Privacy policy

STIRLING COUNTY RUGBY FOOTBALL CLUB (RFC)

PRIVACY NOTICE 

May 2018

This Privacy Notice describes how Stirling County Rugby Football Club (also referred to us “the Club”, “we”, “us” or “SCRFC”) collects, stores, and processes personal data we handle in relation to our members, players, coaches, referees, volunteers, and 200 Club members in order to manage the various relationships.  Wherever we’ve said “you” or “your”, this means you, any authorised persons (e.g. trustees or executors, attorneys under a Power of Attorney) and other related people (including authorised signatories, partners, members and trustees). 

This Privacy Notice provides further detail on what information SCRFC, in its role as a “Data Controller”, collects about you, how we will use that information, who we will share it with, the circumstances when we will share it, and what steps we will take to make sure it stays private and secure.

SCRFC REGISTRATION

If you register as a member of SCRFC or renew your membership (including if you are registering or renewing on behalf of a child under the age of 18), we will ask you for the following personal information: 

• Personal contact details:  name, address, postcode, date of birth, email address, contact numbers, gender; 
• Membership criteria/category:  playing, non-playing, senior, associate, youth/junior, family;
• Permission from parent/guardian of a junior member to participate in photographs used to publicise rugby events 

If you register as a volunteer of SCRFC or member of the 200 Club we will ask you for the following personal information: 

• Contact details:  name, address, postcode, email address, contact numbers; 
• Participation category:  Parent, Committee, 200 Club, etc.; 
• Any other personal information relevant to your involvement, i.e., PVG membership

HOW DO WE USE THIS INFORMATION, AND WHAT IS THE LEGAL BASIS FOR THIS USE? 

We process this personal data for the following purposes:

• To fulfil a contract, or take steps linked to a contract: this is relevant where you make a payment for your membership and any merchandise, or enter a competition. This includes:
  • Taking payments; 
  • Communicating with you;
  • Providing and arranging the delivery or other provision of products, prizes or services.

• As required by the Club to conduct our business and pursue our legitimate interests, in particular:
  • To manage and administer your membership and your involvement with its teams and club, and to keep in contact with you for these purposes;
  • Promote and encourage participation by sending members’ communications and booking information for upcoming competitions and events. Our competitions and events may be filmed or photographed and your personal information may also be used in images captured from our competitions and events, which we use for promotional, education and development purposes; 
  • Managing entries for our competitions and checking your personal information to ensure you are entered into the correct category; 
  • Monitor and develop participation by monitoring members’ engagement and participation and inviting our members to participate in surveys for researching and development purposes;
  • Invite our members as award winners or guests to our annual awards dinner/ceremony, which includes asking our members to nominate individuals for awards and shortlisting such individuals to select the winners, who we will then contact by email;
  • We need to collect personal information relating to criminal convictions or alleged commission of criminal offences where you are required to complete a PVG check under the Protection of Vulnerable Groups (Scotland) Act 2007. This information will include your PVG certificate number, PVG membership number, date of issue and any relevant information in relation to your membership of the PVG Scheme. If your PVG certificate is not clear, we will have a legitimate interest to collect references and any other applicable information to allow us to consider whether or not you can volunteer in a regulated role with children and/or vulnerable adults. 
  • Develop and maintain our members’ qualifications, including sending email communications to members to inform you of upcoming courses, renewal requirements and verify that you have completed any mandatory training and PVG/child protection requirements; 
  • Respond to and communicate with members regarding your questions, comments, support needs or complaints, concerns or allegations;
  • To investigate complaints, to suspend membership, take disciplinary action, etc.; 
  • We will also use data to maintain records of our performances and history, including match reports, score lines and team sheets, and details of any disciplinary issues you may be involved in on and off the pitch, such as within health and safety records;
  • We use CCTV cameras to maintain the security of our premises, and may use this video to investigate incidents at the Club or its premises;

Where we process your personal information in pursuit of our legitimate interests, you have the right to object to us using your personal information for the above purposes.  If you wish to object to any of the above processing, please contact us on hr@stirlingcounty-rfc.co.uk.  If we agree and comply with your objection, this may affect our ability to undertake the tasks above for the benefit of you as a member or a volunteer.

• Where you give us consent:
  • We will provide you with core member services, keeping you informed and up to date;
  • We will send you membership communications by post or email in relation to essential membership services, including but not limited to, general meeting notices, membership renewals, membership fees’ information, etc.; 
  • We may handle medical (including injury) information you or your parent provides to us, to ensure we support you appropriately;
  • On other occasions where we ask you for consent, we will use the data for the purpose which we explain at that time.

