South Shields Westoe RFC

Data Protection/Privacy Policy

This policy sets out South Shields Westoe RFC’s (the club) commitment to protecting
personal data and how that commitment is implemented with regards to the collection
and use of personal data.

The club will collect and hold necessary data on:

• members of the club;
• parents of junior players and supporters who submit personal data;
• sponsors and business partners;
• referees and other officials.

The club is committed to:

• ensuring that it complies with the eight data protection principles, as listed
below
• meeting its legal obligations as laid down by the Data Protection Act 1998,
although as a ‘not-for-profit’ organisation, it is not required to register with theInformation Commissioner’s Office (ICO);
• ensuring that data is collected and used fairly and lawfully
• processing personal data only in order to meet its operational needs or to fulfill
its legal requirements
• taking steps to ensure that personal data is up to date and accurate
• establishing appropriate retention periods for personal data
• ensuring that data subjects' rights can be appropriately exercised
• providing adequate security measures to protect personal data
• ensuring that a nominated officer is responsible for data protection compliance
and provides a point of contact for all data protection issues
• ensuring that all club officers are made aware of good practice in data
protection
• providing adequate training for all staff responsible for personal data
• ensuring that everyone handling personal data knows where to find further
guidance
• ensuring that queries about data protection, internal and external to the
organisation, are dealt with effectively and promptly
• regularly reviewing data protection procedures and guidelines within the club

Data protection principles

Personal data shall be processed fairly and lawfully

• data is only collected with the consent of the data subject (or in the case of
junior members with the consent of parents);
• data on players and coaches will be passed to the RFU and to Durham County
RFU for competition and other appropriate purposes;

Personal data shall be obtained for one or more specified and lawful purposes, and
shall not be further processed in any manner incompatible with that purpose or
those purposes

Personal data shall be adequate, relevant and not excessive in relation to the
purpose or purposes for which they are processed

this data may include:

• ethnicity and disability data which may be used to identify and keep under
review equality of opportunity at the Club and within the game, and(anonymously) for statistical and reporting purposes;
• Injuries data which may be used to identify and keep under review equality
of opportunity at the Club and within the game, and (anonymously) forstatistical and reporting purposes;
• criminal records data - the RFU is registered with the Criminal Records
Bureau (CRB) to assist it in ensuring that those who take up appointmentsdo not pose a risk to the children in its care and as such RFU may processcriminal records data disclosed by the CRB, which will be processed inaccordance with the CRB’s Code of Practice.

Personal data shall be accurate and, where necessary, kept up to date

• all data will be factual, accurate and subject to regular updating.

Personal data processed for any purpose or purposes shall not be kept for longer
than is necessary for that purpose or those purposes

• data which is no longer relevant will, after a reasonable period, be destroyed.

Personal data shall be processed in accordance with the rights of data subjects
under the Data Protection Act 1998.

Appropriate technical and organisational measures shall be taken against
unauthorised and unlawful processing of personal data and against accidental loss
or destruction of, or damage to, personal data

• all paper records will be kept secure and physical access will be restricted to
officials of the club and to the data subject;
• all electronically held data will be kept secure and officials of the club who
work either at home or using mobile devices to are required by the club toensure that data is secure with adequate firewalls, virus protection etc in placeand that laptops and other mobile devices are kept physically secure.

Personal data shall not be transferred to a country or territory outside the
European Economic Area unless that country or territory ensures an adequate
level of protection for the rights and freedoms of data subjects in relation to the
processing of personal data

Data Subject Access Requests

The data subject may request access to records held by the club on him/her.Such
information will be provided within 40 days of the request. The club may charge
of fee of £10 for the disclosure. Data will only be disclosed if:

• a living individual can be identified from the data;
• the data relates to the identifiable living individual, whether in personal or
family life, business or profession;
• that data is obviously about a particular individual;
• the data linked to the individual provides particular information about that
individual;
• the data is used to inform or influence actions or decisions affecting an
identifiable individual;
• the data has biographical significance in relation to the individual;
• the data focuses or concentrates on the individual as its central theme rather
than some other person; or
• the data impacts or has the potential to impact on an individual whether in a
person, family, business or professional capacity.

Data will not be disclosed in such a way as would identify a third party.

The following statement will be attached to all club communication which requires
personal detail to be entered

DATA PROTECTION ACT

The information that is required in this document may be stored on a computer and, if
so, it is subject to the Data Protection Act 1984. The Act requires that all the
information is strictly confidential and may only be accessed by those with the legal
right to see it. The information will not be given to anyone else without your written
consent.

You have the right to examine the information that is stored on a computer at any
reasonable time. You have a right to correct any information that you feel is wrong or
misleading. Please contact the Club Secretary or Club Registration Officer if you wish
to examine the information stored about you or your child
_____________________________________________________________________
Further reference may be made to
www.rfu.com/managingrugby/clubdevelopment/legalandadmin/dataprotection