Data Protection Policy for Busby Amateur Football Club (Busby AFC)

1. Introduction

Busby Amateur Football Club ("Busby AFC," "we," "us," or "our") is committed to protecting the personal data of its members, participants, and all individuals associated with the club. This Data Protection Policy outlines how we handle personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable laws of Scotland.

2. Purpose of This Policy

The purpose of this policy is to:

- Ensure the lawful, fair, and transparent processing of personal data.
- Safeguard the rights and freedoms of individuals whose data we process.
- Detail the responsibilities of Busby AFC in managing personal data.
- Provide a framework for addressing data protection concerns and breaches.

3. Scope of the Policy

This policy applies to:

- All personal data processed by Busby AFC, whether electronically or in paper form.
- All members, participants, volunteers, employees, and contractors who process data on behalf of Busby AFC.

4. Data Protection Principles

Busby AFC is committed to processing personal data in accordance with the following principles:

4.1 Lawfulness, Fairness, and Transparency:
Personal data will be processed lawfully, fairly, and in a transparent manner.

4.2 Purpose Limitation:
Data will be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.

4.3 Data Minimization:
Data collection will be limited to what is necessary in relation to the purposes for which it is processed.

4.4 Accuracy:
We will ensure that personal data is accurate and kept up to date.

4.5 Storage Limitation:
Personal data will be retained only as long as necessary for the purposes for which it was collected.

4.6 Integrity and Confidentiality:
We will process personal data securely, protecting it against unauthorized or unlawful processing, accidental loss, destruction, or damage.

5. Lawful Bases for Processing

Busby AFC processes personal data under the following lawful bases:

5.1 Consent:
Where explicit consent is provided (e.g., for promotional activities).

5.2 Contractual Necessity:
To fulfill contractual obligations, such as managing memberships or event registrations.

5.3 Legal Obligation:
To comply with legal and regulatory requirements.

5.4 Legitimate Interests:
Where processing is necessary for the legitimate interests of the club, provided these do not override individual rights.

6. Types of Data Collected

Busby AFC collects and processes the following categories of personal data:

6.1 Personal Identification Data:
- Name
- Date of birth
- Contact information (address, email, phone number)

6.2 Health and Safety Data:
- Medical conditions (as required for player safety)
- Emergency contact information

6.3 Financial Data:
- Payment information for membership fees, donations, and merchandise

6.4 Usage Data:
- Attendance at club activities, events, and matches
- Photographs and videos taken during club events

6.5 Technical Data:
- IP addresses and website usage data (via cookies and similar technologies)

7. Data Security

Busby AFC implements appropriate technical and organizational measures to ensure the security of personal data, including:

- Access control measures to restrict data access to authorized individuals.
- Secure storage of physical and electronic records.
- Regular training for staff and volunteers on data protection.
- Use of encrypted methods for data transmission where applicable.

8. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy or to comply with legal obligations. Once data is no longer required, it will be securely deleted or anonymized.

9. Data Sharing

Busby AFC does not sell or rent personal data to third parties. However, data may be shared with:

- Service providers (e.g., payment processors, IT support) under strict confidentiality agreements.
- League organizers and governing bodies for registration purposes.
- Emergency services in case of health and safety incidents.

10. Individual Rights

Under the UK GDPR, individuals have the following rights regarding their personal data:

10.1 Right to Access:
Request a copy of personal data held by Busby AFC.

10.2 Right to Rectification:
Request correction of inaccurate or incomplete data.

10.3 Right to Erasure:
Request deletion of data, subject to certain conditions.

10.4 Right to Restrict Processing:
Request limited processing of data under certain circumstances.

10.5 Right to Data Portability:
Request transfer of personal data to another organization in a structured, commonly used format.

10.6 Right to Object:
Object to data processing based on legitimate interests.

To exercise any of these rights, contact us using the details below.

11. Data Breaches

In the event of a data breach, Busby AFC will:

- Notify the affected individuals and the Information Commissioner’s Office (ICO) where required.
- Take immediate steps to mitigate the impact of the breach.
- Investigate the cause and implement measures to prevent recurrence.

12. Contact Us

For questions, concerns, or to exercise your data protection rights, please contact:

Busby Amateur Football Club (Busby AFC)
Email: info@busbyafc.co.uk

13. Changes to This Policy

Busby AFC reserves the right to update this policy to reflect changes in legislation or club operations. Updates will be posted on our website, and significant changes may be communicated to members directly.

Last Updated: 26 January 2025

Busby AFC

Annual Report - 2024