Privacy Notice

1. About this Privacy Notice

Cottingham Rangers AFC, referred to in this Privacy Notice as “the Club”, “we”, “us” or “our”, is committed to protecting the personal information of its players, parents, guardians, coaches, volunteers, officials, supporters and other people who interact with the Club.

This Privacy Notice explains:

what personal information we collect;
why we collect and use it;
the lawful reasons that allow us to use it;
who we may share it with;
how long we keep it;
how we protect it; and
the rights individuals have over their personal information.

For data-protection purposes, Cottingham Rangers AFC is normally the data controller for the personal information described in this notice.

2. Our contact details

Questions about this Privacy Notice or the way the Club uses personal information should be directed to:

Cottingham Rangers AFC

Data-protection contact: Vice Chair

Email: brian.serajuddy@cottinghamrangers.co.uk

Website: www.cottinghamrangers.co.uk

Correspondence address: Hull Sport Park, Hull University, Inglemire Lane, Hull, HU6 7TS

Safeguarding concerns should be reported directly to the Club Welfare Officer using the contact details published on the Club website or within 360Player.

3. A summary for young players

We need some information about you so that you can join the Club and take part safely in football.

This may include your name, age, contact details, team, emergency contacts and information about any medical condition that coaches need to know about.

We use this information to:

register you to play football;
organise training and matches;
keep you safe;
contact your parent or guardian;
help you if you become injured or unwell; and
manage your membership of the Club.

We only share your information when there is a proper reason to do so. This might include sharing it with The Football Association, the County FA, your league, coaches, medical professionals or safeguarding organisations.

You can ask us what information we hold about you. Depending on your age and understanding, you may be able to exercise your data-protection rights yourself. A parent or guardian may also help you.

4. The information we collect

The information we collect will depend on how a person is involved with the Club.

4.1 Players

We may collect:

full name;
preferred name;
date of birth and age group;
gender, where required for football registration or competition purposes;
home address;
telephone numbers and email addresses;
player photograph or profile image;
FA, County FA, league or player-registration information;
team, squad and playing history;
attendance at training, matches and Club events;
match availability and selection information;
coaching and player-development information;
disciplinary information;
kit and equipment issued to the player;
payment and subscription status;
information about injuries;
health conditions, allergies and medication;
accessibility or additional support requirements;
emergency contact information;
safeguarding and welfare information; and
photographs and videos where appropriate permission or another lawful basis applies.

4.2 Parents, guardians and responsible payers

We may collect:

name;
relationship to the player;
parental-responsibility information where relevant;
address;
telephone number;
email address;
emergency contact details;
communications with the Club;
payment and subscription information;
consent and permission records;
attendance at meetings or Club events;
complaints or disciplinary information; and
information relevant to safeguarding or the welfare of a player.

4.3 Coaches, volunteers, committee members and officials

We may collect:

name and contact details;
date of birth where required;
role within the Club;
qualifications and coaching records;
FA numbers and football-administration information;
safeguarding-training records;
Disclosure and Barring Service or FA criminal-record-check status;
emergency contact information;
availability;
expenses and payment details;
photographs;
communications;
disciplinary or complaint information; and
information needed to manage the person’s role within the Club.

The Club will not normally retain a full copy of a DBS certificate unless there is a lawful and necessary reason to do so.

4.4 Website visitors and people making enquiries

We may collect:

name;
email address;
telephone number;
information included in an enquiry or online form;
player-enquiry information;
website usage and technical information;
IP address;
browser and device information; and
cookie information.

More detailed information about cookies may be provided in a separate Cookie Notice.

5. How we obtain personal information

We may receive personal information:

directly from players, parents, guardians, coaches and volunteers;
through 360Player;
through the Club website and online forms;
through payment and subscription systems;
through The FA’s football-administration systems;
from the East Riding County FA or another relevant County FA;
from leagues and competition organisers;
from another football club when a player joins or transfers;
from coaches, team managers, Club officials or Welfare Officers;
from referees or match officials;
from medical professionals or emergency services;
from safeguarding organisations, police or local authorities;
from publicly available sources; and
from photographs, videos, match reports and Club events.

Where information is provided about another person, such as an emergency contact, the person supplying it should ensure that the other person is aware that their information has been provided to the Club.

6. How and why we use personal information

We may use personal information for the following purposes.

