Stewart’s Melville RFC limited – Privacy Notice
Stewart’s Melville Rugby Football Club Limited (“the Club”) is a Scottish rugby club, affiliated to and governed by the Scottish Rugby Union (“Scottish Rugby”).
The Club’s primary aims are the promotion of rugby at both age grade and junior levels by creating a positive, fun and inclusive environment that allows all players to grow and improve.
2. Data Protection Principles
The General Data Protection Regulation (“GDPR”) governs how organisations use personal data and increases the protection of an individual’s privacy. Personal data is any information that relates to and can identify a person such as a player, coach, non-playing member or official. The Club will be a “controller” of the personal information that you provide to us, whether that be via membership application forms or otherwise. The GDPR includes six data protection principles that the Club needs to comply with whenever processing personal data (for example, signing up a new member or sending an email to a volunteer):
1. Ensure that the Club identifies a lawful basis to process the personal data and provide a privacy notice to the individual, which tells individuals how the club uses their personal data;
2. Only collect, use and keep personal data for specific purposes;
3. Only collect, use and keep personal data that the Club actually needs;
4. Keep personal data up-to-date where possible;
5. Only keep personal data for as long as the Club needs it; and
6. Protect personal data and keep it secure
3. What we need
3.1. Members’ Personal Data:
When you register as a member of the Club or renew your membership (including if you are registering or renewing on behalf of a child under the age of 18, as a volunteer, a coach, a non-playing member, a committee member or otherwise) we will ask you for the following personal information:
* Contact details – name, address, email address, contact phone number, date of birth;
* Membership category – for example, player, parent, coach, volunteer;
* Payment details – bank account number, sort code, card details;
* Participation details – for example, parent, playing member, non-playing member;
* PVG membership information where applicable.
3.2. Playing members’ special category personal data
Special Category Personal Data is a separate category of Personal Data which requires your express consent for processing. In this context it relates to medical information of players only (both Senior and Junior players) which is relevant to player protection. Medical information is not collected or processed for other member categories such as coaches or non-playing members.
Player medical information will be shared with Scottish Rugby through Scottish Rugby’s Registration System (“SCRUMS”).
Player medical information will also be shared with coaches and officials where necessary to protect player welfare, including, where necessary, coaches and officials of other clubs.
3.3. Volunteers’ personal data
With respect to coaches, committee members and other volunteers and Club officials, we will collect personal information relating to criminal convictions or alleged commission of criminal offences where you are required to complete a PVG check under the Protection of Vulnerable Groups (Scotland) Act 2007. This information will include your PVG certificate number, PVG membership number, date of issue and any relevant information in relation to your membership of the PVG Scheme.
If your PVG certificate is not clear, we will have a legitimate interest to collect references and any other applicable information to allow us to consider whether or not you can volunteer in a regulated role with children and/or vulnerable adults.
Where we process your personal information in pursuit of our legitimate interests, you have the right to object to us using your personal information for the above purposes. If we comply with your objection, this may affect our ability to undertake the tasks above for the benefit of you as a volunteer.
4. Why we need your personal information
4.1. Contractual purposes
We need to collect our members’ personal information so that we can manage your membership. We will use our members’ personal information to:
* Provide you with core member services, including insurance and player registration where applicable; and
* Send you membership communications in relation to essential membership services, including but not limited to, general meeting notices, membership renewals and membership fee information.
If you do not provide us with all of the personal information that we need to collect then this may affect our ability to offer the above membership services and benefits.
4.2. Legitimate purposes
We also process our members’ personal information in pursuit of our legitimate interests to:
* Promote and encourage participation in rugby by sending members’ communications and booking information for upcoming competitions, training sessions, fixtures and events which may be filmed or photographed and your personal information may also be used in images captured from all events, which may be used for promotional, education and development purposes;
* Promote and develop the Club by inviting members to participate in social and fundraising activities;
* Distribute relevant communications from Scottish Rugby and enforce relevant regulations;
* Distribute newsletters and other information;
* Accept payments;
* Develop and maintain our members’ qualifications, including sending email communications to members to inform you of upcoming courses, renewal requirements and verify that you have completed any mandatory training and PVG / child protection requirements; and
* Respond to and communicate with members regarding your questions, comments, support needs, complaints, concerns or allegations in relation to rugby, the Club and its members. For example, we will use your personal information to investigate complaints or take disciplinary action as required.
