We are the data controller, responsible for the processing of any personal data you give us. We take reasonable care to keep your information secure and to prevent any unauthorised access to or use of it.

What personal data we hold on you
Personal data means any information about an individual from which that individual can be identified.
We collect, use, store and transfer personal data of our players, their parents or guardians and other Club members and officials. In this Notice when we refer to “you”, we mean you and any player for whom you are responsible as a parent or guardian. When we refer to your personal data, we mean personal data you give us about yourself and data of any player for whom you are responsible.

You provide information about yourself when you register with the Club, fill in forms at an event or online, or correspond with us by phone, social media, e-mail or otherwise.

The information you give us may include your name, date of birth, address, e-mail address, phone number, gender, and the contact details of a third party in the case of emergency. We may also ask for relevant health information, which is classed as special category personal data, for the purposes of your health, wellbeing, welfare and safeguarding. Where we hold this data, it will be with your explicit consent.

Where we need to collect personal data to fulfil Club responsibilities and you do not provide that data, we may not be able honour or administer your membership.

Why we need your personal data
We will only use personal data for any purpose for which it has been specifically provided.

The reason we need your/your player’s personal data is to be able to run the football club and arrange matches; to administer memberships, and provide the membership services you are signing up to when you register with the club. Our lawful basis for processing your personal data is that we have a contractual obligation to you as a member to provide the services you are registering for.

We have set out below a description of all the ways we plan to use your personal data and the legal bases we rely on to do so. We have also identified what our legitimate interests are, where appropriate.

For the performance of a contract (your membership of the Club) we may process data in the following ways
• The processing of membership forms and payments/subs
• Organising matches
• Sending out match or Club information
• Sharing data with coaches, managers or officials to run training sessions or enter events
• Sharing membership data within the broader sports club, registered as Kenilworth Wardens Sports Club Ltd, in order to maintain club memberships
• Sharing data with leagues we are in membership of, the county FA associations and other competition providers for events
For a legitimate interest (to maintain member and player correspondence for club community purposes) we share data with committee members in order to provide information about club activities, membership renewals or invitations to social events.
For a legitimate interest (because the Club has a legitimate interest to run the organisation efficiently and appropriately for a grassroots football club) we may share data with third parties:
• Service or facility providers, where these third-party services are for the benefit of the Club and its members.
• Anonymised data with funding partners (eg local authorities) where that is a condition of grant funding. An application for funding is a purpose that benefits the Club and its members.
With your consent (where applicable as the parent or guardian of a player for whom you are responsible) we may carry out the following activities:
• We will only publish your personal data in a public domain if you have given your consent for us to do so, and in the case of children under the age of 13 only with your written consent.
• We will only use photos or videos of teams or individual members in a safe and respectful manner, in line with the FA Photography Guidelines, for the promotion and celebration of club activities.
• Using your information to understand possible health risks. Subject to our legitimate interests in the case of major public emergencies, we will only process details on your or your player’s medical history with your consent.

Whom we share your personal data with
When you become a member or an official of the Club, your information will be entered onto the FA Club Portal database, which is administered by the FA. We also pass your information to leagues to register players and teams for matches, tournaments or other events.

We may share your personal data with selected third parties, suppliers and sub-contractors such as referees, coaches, match organisers and insurers. In particular, we will share information with Pitchero for the purpose of general club administration including payments, club communications and maintaining club records. Third-party service providers will only process your personal data for specified purposes and in accordance with our instructions.

We may disclose your personal information to third parties to comply with a legal obligation; or to protect the rights, property, or safety of the Club, our members or officials.

The Club’s data processing may require your personal data to be transferred outside of the UK. Where the Club does transfer your personal data overseas it is with the sufficient appropriate safeguards in place to ensure the security of that personal data.

Protection of your personal data
We will ensure that your personal data is not accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

How long we hold your personal data
We keep personal data on members, their parents and guardians, and club officials while they continue to be a member or are otherwise actively involved with the Club. We will delete this data within 2 years after a member has left or otherwise ended their membership, or sooner if specifically requested and we are able to do so. Information obtained in order to help with combatting major public health emergencies will be retained only as long as reasonably required for the purpose. We may need to retain some personal data for longer for legal or regulatory purposes. The personal data that is stored on the FA Club Portal is subject to the FA’s privacy policy so we advise you review that policy together with this notice. While we will do our best to remove your data from the Club Portal, if you would like to ensure your personal data has been deleted then please contact the FA.

