Data Protection Policy (GDPR)

Saltcoats Victoria FC needs to hold personal information about people in order to run the club. This policy explains how we look after it, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It supplements our Privacy Policy, which explains to the public what we do with their information.

Who is responsible

Saltcoats Victoria FC is the “data controller” for the personal data it holds. The committee is responsible for compliance, and a committee member is named as the club’s data protection lead. Questions can be sent to saltcoatsvictoria@gmail.com.

The principles we follow

Personal data must be:

used lawfully, fairly and transparently;
collected for specific, stated purposes only;
adequate, relevant and limited to what is needed;
accurate and kept up to date;
kept for no longer than necessary;
kept safe and secure.

What we hold, and why

Players and members: names, contact details, dates of birth, medical or dietary information relevant to safety, registration details and match records, to run teams, register players with the league and Scottish FA, and keep people safe.
Volunteers, coaches and officials: contact details, references and PVG scheme membership information, to recruit and manage people safely.
Customers and supporters: details given when buying tickets, shop items, season tickets or sponsorship, or when getting in touch, to fulfil orders and reply.
Website visitors: information collected by cookies and analytics, and only with consent where consent is required.
Images and video: covered by our Photography, Filming & Social Media Policy.

Where we hold information about children, we take extra care, and ask a parent or carer for consent where it is required.

Lawful basis

We rely on one or more of the following: a contract (for example buying a ticket); a legal obligation; consent (for example to marketing or non-essential cookies); legitimate interests of the club, balanced against your rights; and, for safeguarding, our duty to protect children and adults at risk. Special category data, such as health information, is used only where necessary and with appropriate safeguards.

Keeping data safe

Access is limited to the people who need it for their role.
Passwords are strong and not shared, and devices and accounts used for club business are protected.
Paper records are locked away, and personal data is not left where others can see it.
Data is not sent to personal email accounts or messaging groups where it can be avoided. Where email is used, the minimum is shared.
Systems that are used to hold data, for example website, ticketing and payment providers, are chosen with care and only process data on our instructions. Card payments are handled by our payment provider and the club does not store full card details.

Sharing data

We do not sell personal data. We share it only where necessary, for example with the league, the Scottish FA, Disclosure Scotland, payment and ticketing providers, insurers, emergency services, the police, or where the law requires it.

How long we keep it

Financial records: 7 years.
Player and member records: while the person is involved with the club, then for up to 12 months after they leave, unless the law or governing body requires longer.
Safeguarding records, incident and accident records: as required by law and Scottish FA guidance, including for as long as needed for any concern to be dealt with.
Enquiries and marketing details: until you ask us to stop, or for as long as it is reasonable to expect them to be useful.

When data is no longer needed it is securely deleted or destroyed.

Your rights

You have the right to be informed, to see the information we hold about you, to have it corrected, to have it erased in certain cases, to restrict or object to our use of it, to move it, and to withdraw consent at any time. To use a right, email us. We aim to respond within one month, and may need to check your identity first.

If something goes wrong

Anyone who loses data, sends it to the wrong person, or suspects a breach must tell the data protection lead straight away. The club records every breach, and reports it to the Information Commissioner’s Office within 72 hours if it is likely to put people at risk, and tells the people affected where required.

Complaints

If you are unhappy with how we have used your data, please tell us first. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).