Newquay Hornets Rugby Football Club ("Newquay Hornets RFC", "the Club", "we", "our" or "us") is committed to maintaining high standards of data protection, information security and responsible data management.

The Club recognises that personal information is an important responsibility and that everyone involved in its administration, coaching, management and wider activities has a duty to handle information appropriately.

This policy establishes the principles, procedures and responsibilities that govern how personal information is collected, accessed, stored, used, shared, retained and securely disposed of.

It applies to all individuals who handle personal information on behalf of Newquay Hornets RFC, including committee members, coaches, team managers, volunteers, employees and other authorised representatives.

The policy is designed to support compliance with:

UK General Data Protection Regulation (UK GDPR).

Data Protection Act 2018.

Privacy and Electronic Communications Regulations (PECR), where applicable.

Relevant Rugby Football Union (RFU) regulations and guidance.

Other applicable data protection and safeguarding requirements.

2. Purpose of This Policy

The purpose of this policy is to:

Protect the personal information of Club members and individuals involved with the Club.

Establish clear responsibilities for handling personal information.

Ensure information is collected and used for appropriate purposes.

Prevent unauthorised access, disclosure, alteration or loss of information.

Establish consistent data storage and retention arrangements.

Protect the personal information of children and young people.

Ensure appropriate procedures are followed when sharing information.

Provide guidance for responding to data protection requests and incidents.

Promote a culture of accountability and responsible information management.

3. Scope of This Policy

This policy applies to all personal information processed by or on behalf of Newquay Hornets RFC.

It covers information relating to:

Senior players.

Junior and youth players.

Parents, carers and guardians.

Club members.

Coaches and team managers.

Committee members.

Volunteers.

Match officials.

Sponsors and commercial partners.

Supporters and website visitors.

Other individuals who interact with the Club.

It applies to information held in both electronic and physical formats, including databases, spreadsheets, emails, registration forms, documents, photographs, videos and paper records.

All individuals acting on behalf of the Club are expected to follow this policy.

4. Data Protection Principles

Newquay Hornets RFC will follow the seven principles of data protection established under UK GDPR.

4.1 Lawfulness, Fairness and Transparency

Personal information must be collected and processed lawfully, fairly and transparently.

Individuals should understand why their information is being collected, how it will be used and who it may be shared with.

4.2 Purpose Limitation

Personal information must only be collected for specified, explicit and legitimate purposes.

Information must not be used for unrelated purposes without an appropriate lawful basis.

4.3 Data Minimisation

The Club must only collect and retain personal information that is necessary for the intended purpose.

Unnecessary information should not be requested or retained.

4.4 Accuracy

Personal information must be accurate and kept up to date where necessary.

Individuals should be able to request corrections to inaccurate or incomplete information.

4.5 Storage Limitation

Personal information must not be retained for longer than necessary.

Information that is no longer required must be securely deleted, destroyed or anonymised.

4.6 Integrity and Confidentiality

Personal information must be protected against unauthorised access, accidental loss, destruction or disclosure.

Appropriate security measures must be implemented to maintain confidentiality.

4.7 Accountability

The Club must be able to demonstrate that it complies with its data protection responsibilities.

Relevant policies, procedures, records and security arrangements must be maintained.

5. Roles and Responsibilities

Everyone involved in the administration and operation of Newquay Hornets RFC has a responsibility to protect personal information.

5.1 Club Committee

The Club Committee is responsible for overseeing the Club's approach to data protection and ensuring appropriate arrangements are in place.

This includes:

Approving and reviewing data protection policies.

Ensuring appropriate data security measures are implemented.

Supporting compliance with relevant legislation.

Ensuring individuals handling personal information understand their responsibilities.

Reviewing significant data protection incidents.

Ensuring appropriate resources are available for data management.

5.2 Data Protection Lead

The Club should appoint a designated individual to oversee data protection matters.

The Data Protection Lead will be responsible for:

Acting as the main point of contact for data protection enquiries.

Supporting the implementation of this policy.

Monitoring data handling practices.

Coordinating responses to data protection requests.

Supporting the investigation of data breaches.

Maintaining relevant data protection documentation.

Advising the Committee on data protection responsibilities.

The appointed individual does not automatically become the Club's formal Data Protection Officer (DPO). A statutory DPO should only be appointed where legally required or otherwise considered appropriate.

5.3 Committee Members

Committee members must:

Only access personal information necessary for their responsibilities.

Keep personal information confidential.

Store documents securely.

