This Policy is to help clubs, Associations and football leagues deal with data protection matters internally. This should be kept with other club / Bolton & Bury District Football League (BBDFL) / Community Partnership League (CPL) / Lancashire FA policies and a copy should be given (or made available) to all volunteers and others who come into contact with personal data during the course of their involvement with the club.

The Club, Breightmet Wanderers AFC (“we”, “our”, “us”) handles personal data about current, former, and on occasion prospective players [and their parents or guardians], volunteers and committee members.

In your official capacity with the club you may process personal data on our behalf and we will process personal data about you. We recognise the need to treat all personal data in an appropriate and lawful manner, in accordance with the EU General Data Protection Regulation 2016/679 (GDPR).

Correct and lawful treatment of this data will maintain confidence in the club, and protect the rights of players and any other individuals associated with the club. This Policy sets out our data protection responsibilities and highlights the obligations of the club, which means the obligations of our committee, volunteers, members, and any other contractor or legal or natural individual or organisation acting for or on behalf of the club.

You (members and volunteers who come into contact with personal data) are obliged to comply with this policy when processing personal data on behalf of the Club and this policy will help you to understand how to handle personal data.

The Club's Committee will be responsible for ensuring compliance with this Policy. Any questions about this Policy or data protection concerns should be referred to the committee.

We process volunteer, member, referee, coach, manager, contractor, committee, supplier and third party personal data for administrative and Club management purposes. Our purpose for holding this personal data is to be able to contact relevant individuals on Club business and our legal basis for processing your personal data in this way is the contractual relationship we have with you. If you do not provide your personal data for this purpose, you will not be able to carry out your role or the obligations of your contract with the Club.

What we need from you

To assist with our compliance with GDPR we will need you to comply with the terms of this policy. We have set out the key guidance in this section but please read the full policy carefully.

Please help us to comply with the data protection principles (set out briefly in section 3 of this policy and in further detail below):
Please ensure that you only process data in accordance with our transparent processing as set out in our Privacy notice
Please only process personal data for the purposes for which we have collected it (i.e. club related activities)
Please do not ask for further information about players, members or volunteers without first checking with a member of the Club’s Committee
if you are asked to correct an individual’s personal data, please make sure that you can identify that individual and, where you have been able to identify them, make the relevant updates on your records and systems and ask the member to update their records online
Please comply with our retention periods listed in our Privacy Notice and make sure that if you still have information which falls outside of those dates, that you delete/destroy it securely (paper data must be shredded, and online data deleted from any hard drives)
Please treat all personal data as confidential. If data is stored in electronic format then please ensure that the documents themselves are password protected and that you limit the people who have access to the information to those who need it to fulfil their role within the Club. Please also consider the security levels of any cloud storage provider (and see below). If it is stored in hard copy format then please make sure it is locked away safely and is not kept in a car overnight or disposed of in a public place
If you are looking at using a new electronic system for the storage of information, please talk to a member of the Club’s Committee first so that we can decide whether such a system is appropriately secure and complies with GDPR
Do not share personal data with anybody new or with a party outside the Club
If you receive a subject access request (or you think somebody is making a subject access request for access to the information we hold on them) then please tell a member of the Club’s Committee as soon as possible because we have strict timelines in which to comply
If you think there has been a data breach (for example you have lost personal data or a personal device which contains personal data or you have been informed that a coach has done so, or you have sent an email and open copied all contacts in) then please speak to a member of the Club’s Committee who will be able to help you to respond

Data protection principles

Anyone processing personal data must comply with the enforceable principles of data protection. Personal data must be:

processed lawfully, fairly and in a transparent manner
collected for only specified, explicit and legitimate purposes
adequate, relevant and limited to what is necessary for the purpose(s) for which it is processed
accurate and, where necessary, kept up to date
kept in a form which permits identification of individuals for no longer than is necessary for the purpose(s) for which it is processed
processed in a manner that ensures its security by appropriate technical and organisational measures to protect against unauthorised or unlawful processing and against accidental loss, destruction or damage

We are responsible for, and must be able to demonstrate compliance with, the data protection principles listed above.

Fair and lawful processing

This Policy aims to ensure that our data processing is done fairly and without adversely affecting the rights of the individual.

Lawful processing means data must be processed on one of the legal bases set out in the GDPR. When special category personal data is being processed, additional conditions must be met.

Processing for limited purposes

The Club collects and processes personal data. This is data we receive directly from an individual and data we may receive from other sources.

We will only process personal data for the purposes of the Club as instructed by the committee, the BBDFL, CPL or The FA, or as specifically permitted by the GDPR, and as documented in the Club’s Privacy Policy.

Consent

One of the lawful bases on which we may be processing data is the individual’s consent.

An individual consents to us processing their personal data when they complete the registration form, or provide their details over email or text.

Individuals must be easily able to withdraw their consent at any time and withdrawal must be promptly honoured. Consents will be refreshed every season.

Explicit consent is usually required for automated decision-making and for cross-border data transfers, and for processing special category personal data. Where children are involved then the consent must be in writing from parent/guardian.

