What information do we collect?
We collect and process personal data from you or your parent when you initially join WRFC, when we carry out annual renewals of your membership, when a disciplinary or safeguarding incident is raised or when you are employed by WRFC.
This may include:
• your name,
• your gender,
• your date of birth,
• your RFU ID (as assigned in GMS)
• your home address, email address and phone number;
• your passport and NI details to check your eligibility or ability to work for us;
• your type of membership
• your involvement in particular teams
• your allocated key role, such as Chair, Safeguarding Lead, Membership Secretary etc.;
• your bank account details, where you pay for membership or for employment purposes.
• your marketing preferences
• your medical conditions or disability
• your school name & address (players under the age of 18)
• Your image.
• players performance
• match reports
• Incident details for disciplinary reports
• Incident details for completing safeguarding reports

What information do we receive from third parties?
Sometimes, we receive information about you from third parties. For example, if you are a child, we may be given information about you by your parents.
We may receive information from other clubs or rugby bodies or disciplinary history from the RFU through GMS. Additionally, for certain role holders, we may receive information from the DBS.

How do we use this information, and what is the legal basis for this use?
We process this personal data for the following purposes:
• To fulfil a contract, this includes:
o Taking/making payments;
o communicating with you;
o providing and arranging the delivery products, prizes or services;
• As required by the Club to conduct our business and pursue our legitimate interests, in particular:
o to manage and administer your membership and RFU player registration
o to manage your involvement with its teams and club
o to keep in contact with you for these purposes
o to maintain records of performances and history
o we use CCTV cameras to maintain the security of our premises
o to send you promotional materials and offers relating to similar products and services relating to rugby. These could be from the RFU, our sponsors or relevant companies.
o to invite you to take part in market research
o To produce safeguarding reports
o To produce disciplinary reports
• Where you give us consent:
o we will send you direct marketing or promotional material by email;
o we may handle medical or disability information to ensure we support you appropriately;
o on other occasions we will use the data for the purpose which we explain at that time.
o we may take photographic images and videos for the purposes of such activities as match analysis, club promotion and match reports. We will never identify any children under the age of 18 in such images.
• For purposes which are required by law:
o we maintain records such as health and safety, safeguarding and accounting records in accordance with our specific legal requirements;
o we ensure, that those who work with children, have undergone an appropriate DBS check.
o where you hold a role at the Club requiring us to check your right to work
o we may respond to requests by government or law enforcement authorities conducting an investigation.

What information does the RFU collect?
The RFU provides GMS, but make its own use of the following information:
• your name, gender, date of birth, RFU ID number, school name, home address, email address and phone number
• your type of membership and involvement in particular teams or any key role you have been allocated, such as Chair, Safeguarding Lead, Membership Secretary etc.
The RFU uses this information as follows:
• As required by the RFU to conduct its business and pursue its legitimate interests, in particular:
o communicating with you to administer or improve Rugby in England
o administering and ensuring the eligibility of players, match officials and others involved in English rugby
o maintaining records of the game, in particular details of discipline and misconduct;
o monitoring use of GMS to improve and protect its content and services
o maintaining statistics and conducting analysis on the make-up of rugby’s participants;
o ensuring compliance with the current RFU Rules and Regulations including those on the affiliation of clubs, referee societies, constituent bodies and other rugby bodies, and registration of players;
• For purposes which are required by law:
o The RFU will ensure, that those who work with children have undergone an appropriate DBS check
o The RFU may respond to requests by government or law enforcement authorities conducting an investigation.

Who will we share this data with, where and when?
For the purpose of maintaining appropriate records and assist us in organising matches and administering the game we may share some limited information with the following
• The RFU
• GMS
• Club Officials
• Other clubs
• Referee societies
• League organisers
• Constituent Bodies
• Third parties Pitchero (our website provider)
• Go Cardless (membership collection provider)
Personal data may be shared with government authorities and/or law enforcement officials if required.

How long will you retain my data?
o We process the majority of your data for as long as you are an active member and for 3 years after this.
o For marketing purposes we process the data for the length of your membership
o For contractual agreements, we keep the data for 6 years from your last interaction with us.
o We will retain information held to maintain statutory records in line with appropriate statutory requirements or guidance.
o Records of your involvement in a particular may be held indefinitely both by us and the RFU in order to maintain a record of the game.
o The RFU will maintain records of individuals on GMS, DBS records or disciplinary matters for such period as is set out in the RFU’s privacy notice.
o Our club operate CCTV. Images are recorded and stored securely and deleted after a retention period (currently 10 days). In the event of criminal activity or anti-social behaviour being investigated by the police, we will pass a copy of the recorded images on to them for their use & storage.

What rights do I have?
• You have the right to ask us for a copy of your personal data
• You can object to the processing of your personal data in some circumstances
• You have the same rights for data held by the RFU for its own purposes on GMS.
• To exercise any of these rights, you can get in touch with us or, as appropriate, the RFU – using the details set out below.

How do I get in touch with you or the RFU?
If you have any concerns about how we process your data, or would like to opt out of direct marketing, you can get in touch at becky.skinner@withycomberugby.co.uk or by writing to Rebecca Skinner (Data Officer) c/o Withycombe RFC, Hulham Road, Exmouth Devon EX8 3HS
If you have any concerns about how the RFU process your data, you can get in touch at legal@rfu.com or by writing to The Data Protection Officer, Rugby Football Union, Twickenham Stadium, 200 Whitton Road, Twickenham TW2 7BA.