Avoid sharing information through unauthorised channels.

Report suspected data breaches promptly.

5.4 Coaches and Team Managers

Coaches and team managers must:

Only access information relevant to their team responsibilities.

Protect player and parent contact information.

Handle medical and emergency information securely.

Avoid sharing personal information unnecessarily.

Follow the Club's safeguarding and communication procedures.

Report any suspected loss or disclosure of information.

5.5 Volunteers and Other Representatives

Anyone handling personal information on behalf of the Club must follow this policy and any relevant instructions issued by the Committee or Data Protection Lead.

6. Collecting Personal Information

Personal information must only be collected where there is a genuine Club-related requirement.

Information may be collected through:

Pitchero membership and registration facilities.

RFU Game Management System (GMS).

Membership application forms.

Player registration forms.

Parent and guardian information forms.

Medical and emergency contact forms.

Website contact forms.

Email correspondence.

Club events and activities.

Other authorised registration or administration systems.

When collecting personal information, the Club should:

Explain why the information is required.

Identify the relevant lawful basis for processing.

Collect only information that is necessary.

Provide appropriate privacy information.

Obtain consent where consent is the appropriate lawful basis.

Take additional care when collecting information about children.

Personal information must not be collected informally or unnecessarily simply because it may be useful in the future.

7. Categories of Personal Information

The Club may handle several categories of information.

7.1 General Personal Information

This includes names, addresses, telephone numbers, email addresses, dates of birth and membership details.

7.2 Membership and Rugby Information

This includes player registrations, team allocations, playing history, eligibility information, fixtures, participation and membership payments.

7.3 Special Category Personal Information

This may include health and medical information, certain safeguarding information and other information requiring additional protection under data protection legislation.

Special category information must only be processed where an appropriate Article 9 UK GDPR condition and lawful basis apply.

Access must be restricted to authorised individuals who genuinely require the information.

7.4 Financial Information

This may include membership payments, invoices, transaction records, refunds and other relevant financial information.

Payment card details and banking credentials must not be collected or stored unnecessarily by the Club.

7.5 Photographic and Video Information

Photographs and videos may identify individuals and therefore constitute personal data.

Their collection, storage and publication must follow the Club's photography arrangements, safeguarding procedures and applicable data protection requirements.

8. Data Storage and Security

The Club must ensure that personal information is stored securely and can only be accessed by authorised individuals.

8.1 Electronic Records

Electronic information should be stored using approved Club systems and accounts wherever possible.

These may include:

Pitchero.

RFU Game Management System (GMS).

Authorised Club email accounts.

Approved cloud storage facilities.

Other authorised administrative systems.

Individuals must:

Use strong, unique passwords.

Enable multi-factor authentication where available.

Keep login credentials confidential.

Avoid sharing accounts.

Lock devices when unattended.

Keep software and devices updated.

Avoid downloading personal information onto unapproved devices.

Remove access when their Club responsibilities end.

8.2 Paper Records

Physical documents containing personal information must be stored securely.

They should:

Be kept in locked cabinets or secure offices.

Only be accessible to authorised individuals.

Not be left unattended in public or shared areas.

Not be taken away from Club premises unless necessary and appropriately secured.

Be securely destroyed when no longer required.

8.3 Personal Devices

Where individuals use personal phones, tablets or computers for Club administration, they must take reasonable precautions to protect personal information.

This includes using device passwords, keeping software updated and ensuring personal information is not accessible to other unauthorised users.

Sensitive medical, safeguarding or personal information should not be stored on personal devices unless specifically authorised and appropriately protected.

9. Access to Personal Information

Access to personal information must be based on an individual's Club responsibilities and genuine operational requirements.

The Club will apply the principle of least-privilege access.

This means individuals should only have access to the information necessary to perform their role.

Examples include:

Coaches accessing relevant team and player information.

Team managers accessing relevant player and parent contact information.

Safeguarding personnel accessing information required to manage welfare concerns.

Committee members accessing information necessary for their responsibilities.

The Treasurer accessing relevant financial records.

Being a Club official, coach or volunteer does not automatically provide unrestricted access to all Club records.

Access permissions should be reviewed periodically and amended when individuals change roles or leave the Club.

10. Sharing Personal Information

Personal information must only be shared where there is a lawful and appropriate reason.

The Club may share relevant information with:

The Rugby Football Union (RFU).

Other relevant rugby governing bodies.

Pitchero.

Medical professionals and emergency services.

Insurers and professional advisers.