• For purposes which are required by law:
  • The Companies Act 2006/Charities and Trustee Investment (Scotland) Act 2005 to maintain a register of our members, which includes our members’ name, address, the date they were admitted to membership and the date on which they ceased to be our member, and hold general meetings, including issuing notices and voting arrangements;
  • Where you hold a role at the Club requiring us to check your right to work, we may process information to meet our statutory duties;
  • The Protection of Vulnerable Groups (Scotland) Act 2007 to check that our coaches and volunteers are able to undertake regulated work with children and vulnerable adults; 
  • The Equality Act 2010, which requires us to process personal information to make reasonable adjustments where necessary;
  • We maintain records such as health and safety records and accounting records in order to meet specific legal requirements; and 
  • We may respond to requests by government or law enforcement authorities conducting an investigation.

WHO WE SHARE YOUR PERSONAL INFORMATION WITH

If your personal information is included in any images or videos taken by us at our competitions and events, we may share this with our member base, followers on social media (Facebook and Twitter), SRU, and rugby teams at a minimum for promotional and/or journalistic purposes.

Players and Participants personal data including name, age, etc. may be published for the player and participant bios on our website, newsletters or match programmes. 

Some limited information may be shared with other stakeholders in rugby, such as the SRU, other clubs, Constituent Bodies, referee societies, league organisers, so that they can maintain appropriate records and assist us in organising matches; regulating, developing and managing the game; maintaining statistics; conducting analysis; ensuring compliance, and communication.

SCRFC may also share personal data with Scottish Rugby through Scottish Rugby’s Registration System (SCRUMS) and for other purposes such as PVG, insurance, disciplinary matters, etc.  

We will retain information held to maintain statutory records in line with appropriate statutory requirements or guidance.  We may be required to share personal information with statutory or regulatory authorities and organisations to comply with statutory obligations. Such organisations include the Health & Safety Executive, Disclosure Scotland, and Police Scotland.

For the purposes of safeguarding children we may also share personal information with our professional and legal advisors for the purposes of taking advice. 

SCRFC employs third party suppliers to provide services, including IT, payroll, etc. These suppliers may process personal information on our behalf as “processors” and are subject to written contractual conditions to only process that personal information under our instructions and protect it. In the event that we do share personal information with external third parties, we will only share such personal information strictly required for the specific purposes and take reasonable steps to ensure that recipients shall only process the disclosed personal information in accordance with those purposes.

Data is also shared with any relevant third parties to allow for the progression of tour-related organisational activities and this information may be shared internationally depending on the planned tour location.

Where information is transferred outside the EEA, and where this is to a stakeholder or vendor in a country that is not subject to an adequacy decision by the EU Commission, data is adequately protected by EU Commission approved standard contractual clauses, an appropriate Privacy Shield certification or a vendor’s Processor Binding Corporate Rules.  A copy of the relevant mechanism can be provided for your review on request. 

WHAT INFORMATION DO WE RECEIVE FROM THIRD PARTIES?

Sometimes, we receive information about you from third parties. For example, if you are a child, we may be given information about you by your parents. 

We may receive information relating to your existing registrations with other clubs or rugby bodies or disciplinary history from the SRU.  Additionally, for certain role holders or those working with children, we may receive information from Disclosure Scotland and SRU on the status of any PVG check you have been required to take. 

HOW WE PROTECT YOUR PERSONAL INFORMATION

Your personal information is stored in both paper and electronic filing systems.  Our servers are based in the UK and are accessed only by our staff or volunteers for the purposes set out above.  Paper files are stored securely in a locked filing cabinet with access strictly limited to the relevant personnel. 

We may be required to transfer your personal information outwith the EU for the purposes of entering players into competitions, booking travel arrangements for training camps, etc. 

Where your personal information is transferred outwith the EU, we will provide you with information regarding the safeguards that we have put in place with the recipient country to protect your personal information.

HOW LONG WE KEEP YOUR PERSONAL INFORMATION

Members 

We will only keep your personal information for as long as necessary to provide you with membership services. Unless you ask us not to, we will review and possibly delete your personal information where you have not renewed your membership with us for 6 years after submission. 

Players

We keep our players personal data for six (6) years after you cease playing for SCRFC.  

We have a data retention policy that sets out the periods for retaining and reviewing all information that we hold.  This sets out different retention periods and you can request a copy by contacting us at hr@stirlingcounty-rfc.co.uk. 

YOUR RIGHTS

You can exercise any of the following rights by writing to us at:

Your rights in relation to your personal information are: 

• You have a right to request access to the personal information that we hold about you by making a “Subject access request” (SAR); 
• If you believe that any of your personal information is inaccurate or incomplete, you have a right to request that we correct or complete your personal information; 
• You have a right to request that we restrict the processing of your personal information for specific purposes; and
•  If you wish us to delete your personal information, you may request that we do so. 

You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format. 

In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing). 

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping. 

Any requests received by SCRFC will be considered under applicable data protection legislation. If you remain dissatisfied, you have a right to raise a complaint with the Information Commissioner’s Office at www.ico.org.uk

This privacy notice may be updated at any time.