Where consent is our legal basis for processing, we will need to keep records of when and how this consent was captured.

Our Privacy Notice sets out the lawful bases on which we process data of our players and members.

Notifying individuals

Where we collect personal data directly from individuals, we will inform them in the Privacy Notice about:

the purpose(s) for which we intend to process that personal data
the legal/lawful basis on which we are processing that personal data
where that legal/lawful basis is a legitimate interest, what that legitimate interest is
where that legal/lawful basis is statutory or contractual, any possible consequences of failing to provide that personal data
the types of third parties, if any, with which we will share that personal data, including any international data transfers
their rights as data subjects, and how they can limit our use of their personal data
the period for which data will be stored and how that period is determined
any automated decision-making processing of that data and whether the data may be used for any further processing, and what that further processing is
If we receive personal data about an individual from other sources, we will provide the above information as soon as possible and let them know the source we received their personal data from

We will also inform those whose personal data we process that we, the Club are the data controller in regard to that data, and which individual(s) in the Club are responsible for data protection.

Adequate, relevant and non-excessive processing

We will only collect personal data that is required for the specific purpose notified to the individual.

You may only process personal data if required to do so in your official capacity with the Club. You cannot process personal data for any reason unrelated to your duties.

The Club must ensure that when personal data is no longer needed for specified purposes, it is deleted or anonymised.

Accurate data

We will ensure that personal data we hold is accurate and kept up to date. We will check the accuracy of any personal data at the point of collection and at the start of each season. We will take all reasonable steps to destroy or amend inaccurate or out-of-date data.

Timely processing

We will not keep personal data longer than is necessary for the purpose(s) for which they were collected. We will take all reasonable steps to destroy or delete data which is no longer required, as per our Privacy Notice.

Processing in line with data subjects’ rights

As data subjects, all individuals have the right to:

be informed of what personal data is being processed
request access to any data held about them by a data controller
object to processing of their data for direct-marketing purposes (including profiling)
ask to have inaccurate or incomplete data rectified
be forgotten (deletion or removal of personal data)
restrict processing
data portability
not be subject to a decision which is based on automated processing

The Club is aware that not all individuals’ rights are absolute, and any requests regarding the above should be immediately reported to the committee, and if applicable escalated to the SAL for guidance.

Data security

We will take appropriate security measures against unlawful or unauthorised processing of personal data, and against the accidental loss of, or damage to, personal data.

We have proportionate procedures and technology to maintain the security of all personal data.

Personal data will only be transferred to another party to process on our behalf (a data processor) where we have a GDPR-compliant written contract in place with that data processor.

We will maintain data security by protecting the confidentiality, integrity and availability of the personal data.

Our security procedures include:

Entry controls Any stranger seen in entry-controlled areas should be reported
Secure desks, cabinets and cupboards Desks and cupboards should be locked if they hold personal data
Methods of disposal Paper documents should be shredded. Digital storage devices should be physically destroyed
Equipment Screens and monitors must not show personal data to passers-by, and should be locked when unattended. Excel spreadsheets will be password protected
Personal Devices Anyone accessing or processing Club’s personal data on their own device, must have and operate a password only access or similar lock function, and should have appropriate anti-virus protection. These devices must have the Club’s personal data removed prior to being replaced by a new device or prior to such individual ceasing to work with or support the Club

Disclosure and sharing of personal information

We share personal data with BBDFL, CPL and The FA, and with applicable leagues using the Whole Game System.

We may share personal data we hold if we are under a duty to disclose or share an individual’s personal data in order to comply with any legal obligation, or in order to enforce or apply any contract with the individual or other agreements; or to protect our rights, property, or safety of our players, other individuals associated with the Club or others.

Transferring personal data to a country outside the EEA

We may transfer any personal data we hold to a country outside the European Economic Area (EEA), provided that one of the appropriate safeguards applies.

Reporting a personal data breach

In the case of a breach of personal data, we may need to notify the applicable regulatory body and the individual.

If you know or suspect that a personal data breach has occurred, inform a member of the committee immediately, who may need to escalate to the league as appropriate. You should preserve all evidence relating to a potential personal data breach.

Dealing with subject access requests

Individuals may make a formal request for information we hold about them. Anyone who receives such a request should forward it to the committee immediately, and where necessary escalated to the league for guidance. Nobody should feel bullied or pressured into disclosing personal information.

When receiving telephone enquiries, we will only disclose personal data if we have checked the caller’s identity to make sure they are entitled to it.

Accountability

The Club must implement appropriate technical and organisational measures to look after personal data, and is responsible for, and must be able to demonstrate compliance with the data protection principles.

The Club must have adequate resources and controls in place to ensure and to document GDPR compliance, such as:

providing fair processing notice to individuals at all points of data capture
training committee and volunteers on the GDPR, and this Data Protection Policy
reviewing the privacy measures implemented by the Club

Changes to this policy

We reserve the right to change this policy at any time. Where appropriate, we will notify you by email.