6.1 Membership and player administration

We use information to:

process membership applications;
create and maintain player records;
allocate players to teams and squads;
administer training-only and matchday membership;
manage subscription categories;
administer long-term injury arrangements;
issue and recover Club-owned kit;
respond to membership enquiries; and
communicate with players, parents and guardians.

Our lawful bases will normally be performance of a contract, steps taken before entering into a contract, and the Club’s legitimate interests in operating and administering grassroots football.

6.2 Football registration and competitions

We use information to:

register players with The FA, County FA, leagues and competitions;
confirm player eligibility;
administer fixtures, tournaments and team sheets;
record match participation;
manage transfers;
administer disciplinary matters; and
comply with football rules and regulations.

Our lawful bases may include performance of the membership agreement, legitimate interests and compliance with legal or regulatory obligations.

6.3 Training, matches and events

We use information to:

arrange training sessions and matches;
issue invitations and reminders;
record availability and attendance;
select squads;
arrange venues and facilities;
communicate cancellations or changes;
manage tournaments and Club events; and
support player development.

Our lawful bases will normally be performance of the membership agreement and the Club’s legitimate interests in organising football activities.

6.4 Subscriptions and payments

We use information to:

issue invoices;
collect annual league-registration fees;
collect monthly subscriptions;
administer sibling or long-term injury rates;
monitor failed or overdue payments;
process refunds;
manage payment arrangements;
maintain accounting records; and
prevent or investigate fraud.

Our lawful bases will normally be performance of a contract, legitimate interests and compliance with accounting, tax or other legal obligations.

The Club does not normally receive or retain complete payment-card details. These are handled by the relevant payment provider.

6.5 Health, injuries and emergencies

We may use health and medical information to:

decide whether reasonable adjustments are required;
help coaches manage participation safely;
record injuries and accidents;
provide or arrange first aid;
contact emergency services;
inform medical professionals about relevant conditions or medication;
administer a long-term injury subscription; and
protect the player’s health and welfare.

Health information is special-category personal information. For routine medical information, we will normally rely on explicit consent in addition to an appropriate general lawful basis.

In an emergency, we may use or share health information where this is necessary to protect the vital interests of the player or another person.

Consent to the use of routine medical information may be withdrawn, but withdrawing information that is necessary for safe participation may affect

whether the Club can safely allow the player to participate.

6.6 Safeguarding and welfare

We use information to:

respond to concerns about a child or adult at risk;
investigate and manage safeguarding reports;
protect the physical, mental and emotional welfare of players;
liaise with the Club Welfare Officer;
make referrals to the County FA or The FA;
contact children’s services, police or another appropriate authority; and
maintain appropriate safeguarding records.

Depending on the circumstances, our lawful bases may include legal obligation, legitimate interests, vital interests and the substantial public-interest condition relating to safeguarding children and individuals at risk.

We may share safeguarding information without consent where this is necessary and proportionate to protect a child or another person. We will only share information with people or organisations that have a legitimate need to know.

6.7 Coaches, volunteers and Club officials

We use information to:

recruit and appoint coaches and volunteers;
verify qualifications and safeguarding requirements;
manage Club roles and responsibilities;
arrange training and development;
administer expenses;
maintain emergency contacts;
communicate Club information; and
manage complaints or disciplinary matters.

Our lawful bases may include performance of an agreement, legal obligation and the Club’s legitimate interests.

6.8 Photography and video

We may take or use photographs and videos for:

Club news and match reports;
the Club website;
official social-media accounts;
printed Club materials;
promotional and recruitment materials;
awards and presentations;
coaching or match analysis; and
recording Club events.

Where we rely on consent for promotional photography or video, permission will be requested separately and will not be made a compulsory condition of membership.

Consent may be withdrawn for future use by contacting the Club. Withdrawal will not necessarily require the Club to remove material that was lawfully published before consent was withdrawn, particularly where removal is no longer reasonably practicable.

Photographs or videos connected with safeguarding, disciplinary, accident or evidential matters may be processed under another lawful basis.

6.9 Club news, fundraising and marketing

We may use contact information to send communications that are necessary for membership, such as payment reminders, training information, fixture changes, Club notices and AGM information. These are service or administrative communications and are not dependent on marketing consent.

We will normally seek separate consent before sending optional electronic marketing, fundraising messages, partner promotions or other non-essential promotional communications.

People may withdraw marketing consent or unsubscribe at any time without affecting their membership.

