This Privacy Notice describes how Stirling County Rugby Football Club (also referred to us “the Club”, “we”, “us” or “SCRFC”) collects, stores, and processes personal data we handle in relation to our members, players, coaches, referees, volunteers, and 200 Club members in order to manage the various relationships. Wherever we’ve said “you” or “your”, this means you, any authorised persons (e.g. trustees or executors, attorneys under a Power of Attorney) and other related people (including authorised signatories, partners, members and trustees).
This Privacy Notice provides further detail on what information SCRFC, in its role as a “Data Controller”, collects about you, how we will use that information, who we will share it with, the circumstances when we will share it, and what steps we will take to make sure it stays private and secure.
If you register as a member of SCRFC or renew your membership (including if you are registering or renewing on behalf of a child under the age of 18), we will ask you for the following personal information:
If you register as a volunteer of SCRFC or member of the 200 Club we will ask you for the following personal information:
HOW DO WE USE THIS INFORMATION, AND WHAT IS THE LEGAL BASIS FOR THIS USE?
We process this personal data for the following purposes:
Where we process your personal information in pursuit of our legitimate interests, you have the right to object to us using your personal information for the above purposes. If you wish to object to any of the above processing, please contact us on email@example.com. If we agree and comply with your objection, this may affect our ability to undertake the tasks above for the benefit of you as a member or a volunteer.
WHO WE SHARE YOUR PERSONAL INFORMATION WITH
If your personal information is included in any images or videos taken by us at our competitions and events, we may share this with our member base, followers on social media (Facebook and Twitter), SRU, and rugby teams at a minimum for promotional and/or journalistic purposes.
Players and Participants personal data including name, age, etc. may be published for the player and participant bios on our website, newsletters or match programmes.
Some limited information may be shared with other stakeholders in rugby, such as the SRU, other clubs, Constituent Bodies, referee societies, league organisers, so that they can maintain appropriate records and assist us in organising matches; regulating, developing and managing the game; maintaining statistics; conducting analysis; ensuring compliance, and communication.
SCRFC may also share personal data with Scottish Rugby through Scottish Rugby’s Registration System (SCRUMS) and for other purposes such as PVG, insurance, disciplinary matters, etc.
We will retain information held to maintain statutory records in line with appropriate statutory requirements or guidance. We may be required to share personal information with statutory or regulatory authorities and organisations to comply with statutory obligations. Such organisations include the Health & Safety Executive, Disclosure Scotland, and Police Scotland.
For the purposes of safeguarding children we may also share personal information with our professional and legal advisors for the purposes of taking advice.
SCRFC employs third party suppliers to provide services, including IT, payroll, etc. These suppliers may process personal information on our behalf as “processors” and are subject to written contractual conditions to only process that personal information under our instructions and protect it. In the event that we do share personal information with external third parties, we will only share such personal information strictly required for the specific purposes and take reasonable steps to ensure that recipients shall only process the disclosed personal information in accordance with those purposes.
Data is also shared with any relevant third parties to allow for the progression of tour-related organisational activities and this information may be shared internationally depending on the planned tour location.
Where information is transferred outside the EEA, and where this is to a stakeholder or vendor in a country that is not subject to an adequacy decision by the EU Commission, data is adequately protected by EU Commission approved standard contractual clauses, an appropriate Privacy Shield certification or a vendor’s Processor Binding Corporate Rules. A copy of the relevant mechanism can be provided for your review on request.
WHAT INFORMATION DO WE RECEIVE FROM THIRD PARTIES?
Sometimes, we receive information about you from third parties. For example, if you are a child, we may be given information about you by your parents.
We may receive information relating to your existing registrations with other clubs or rugby bodies or disciplinary history from the SRU. Additionally, for certain role holders or those working with children, we may receive information from Disclosure Scotland and SRU on the status of any PVG check you have been required to take.
HOW WE PROTECT YOUR PERSONAL INFORMATION
Your personal information is stored in both paper and electronic filing systems. Our servers are based in the UK and are accessed only by our staff or volunteers for the purposes set out above. Paper files are stored securely in a locked filing cabinet with access strictly limited to the relevant personnel.
We may be required to transfer your personal information outwith the EU for the purposes of entering players into competitions, booking travel arrangements for training camps, etc.
Where your personal information is transferred outwith the EU, we will provide you with information regarding the safeguards that we have put in place with the recipient country to protect your personal information.
HOW LONG WE KEEP YOUR PERSONAL INFORMATION
We will only keep your personal information for as long as necessary to provide you with membership services. Unless you ask us not to, we will review and possibly delete your personal information where you have not renewed your membership with us for 6 years after submission.
We keep our players personal data for six (6) years after you cease playing for SCRFC.
We have a data retention policy that sets out the periods for retaining and reviewing all information that we hold. This sets out different retention periods and you can request a copy by contacting us at firstname.lastname@example.org.
You can exercise any of the following rights by writing to us at:
Data Protection Officer,
Stirling County RFC,
STIRLING, FK9 5AP.
Your rights in relation to your personal information are:
You have the right to ask us for a copy of your personal data; to correct, delete or restrict (stop any active) processing of your personal data; and to obtain the personal data you provide to us for a contract or with your consent in a structured, machine readable format.
In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement, or where we are using the data for direct marketing).
These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.
Any requests received by SCRFC will be considered under applicable data protection legislation. If you remain dissatisfied, you have a right to raise a complaint with the Information Commissioner’s Office at www.ico.org.uk
This privacy notice may be updated at any time.