Privacy & Data Protection

1. Privacy notice

Who is responsible? The proposed data controller is Rushden & Higham Rugby Union Football Club (RHRFC), acting through its club committee. This designation and the club's legal identity must be confirmed by the committee.

Why we use information. We use the Club Check-In app and Parent Portal to organise Mini Section activities, record attendance, plan fixtures, collect availability responses, manage parent/carer access and maintain the security of the service.

Information we may hold

• Child's name, age group and, where provided, school year.
• Attendance at training sessions and other club activities.
• Match and event availability, including available, unavailable or unsure responses.
• Parent or carer's name and account/PIN verification information.
• Family-sharing links and records of which parent/carer submitted or updated a response.
• Submission and update dates, fixture details and relevant system/security records.
• Technical information generated by the services used to operate and protect the system, which may include device, browser, network or access-log information depending on supplier configuration.

The system is not intended to collect parent contact details, children's medical information or other sensitive information for routine attendance and availability. If a new feature requires this information, the club should review the purpose, lawful basis, safeguards and privacy notice before collecting it.

Who can see information?

• Coaches can access information needed for the age groups they are authorised to manage.
• Designated senior administrators can access wider club information and manage user access.
• Parents/carers can view and manage the relevant family responses available to their account, including where family sharing has been linked.
• Technical service providers may process limited information to host, deliver, secure or support the service.

Player information is not intended to be publicly displayed. Access should be restricted to authorised people with a genuine club-related need.

Lawful basis and sharing

The proposed lawful basis for routine club administration is legitimate interests, subject to a documented assessment and committee approval. The club must identify and document any additional lawful basis required for a particular activity. Information may be shared where necessary for club operations, safeguarding, an emergency, legal obligations or another properly authorised purpose. It is not used for unrelated marketing.

How long information is kept

The proposed retention periods are set out in the Retention Policy below. These periods remain provisional until approved by the club after checking applicable RFU, safeguarding, insurance and legal requirements.

Your rights

Parents/carers and, where appropriate, players can ask the club to explain what information it holds, request a copy, correct inaccurate information, or raise a concern about how information is used. Some rights depend on the circumstances and applicable law. Requests should be directed to the club through its usual official contact route and marked for the Data Protection Lead.

You can also raise a concern with the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint.

2. Acceptable use policy

This policy applies to coaches, senior administrators and anyone given access to the protected areas of Club Check-In.

• Access is personal and must only be used by the person it was issued to.
• Coach access must be limited to the age groups the coach is authorised to manage.
• Senior/admin access is restricted to people specifically authorised by the club.
• PINs, passwords, invitation links and other access credentials must not be shared or reused by another person.
• Information must only be viewed or used for a legitimate club purpose.
• Player or parent information must not be copied, downloaded, photographed, screenshotted or circulated unless there is a genuine need and the club has authorised it.
• Personal copies of registers or availability lists must not be retained indefinitely or stored in unsecured locations.
• Information must not be used for personal purposes, marketing or unrelated contact.
• Suspected loss, misuse, unauthorised access or accidental disclosure must be reported promptly to the club's designated contact.
• Access must be reviewed and removed when a person leaves their coaching or administrative role or no longer needs access.
• The club may review access and system activity for security, audit and investigation purposes.

Access may be suspended while a suspected breach or misuse is investigated.

3. Data retention policy

The periods below are proposals for committee review, not statutory retention periods. Information should not be kept longer than necessary. A record may need to be retained or placed on hold where there is an active safeguarding, insurance, legal or incident-related reason.

Deletion and backups

Deletion should cover active records and any copies controlled by the club. Supplier backups may persist for a limited period under the supplier's backup cycle; the club must document the actual arrangements rather than promise immediate deletion from every backup. Records subject to a legitimate hold must be restricted and reviewed.

4. Data protection responsibilities

Proposed data controller: Rushden & Higham RUFC, acting through its committee, subject to formal confirmation.

The technical administrator is not automatically the person accountable for the club's data protection decisions. The committee should appoint a named lead and publish an appropriate club contact route.

Data incidents

Any suspected personal data breach must be reported to the club promptly. The club should record what happened, what information and people were affected, what action was taken and whether notification to the ICO or affected individuals is required. Where notification to the ICO is required, the legal time limit is generally 72 hours from awareness of the breach.

5. Supplier and hosting review

The following is an initial supplier register. It identifies services currently understood to be involved; the club must verify the live account configuration, contractual terms, data locations, subprocessors and retention settings before approving it.

Suppliers may act as processors or independent controllers depending on the service and activity. The club should not assume every supplier has the same legal role. Relevant data processing terms and international transfer safeguards must be checked and recorded.

6. Review, approval and contact

• Document owner: RHRFC committee – proposed.
• Data Protection Lead: To be appointed.
• Approval status: Draft – not yet approved by the club committee.
• Review frequency: At least annually and whenever a significant new feature, supplier or use of personal information is introduced.
• Next review: To be set following committee approval.

Before formal approval, the club should complete a documented legitimate interests assessment, confirm its controller details and contact route, approve retention periods, verify supplier arrangements and complete a DPIA screening exercise to decide whether a full Data Protection Impact Assessment is required.

For questions or requests, contact the club through its usual official contact channel and ask for the Data Protection Lead. The named contact will be added here once appointed.