6.10 Complaints, disputes and legal matters

We may use information to:

respond to complaints;
manage disciplinary proceedings;
investigate breaches of Club rules;
establish, exercise or defend legal claims;
respond to insurance matters; and
cooperate with regulators or football authorities.

Our lawful bases may include legitimate interests, legal obligation and the establishment, exercise or defence of legal claims.

7. Lawful bases we rely on

Depending on the purpose, we may rely on one or more of the following lawful bases:

Contract

The information is necessary to enter into or perform the Club’s membership or subscription agreement.

Legal obligation

The information is necessary for the Club to comply with a legal requirement.

Legitimate interests

The information is necessary for the legitimate operation of the Club, including:

running teams and football activities;
communicating with members;
maintaining accurate records;
protecting players, volunteers and Club property;
maintaining network and information security;
managing complaints and disputes; and
establishing or defending legal claims.

Before relying on legitimate interests, we will consider the impact on the individual, paying particular attention to the rights and interests of children.

Consent

The person has given clear consent for a specific use, such as optional marketing, promotional photography or particular uses of health information.

Consent may be withdrawn at any time. Withdrawal does not make the use of information before withdrawal unlawful.

Vital interests

The information is necessary to protect someone’s life or physical safety, particularly in an emergency.

Substantial public interest

This may apply where special-category information must be used to safeguard a child or an individual at risk.

8. Special-category information

Some personal information requires additional protection. The special-category information most likely to be used by the Club includes:

physical or mental health information;
information about disabilities;
racial or ethnic origin where relevant to equality or discrimination matters;
religious information where relevant to reasonable adjustments;
information about sexual orientation where relevant to safeguarding, discrimination or inclusion; and
biometric information, if the Club ever introduces a system that uses it to uniquely identify a person.

We will only collect and use special-category information where it is necessary and where both an ordinary lawful basis and an additional special-category condition apply.

Access to this information will be restricted to people who need it for their role.

9. Criminal-offence and DBS information

The Club may process limited information about criminal convictions, alleged offences, DBS checks or safeguarding investigations where this is necessary for:

safer recruitment;
safeguarding;
compliance with FA requirements;
managing disciplinary matters; or
protecting members of the Club.

Access will be strictly limited. The Club will normally record the status and date of an approved check rather than retain detailed criminal-record information or copies of certificates.

10. Who we share information with

Where necessary and proportionate, we may share personal information with:

The Football Association;
the East Riding County FA or another relevant County FA;
leagues, competition and tournament organisers;
other football clubs;
referees and match officials;
team managers, coaches and authorised Club volunteers;
360Player;
payment providers, including Adyen;
banks and accounting-service providers;
insurers and insurance advisers;
pitch, venue and facility providers;
kit and equipment suppliers where an order requires player details;
website, email, hosting and information-technology providers;
professional advisers, including solicitors and accountants;
medical professionals and emergency services;
children’s services and local authorities;
police and other law-enforcement organisations;
The FA, County FA or Club safeguarding teams;
regulators, courts and tribunals; and
another organisation where required by law or necessary to protect a person.

We do not sell personal information.

We require service providers handling information on our behalf to use it only for the agreed purpose and to provide appropriate protection.

11. 360Player and football-administration systems

The Club uses 360Player for activities including:

player and parent accounts;
membership administration;
communications;
training and match invitations;
attendance;
payments and subscriptions;
forms and consents;
team information; and
Club administration.

Information entered into 360Player may be visible to authorised Club administrators, coaches, team staff, players or parents depending on their role and the platform settings.

The Club may also enter or access information through systems operated by The FA, County FA, leagues or competitions. Those organisations may act as separate data controllers for their own use of the information and will have their own privacy notices.

12. Payment providers

Payments may be processed by Adyen or another payment provider appointed by the Club or 360Player.

Payment providers may process information including:

payer name;
contact information;
payment amount;
payment method;
transaction date and time;
payment reference;
bank or card information;
device and technical information; and
fraud-prevention information.

The payment provider may use information to process transactions, prevent fraud, meet financial-regulation requirements and handle refunds or disputes.

The Club will normally retain transaction records and payment status but will not normally have access to complete card information.

13. International transfers

Some service providers may store or access personal information outside the United Kingdom.

Where personal information is transferred internationally, we will take reasonable steps to ensure that an appropriate legal safeguard is in place. This may include:

transfer to a country recognised as providing adequate protection;
use of approved contractual safeguards;
reliance on another lawful transfer mechanism; or
obtaining explicit consent where appropriate and legally permitted.