Where we process your personal information in pursuit of our legitimate interests, you have the right to object to us using your personal information for the above purposes. If we agree and comply with your objection, this may affect our ability to undertake the tasks above for the benefit of you as a member.
4.3. Legal obligations
We are under legal obligation to process certain personal information relating to our members, employees, volunteers and participants for the purposes of complying with our obligations:
* To maintain a register of our members, which includes our members’ name, address, the date they were admitted to membership and the date on which they ceased to be our member, and hold general meetings, including issuing notices and voting arrangements;
* The Protection of Vulnerable Groups (Scotland) Act 2007 to check that our coaches and volunteers are able to undertake regulated work with children and vulnerable adults; and
* The Equality Act 2010, which requires us to process personal information to make reasonable adjustments where necessary.
4.4. Other uses of your personal information
We may ask you if we can process your personal information for additional purposes. Where we do so, we will provide you with an additional privacy notice with information on how we will use your information for these additional purposes.
5. Who we share your personal information with
If your personal information is included in any images or videos taken at events, we may share this with Scottish Rugby for promotional, training and/or journalistic purposes or share such photos and videos for training, educational and general marketing purposes via social media or otherwise.
We may be required to share personal information with statutory or regulatory authorities and organisations to comply with statutory obligations. Such organisations include the Health & Safety Executive, Disclosure Scotland, and Police Scotland for the purposes of safeguarding children.
We may also share personal information with our professional and legal advisors for the purposes of taking advice. The Club employs third party suppliers to provide services. These suppliers may process personal information on our behalf as “processors” and are subject to written contractual conditions to only process that personal information under our instructions and protect it.
In the event that we do share personal information with external third parties, we will only share such personal information strictly required for the specific purposes and take reasonable steps to ensure that recipients shall only process the disclosed personal information in accordance with those purposes.
6. Scottish Rugby and members’ personal data
As a Member club of the Scottish Rugby Union we are required to ensure that all of our playing members are members of Scottish Rugby as a condition of our membership.
We will share the personal information of playing members with Scottish Rugby, who will become a controller of that personal information when they receive it. Scottish Rugby’s privacy notice explains how they use your personal information and can be accessed on the www.scottishrugby.org website.
7. How we protect your personal information
Your personal information is stored on a secure, cloud-based, file-sharing platform which is only accessible by our staff and volunteers for the purposes set out above. Access is hierarchical, meaning that access to the different categories of information is limited to those individuals who need access to that information to fulfil their obligations to the club, members and Scottish Rugby.
Special category personal information is held in a separate file and is only accessible by coaches and club officials who need access to that information in order to discharge their player welfare obligations.
We may be required to transfer your personal information outwith the EU for the purposes of entering into competitions and booking travel arrangements. Where your personal information is transferred outwith the EU, we will provide you with information regarding the safeguards that we have put in place with the recipient country to protect your personal information.
8. How long we keep your personal information
We will only keep your personal information for as long as necessary to provide you with membership services or as required by Scottish Rugby or any other relevant and competent authority.
We have a data retention policy that sets out the periods for retaining and reviewing all information that we hold. This sets out different retention periods and you can request a copy by contacting us at firstname.lastname@example.org.
9. Your rights
You can exercise any of the following rights by writing to us at email@example.com .
Your rights in relation to your personal information are:
* You have a right to request access to the personal information that we hold about you by making a “subject access request”;
* If you believe that any of your personal information is inaccurate or incomplete, you have a right to request that we correct or complete your personal information;
* You have a right to request that we restrict the processing of your personal information for specific purposes;
* If you wish us to delete your personal information, you may request that we do so; and
* If you wish to object to any of the above processing, please contact us on firstname.lastname@example.org.
Any requests received by the Club will be considered under applicable data protection legislation. If you remain dissatisfied, you have a right to raise a complaint with the Information Commissioner’s Office at www.ico.org.uk