Your rights regarding your personal data
As a data subject you may have the right at any time to request access to, rectification or erasure of your personal data; to restrict or object to certain kinds of processing of your personal data, including direct marketing; to the portability of your personal data and to complain to the UK’s data protection supervisory authority, the Information Commissioner’s Office about the processing of your personal data.

As a data subject you are not obliged to share your personal data with the Club. If you choose not to share your personal data with us, if you are a member we may not be able to register or administer your membership and if you are a club official you may not be able to participate in club affairs or activities.

We may update this Privacy Notice from time to time and will inform you of any material changes in how we handle your personal data.

If you have any questions about this Privacy Notice then please contact the Club Secretary.

Data policy

Kenilworth Wardens Football Club Data Protection Policy

1. Purpose of this Policy
1.1 This Policy must be made available to all officials, volunteers and anyone who comes into contact with personal data during the course of their involvement with the club.
1.2 This Policy sets out our data protection responsibilities and highlights the obligations of the Club, which also means the obligations of our officials, volunteers, contractors or others acting for the Club.
1.3 Correct and lawful treatment of this data will maintain confidence in the Club and protect the rights of people associated with the Club.
1.4 You must comply with this Policy when processing personal data on behalf of the Club. This olicy will help you to understand how to handle personal data.
1.5 The Club Committee will be responsible for ensuring compliance with this Policy. Any questions about this Policy or data protection concerns should be referred to the Club Secretary.

2. Processing of Club Data
2.1 The Club handles personal data about current, former, prospective players, their parents or guardians, volunteers, officials, other Club members, referees, third parties suppliers, and other individuals that we communicate with.
2.2 In your official capacity with the Club, you may process personal data on our behalf and we will process personal data about you. We must comply with the EU General Data Protection Regulation (GDPR).
2.3 We process volunteer, member, referee, coach, manager, official, supplier and third party personal data for administrative and Club management purposes. Our purpose for holding this personal data is to be able to contact relevant individuals on Club business or administer their relationship with the Club.
2.4 Our legal bases for processing this personal data are explained in full in our Privacy Notice. We will keep this data for up to 2 years after the end of the individual’s official relationship with the Club, unless required otherwise by law or regulatory requirements.

3. What we need from you
3.1 To comply with GDPR we will need you to comply with the terms of this Policy. We have set out the key guidance in this section but please do read the full Policy carefully.
3.2 Please follow the data protection principles in section 4 of this Policy by doing the following:
3.2.1 ensure that you only process data in accordance with our transparent processing as set out in our Privacy Notice
3.2.2 only process personal data for the purposes for which we have collected it (i.e. if you want to do something different with it then please speak to the Club Secretary first);
3.2.3 do not ask for further information about players, members, officials or volunteers without first checking with the Club Secretary
3.2.4 if you are asked to correct an individual’s personal data, please make sure that you can identify that individual and, where you have been able to identify them, make the relevant updates on our records
3.2.5 comply with the retention periods listed in our Privacy Notice and make sure that if you still have information which falls outside of those dates, that you delete/destroy it immediately and securely;
3.2.6 treat all personal data as confidential. If it is stored in electronic format then please consider whether the documents themselves should be password-protected to ensure only those people who need to have access to the information. Please also consider the security levels of any cloud storage provider. If it is stored in hard copy format then please make sure it is secure and not kept in a car overnight. Please do not disposed of it in a public place.
3.2.7 if you are looking at using a new electronic system for the storage of information, please talk to the Club Secretary first so that we can decide whether such a system is appropriately secure and complies with GDPR;
3.2.8 if you are planning on sharing personal data with anybody new or with a party outside the FA or leagues then please speak to the Club Secretary before doing so who will be able to check that the correct contractual provisions are in place and that we have a lawful basis to share the information;
3.2.9 if you receive a subject access request (or you think somebody is making a subject access request for access to the information we hold on them) then please tell the Club Secretary as soon as possible because we have strict timelines in which to comply;
3.2.10 if you think there has been a data breach (for example you have lost personal data or a personal device which contains personal data or you have been informed that a coach has done so) then please speak to the Club Secretary immediately who will be able to help.
If you have any questions at any time then please just ask the Club Secretary.