Relevant competition organisers.

Authorised Club officials and volunteers.

Public authorities where legally required.

Before sharing information, individuals must consider:

Whether sharing is necessary.

Whether there is an appropriate lawful basis.

Whether the recipient is authorised to receive it.

Whether the amount of information being shared is proportionate.

Whether the information is being transferred securely.

Personal information must never be shared simply because someone requests it or because they are associated with the Club.

Where a third party processes personal information on behalf of the Club, appropriate contractual and data protection arrangements must be considered.

11. Pitchero and RFU GMS

The Club uses Pitchero and the RFU's Game Management System (GMS) to support different aspects of Club administration and rugby operations.

11.1 Pitchero

Pitchero may be used for:

Website administration.

Membership management.

Player and parent communications.

Team management.

Fixture and match information.

Membership subscriptions and payments.

Club announcements.

Access to Pitchero must be managed through appropriate administrator and user permissions.

11.2 RFU Game Management System (GMS)

GMS may be used for:

Official player registration.

Rugby administration.

Player eligibility.

Governing body requirements.

Relevant safeguarding and regulatory administration.

The RFU operates its own systems and has its own data protection responsibilities.

The Club must ensure that information shared between Pitchero, GMS and other systems is handled appropriately and securely.

11.3 Maintaining Accurate Information

Where information is held across multiple platforms, the Club should take reasonable steps to maintain accuracy and consistency.

The Club should identify which system is authoritative for each category of information.

Official RFU registration information should be maintained through the relevant RFU processes.

Pitchero should be maintained as the Club's operational membership, website and communications platform.

12. Children and Young People's Information

The Club recognises the additional responsibility involved in handling personal information about children and young people.

Information relating to junior players must receive appropriate protection.

The Club will:

Collect only information necessary for participation and administration.

Ensure appropriate parent or guardian involvement where required.

Restrict access to authorised individuals.

Protect medical and emergency contact information.

Follow relevant safeguarding requirements.

Ensure photographs and videos are managed appropriately.

Avoid publishing unnecessary personal information about children.

Respond appropriately to requests or concerns from parents, guardians and young people.

Children's personal information must never be shared in public groups, social media comments or other inappropriate communication channels.

13. Medical and Safeguarding Information

Medical and safeguarding information requires particular care due to its sensitive nature.

13.1 Medical Information

Medical information should only be accessible to individuals who require it to support the safety and welfare of a player or participant.

Coaches and team managers should only receive information necessary for their responsibilities.

Medical information must not be discussed or shared casually with other members, parents or volunteers.

13.2 Safeguarding Information

Safeguarding records must be handled in accordance with the Club's Safeguarding Policy and relevant RFU procedures.

Information relating to safeguarding concerns must:

Be treated as strictly confidential.

Be accessed only by appropriately authorised individuals.

Be shared where necessary to protect individuals or meet legal obligations.

Be stored securely.

Be retained in accordance with applicable safeguarding requirements.

Confidentiality must never prevent an appropriate safeguarding referral or the sharing of information necessary to protect a child or adult at risk.

14. Email, Messaging and Communications

Club-related communications may involve personal information.

Individuals must use appropriate communication channels and exercise care when sharing information.

The following requirements apply:

Club communications should use authorised accounts and platforms where possible.

Email recipients must be checked before sending.

Blind carbon copy (BCC) should be used where appropriate to protect recipients' email addresses.

Personal information must not be shared in public social media posts.

Sensitive information should not be sent through unsecured or inappropriate messaging channels.

Group messaging arrangements involving children must follow the Club's safeguarding requirements.

Personal information should not be included in messages unless necessary.

Any accidental disclosure of personal information must be reported immediately.

15. Photographs, Videos and Social Media

Photographs and videos are an important part of promoting the Club and celebrating rugby participation.

However, all media activity must be managed responsibly.

The Club must:

Follow its Photography and Videography Policy.

Apply appropriate consent and permissions arrangements.

Follow relevant RFU safeguarding guidance.

Avoid publishing unnecessary personal details alongside images.

Restrict access to unpublished media where appropriate.

Remove or review content where there is a legitimate safeguarding or privacy concern.

Individuals responsible for the Club's social media accounts must ensure that personal information is not published without appropriate authorisation.

16. Data Retention and Disposal

The Club must retain personal information only for as long as necessary.

Retention periods should reflect the purpose of processing and any applicable legal, regulatory, financial or safeguarding requirements.

