At London Scottish Rugby Club, we are committed to protecting the privacy and security of our members' personal data in accordance with the General Data Protection Regulation (GDPR) and related UK data protection legislation. This policy outlines how we collect, use, store, and protect the personal data of our players, officials, and members, ensuring compliance with legal requirements and best practices.

Scope

This policy applies to all personal data processed by the club, including information collected on players, officials, members, and other individuals associated with the club.

Data Collection

What We Collect: We collect personal data necessary for club operations, which may include names, addresses, email addresses, telephone numbers, dates of birth, health information for injury management and safeguarding, and payment details for membership fees and merchandise.
How We Collect Data: Data is collected via membership forms, online registration systems, competition entry forms, and directly from individuals during club-related activities.

Purpose of Data Processing

To manage club membership and registrations.
To organise competitions and events.
To communicate club news, events, and promotions.
To fulfil contractual obligations with members and participants.
To ensure the safety and security of members, particularly minors and vulnerable adults.

Data Sharing and Disclosure

Personal data may be shared with regulatory bodies like the Rugby Football Union (RFU) as required by the rules of the sport and for competition purposes.
We may also share data with third parties providing services on our behalf, such as medical staff, equipment suppliers, and event organisers, under strict data protection agreements.
Data will not be shared with other third parties without explicit consent unless legally required.

Data Security

We implement robust security measures to protect data from unauthorised access, alteration, disclosure, or destruction.
Measures include technical controls, secure storage solutions, and employee training on data protection.

Data Retention

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, as detailed in our retention policy, or as required by law.
Data used for historical or statistical purposes will be anonymised where possible.

Rights of Data Subjects

Access: Individuals have the right to access their personal data held by the club.
Correction: Individuals have the right to request correction of inaccurate or incomplete data.
Erasure: Under certain circumstances, individuals may request the deletion of their data.
Restriction: Individuals may request restriction on the processing of their data.
Objection: Individuals have the right to object to the processing of their data based on their particular situation.
Data Portability: Individuals have the right to receive their data in a structured, commonly used, and machine-readable format.

Consent

Where we rely on consent to process personal data, individuals have the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Complaints

If you believe that your data has been handled incorrectly, you may submit a complaint to the Chair of the relevant section within the club.

Policy Review and Updates

This policy will be reviewed and updated regularly to ensure ongoing compliance with data protection laws and to reflect any changes in our operations or legal requirements.

At London Scottish Rugby Club, we take our responsibility to protect the personal data of our members seriously. This GDPR policy ensures that all personal data is processed transparently, fairly, and securely, respecting the privacy rights of individuals.