4. Data protection principles
4.1 Anyone processing personal data must comply with the principles of data protection. Personal data must be:
4.1.1 processed lawfully, fairly and in a transparent manner;
4.1.2 collected for only specified, explicit and legitimate purposes;
4.1.3 adequate, relevant and limited to what is necessary for the purpose(s) for which it is processed;
4.1.4 accurate and, where necessary, kept up to date;
4.1.5 kept in a form which permits identification of individuals for no longer than is necessary for the purpose(s) for which it is processed;
4.1.6 processed in a manner that ensures its security by appropriate technical and organisational measures to protect against unauthorised or unlawful processing and against accidental loss, destruction or damage;
4.2 We are responsible for and must be able to demonstrate compliance with the data protection principles listed above.

5. Fair and lawful processing
5.1 This Policy aims to ensure that our data processing is done fairly and without adversely affecting the rights of the individual.
5.2 Lawful processing means data must be processed on one of the legal bases set out in the GDPR. When special category personal data is being processed, additional conditions must be met.

6. Processing for limited purposes
6.1 The Club collects and processes personal data. This is data we receive directly from an individual and data we may receive from other sources.
6.2 We will only process personal data for the purposes of the Club as instructed by the Committee, the FA, the leagues or as specifically permitted by the GDPR. We will let individuals know what those purposes are when we first collect the data or as soon as possible thereafter.

7. Consent
7.1 One of the lawful bases on which we may be processing data is the individual’s consent.
7.2 An individual consents to us processing their personal data if they clearly indicate specific and informed agreement, either by a statement or positive action.
7.3 Individuals must be easily able to withdraw their consent at any time and withdrawal must be promptly honoured. Consents should be refreshed every season.
7.4 Explicit consent is usually required for automated decision-making, for cross-border data transfers and for processing special category personal data. Where children are involved then the consent must be in writing from the parent/guardian
7.5 Where consent is our legal basis for processing, we will need to keep records of when and how this consent was captured.
7.6 Our Privacy Notice sets out the lawful bases on which we process data of our players and members.

8. Notifying individuals
8.1 Where we collect personal data directly from individuals, we will inform them generally via our Privacy Notice about:
8.1.1 the purpose(s) for which we intend to process that personal data;
8.1.2 the legal basis on which we are processing that personal data;
8.1.3 where that legal basis is a legitimate interest, what that legitimate interest is;
8.1.4 where that legal basis is statutory or contractual, any possible consequences of failing to provide that personal data;
8.1.5 the types of third parties, if any, with which we will share that personal data;
8.1.6 their rights as data subjects, and how they can limit our use of their personal data;
8.1.7 the period for which data will be stored and how that period is determined;
8.1.8 whether the data may be used for any further processing.
8.2 If we receive personal data about an individual from other sources, we will provide the above information as soon as possible and let them know the source we received their personal data from;
8.3 We will also inform those whose personal data we process that we, the Club, are the data controller in regard to that data, and which individual(s) in the Club are responsible for data protection.

9. Adequate, relevant and non-excessive processing
9.1 We will only collect personal data that is required for the specific purpose notified to the individual.
9.2 You may only process personal data if required to do so in your official capacity with the Club. You cannot process personal data for any reason unrelated to your duties.
9.3 The Club must ensure that when personal data is no longer needed for specified purposes, it is deleted or anonymised.

10. Accurate data
10.1 We will ensure that personal data we hold is accurate and kept up to date. We will check the accuracy of any personal data at the point of collection and at the start of each season. We will take all reasonable steps to destroy or amend inaccurate or out-of-date data.

11. Timely processing
11.1 We will not keep personal data longer than is necessary for the purpose(s) for which they were collected. We will take all reasonable steps to destroy or delete data which is no longer required, as per our Privacy Notice.

12. Processing in line with data subjects’ rights
12.1 As data subjects, all individuals have the right to:
12.1.1 be informed of what personal data is being processed;
12.1.2 request access to any data held about them by a data controller;
12.1.3 object to processing of their data for direct-marketing purposes (including profiling);
12.1.4 ask to have inaccurate or incomplete data rectified;
12.1.5 be forgotten (deletion or removal of personal data);
12.1.6 restrict processing;
12.1.7 data portability; and
12.1.8 not be subject to a decision which is based on automated processing.
12.2 The Club is aware that not all individuals’ rights are absolute, and any requests regarding the above should be immediately reported to the Committee, and if relevant escalated to the FA for guidance.