Further information about a particular transfer may be requested using the contact details in section 2.

14. How long we keep information

We will not keep personal information for longer than reasonably necessary.

Retention will depend on:

why the information was collected;
how long the person remains involved with the Club;
FA, County FA, league or competition requirements;
safeguarding guidance;
insurance requirements;
accounting and tax obligations;
limitation periods for complaints or legal claims; and
whether the information is required for an ongoing dispute or investigation.

Our normal approach is as follows:

Active membership records

Player and parent membership information will normally be retained while the player remains a member of the Club.

After membership ends, we will remove or securely archive information that is no longer needed. Limited membership, payment and communication records may be retained where required for accounting, insurance, dispute-resolution or legal purposes.

Payment and accounting records

Invoices, payment records, refunds and accounting information will be retained for the period required by applicable accounting, tax and legal requirements.

Health and medical information

Current medical information will normally be retained while it is required for safe participation.

When a player leaves, routine medical information will normally be deleted or anonymised unless it forms part of an accident, insurance, safeguarding or legal record.

Accident and injury records

Accident and injury information may be retained for the period required to manage insurance obligations and potential legal claims, taking account of the player’s age at the time of the incident.

Safeguarding information

Safeguarding information will be retained and disposed of in accordance with applicable law and relevant FA, County FA and safeguarding guidance.

Safeguarding records may need to be retained for a significant period because concerns can arise or be investigated many years later.

Volunteer and coach records

Volunteer information will normally be retained while the person holds a Club role and for an appropriate period afterwards.

Limited records relating to qualifications, safeguarding checks, complaints, disciplinary matters or incidents may be retained for longer where necessary.

Enquiries and waiting lists

Unsuccessful player enquiries and waiting-list information will normally be deleted when no longer required, unless the person has asked us to retain the information for future opportunities.

Photographs and videos

Photographs and videos may be retained while they remain relevant to Club history, reporting or publicity.

Where use is based on consent, we will stop new use following withdrawal of consent. Existing historic or printed materials may be retained where removal is not reasonably practicable.

Marketing records

Marketing information will be retained until consent is withdrawn, the person unsubscribes or we determine that the consent is no longer sufficiently current.

We may retain a minimal suppression record to ensure that a person who has opted out is not added back to a marketing list accidentally.

The Club may maintain a more detailed internal retention schedule and review it periodically.

16. Information security

The Club takes reasonable organisational and technical measures to protect personal information against:

unauthorised access;
accidental loss;
inappropriate disclosure;
alteration;
destruction; and
misuse.

Measures may include:

role-based access controls;
password-protected systems;
multi-factor authentication where available;
restricting access to medical and safeguarding information;
secure disposal;
confidentiality requirements;
volunteer guidance and training;
use of approved Club systems; and
reviewing access when a coach or volunteer changes role or leaves.

No system can be guaranteed to be completely secure. Any suspected loss, misuse or unauthorised access should be reported to the Club immediately.

Where a personal-data breach presents a reportable risk, the Club will notify the Information Commissioner’s Office and affected individuals where required.

17. Children’s information

The majority of the Club’s players are children, and their interests will be considered when the Club decides how their information is used.

Privacy information will be explained in language appropriate to the player’s age and understanding where reasonably possible.

Data-protection rights belong to the child, although a parent or guardian may exercise them on the child’s behalf where this is appropriate.

As a player becomes older and develops sufficient understanding, the Club may need to take greater account of the player’s own wishes when responding to a request or obtaining permission.

We will not use children’s personal information for inappropriate profiling or targeted commercial marketing.

18. Individual rights

Depending on the circumstances, individuals may have the right to:

be informed about how their information is used;
request access to their personal information;
request correction of inaccurate or incomplete information;
request deletion of information;
request restriction of its use;
object to certain uses;
request transfer of information they provided;
withdraw consent;
object to direct marketing; and
challenge certain decisions made solely by automated means.

These rights are not absolute and may not apply in every situation. For example, the Club may need to retain information to comply with a legal requirement, manage safeguarding concerns or establish or defend a legal claim.

Requests should be sent to the contact details in section 2.

The Club may need to confirm the requester’s identity and authority before releasing information.

The Club will normally respond within the period required by data-protection law. Where a request is particularly complex, we will explain any lawful extension.

Privacy Notice

Cottingham Rangers

Contact us

University of Hull

About us

Club Policies

FAQ

Our teams