2026