13. Data security
13.1 We will take appropriate security measures against unlawful or unauthorised processing of personal data, and against the accidental loss of, or damage to, personal data.
13.2 We have proportionate procedures and technology to maintain the security of all personal data.
13.3 Personal data will only be transferred to another party to process on our behalf (a data processor) where we have a GDPR-compliant written contract in place with that data processor.
13.4 We will maintain data security by protecting the confidentiality, integrity and availability of the personal data.
13.5 Our security procedures include:
13.5.1 Methods of disposal. Paper documents should be shredded.
13.5.2 Personal Devices. Anyone accessing or processing the Club’s personal data on their own device, must have and operate a password only access or similar lock function, and should have appropriate anti-virus protection. These devices must have the Club’s personal data removed prior to being replaced by a new device or prior to such individual ceasing to work with or support the Club.

14. Disclosure and sharing of personal information
14.1 We share personal data with the FA, and with applicable leagues using the FA Club Portal and other administrative systems and records.
14.2 We may share personal data with third parties or suppliers for the services they provide and instruct them to process our personal data on our behalf as data processors. Where we share data with third parties, we will ensure we have a compliant written contract in place incorporating the minimum data processer terms as set out in the GDPR, which may be in the form of a supplier’s terms of service.
14.3 We may share personal data we hold if we are under a duty to disclose or share an individual’s personal data in order to comply with any legal obligation, or in order to enforce or apply any contract with the individual or other agreements; or to protect our rights, property, or safety of our employees, players, other individuals associated with the Club or others.

15. Reporting a personal data breach
15.1 In the case of a breach of personal data, we may need to notify the applicable regulatory body and the individual.
15.2 If you know or suspect that a personal data breach has occurred, inform the Club Secretary immediately, who may need to escalate to the FA or the Information Commissioner as appropriate. You should preserve all evidence relating to a potential personal data breach.

16. Dealing with subject access requests
16.1 Individuals may make a formal request for information we hold about them. Anyone who receives such a request should forward it to the Club Secretary immediately. Nobody should feel bullied or pressured into disclosing personal information.
16.2 When receiving telephone enquiries, we will only disclose personal data if we have checked the caller's identity to make sure they are entitled to it.

17. Accountability
17.1 The Club is responsible for and must be able to demonstrate compliance with the data protection principles.
17.2 Measures include:
17.2.1 Making available the Privacy Notice to individuals before or at all points of data capture;
17.2.2 training officials and volunteers on this Policy; and
17.2.3 reviewing the privacy measures implemented by the Club.

18. Changes to this Policy
We reserve the right to change this Policy at any time. If there are material changes we will notify you.

Terms and Conditions

Kenilworth Wardens Football Club Charter

Our Club
We are a community football club for boys, girls, men and women from the age of 6 upwards.

We are committed to providing a safe, positive and enjoyable environment where people can develop their football skills, keep fit, build character and form lasting friendships through playing a fantastic team sport.

As a club we are inclusive. We believe in and adhere to the FA Diversity Leadership Code, Respect and the FA Grassroots Code .

We foster open communication where everyone is listened to and valued. Safeguarding and welfare are at the heart of everything we do. Our welfare officers are always there if you need to talk to them, confidentially, for any reason.

Our Core Values
Fairness We will treat people equally, with respect and kindness.
Dedication We will strive for personal and team improvement through knowledge and enthusiasm.
Spirit We will embrace honourable behaviour on and off the field.
Teamwork We will work together, understanding that any success is a collective effort.
Fun We will create a positive, happy culture and play with a smile on our faces.

Expectations for Parents, Coaches and Players
• Support each other with positive encouragement.
• Act with honesty across every aspect of the game.
• Attend practices and games regularly, arriving on time.
• Communicate constructively and feel able to challenge where appropriate.
• Show zero tolerance to any form of discrimination, bullying or unsporting action.
• Adhere to rules and guidelines regarding conduct.
• Enjoy victories and accept defeat with grace and humility.
• Abide by decisions, even if you disagree with them.
• Be helpful to others, taking pride as representatives of KWJFC and in yourself.

By participating in our club, parents, players and coaches agree to abide by the principles outlined in this charter. Coaches will talk effectively with players and parents, keeping them informed about their team ethos and expectations.

At the Wardens we want everyone to thrive and enjoy this wonderful game.