The Club should maintain a Data Retention Schedule identifying:

The category of information.

Why it is retained.

Where it is stored.

Who is responsible for it.

How long it should be retained.

How it will be securely disposed of.

When information is no longer required, it must be:

Permanently deleted from electronic systems where appropriate.

Securely shredded or destroyed if held on paper.

Removed from unnecessary downloads and duplicate records.

Disposed of in a manner that prevents unauthorised recovery or access.

Safeguarding records must not be destroyed simply because an individual leaves the Club. Relevant safeguarding retention requirements must be followed.

17. Data Protection Requests

Individuals have rights under UK GDPR regarding their personal information.

These may include:

The right to access personal information.

The right to request corrections.

The right to request erasure in certain circumstances.

The right to restrict processing.

The right to object to certain processing.

The right to data portability where applicable.

The right to withdraw consent where consent is the lawful basis.

All requests must be referred to the designated Data Protection Lead or appropriate Club representative.

The Club must verify the identity and authority of the person making the request where necessary.

Requests should normally be responded to within one month, subject to applicable legal requirements and permitted extensions.

18. Data Breaches and Information Security Incidents

A personal data breach occurs when personal information is accidentally or unlawfully lost, destroyed, altered, disclosed or accessed without authorisation.

Examples include:

Sending personal information to the wrong email recipient.

Losing a device containing Club information.

Unauthorised access to Pitchero or another Club system.

Sharing medical information with an unauthorised individual.

Losing paper registration forms.

Publishing private information or photographs without appropriate permission.

A cyberattack affecting Club records.

18.1 Reporting a Data Breach

Any suspected or actual data breach must be reported immediately to the Data Protection Lead or an appropriate member of the Club Committee.

Individuals must not attempt to conceal or independently dismiss a suspected breach.

18.2 Responding to a Data Breach

The Club will:

Identify and assess the incident.

Establish what information has been affected.

Determine whether individuals are at risk.

Take appropriate steps to contain the breach.

Record the incident and actions taken.

Assess whether notification to the ICO is required.

Inform affected individuals where legally required.

Review the incident and implement preventative measures.

Where a personal data breach is likely to result in a risk to individuals' rights and freedoms, the Club must notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it.

Where the breach is likely to result in a high risk to individuals, affected individuals must also be informed without undue delay, unless a relevant legal exception applies.

19. Training and Awareness

Individuals who handle personal information on behalf of the Club should understand their data protection responsibilities.

The Club will encourage appropriate awareness and training covering:

UK GDPR principles.

Confidentiality.

Information security.

Handling children's information.

Medical and safeguarding information.

Appropriate use of Club systems.

Data breach reporting.

Personal information sharing.

Additional guidance may be provided to individuals with access to sensitive or confidential information.

20. Third-Party Organisations and Suppliers

Where the Club uses external organisations or suppliers to process personal information, appropriate checks must be undertaken.

This may include:

Confirming the organisation's data protection arrangements.

Understanding what information is processed.

Establishing the purpose of processing.

Reviewing security arrangements.

Confirming how information is stored and retained.

Ensuring appropriate data processing agreements are in place where required.

The Club must not provide personal information to external organisations without an appropriate and lawful reason.

21. Non-Compliance

Failure to follow this policy may result in inappropriate access, disclosure or loss of personal information.

Where an individual breaches this policy, the Club may take appropriate action depending on the seriousness and circumstances of the incident.

This may include:

Additional training or guidance.

Removal or restriction of system access.

Review of an individual's Club responsibilities.

Referral to the Club Committee.

Further action in accordance with relevant Club procedures.

Serious incidents may also require notification to the ICO, the RFU or other relevant authorities.

22. Related Club Policies

This policy should be read alongside the following Newquay Hornets RFC policies and procedures:

Website Terms and Conditions.

Cookie Policy.

Safeguarding Policy.

Photography and Videography Policy.

Codes of Conduct.

Membership Rules and Regulations.

Relevant RFU regulations and guidance.

Where there is a conflict between this policy and applicable legislation or regulatory requirements, the relevant legal or regulatory requirements will take precedence.

23. Policy Review

This policy will be reviewed at least annually by the Club Committee or the designated Data Protection Lead.

It may also be reviewed following:

Changes to data protection legislation.

Changes to RFU requirements.

Introduction of new Club systems or platforms.

Significant changes to Club administration.

A serious data protection incident.

Identification of improvements to existing procedures.

Any amendments must be approved through the appropriate Club governance arrangements.