1. Purpose
This Data Policy outlines how AFC Corsham collects, stores, processes, shares, and deletes personal data. The policy ensures compliance with data protection legislation and promotes responsible handling of all personal information associated with club operations.

2. Scope
This policy applies to all club officers, team managers, coaches, volunteers, and anyone else who handles personal data on behalf of AFC Corsham.

It covers:

Players (including youth and adult participants)

Parents/guardians

Volunteers, coaches, and club officials

Referees and event attendees

Website and forum users

3. Data Protection Principles
In accordance with the UK General Data Protection Regulation (UK GDPR), AFC Corsham ensures personal data is:

Processed lawfully, fairly and transparently

Collected for specific, explicit and legitimate purposes

Adequate, relevant and limited to what is necessary

Accurate and kept up to date

Stored securely and only for as long as necessary

Processed in a manner that ensures appropriate security

4. Lawful Bases for Processing
The club relies on the following lawful bases for processing personal

Consent: For optional uses (e.g. photography, communications)

Contractual: For club membership, match registration

Legal obligation: For safeguarding and health & safety

Legitimate interests: For internal club administration

5. Data Collected
Typical personal data collected includes:

Full name, date of birth, gender

Contact details (email, phone, address)

Emergency contacts

Medical information

FA registration data (FAN numbers, DBS checks, qualifications)

Consents (media use, data sharing)

Attendance, performance, and disciplinary records

6. Responsibilities

The Club Secretary is the primary data controller for operational data.

The Welfare Officer manages safeguarding and sensitive data.

Team Managers and Coaches act as data handlers for their teams.

All club officials must complete basic data protection awareness annually.

7. Data Security and Storage

Electronic data is stored securely using password-protected devices and FA systems (e.g. Whole Game System, Club Portal, Pitchero).

Paper records are stored in locked cabinets by the Secretary or Chair.

Access is restricted to individuals who require the data to fulfil their role.

Personal data must never be shared informally or stored on personal, unsecured devices.

8. Data Retention and Disposal

Player and membership data is retained for up to 2 years after membership ends.

Volunteer data is retained for 12 months post-departure, unless safeguarding legislation requires longer retention.

Obsolete data is securely destroyed (e.g. digital deletion, paper shredding).

9. Data Subject Rights
All individuals whose data is held by the club have the right to:

Request access to their personal data

Request correction of inaccurate data

Request erasure of data, where lawful

Object to processing under certain conditions

Withdraw consent (for consent-based data)

Requests should be submitted to secretary.afccorsham@gmail.com. The club will respond within 30 days.

10. Data Breaches
Any data breach or suspected breach must be reported immediately to the Club Welfare Officer. The club will assess the risk and report to the ICO where required, within 72 hours.

11. Training and Awareness
All managers, coaches and committee members are required to complete safeguarding and data handling training where applicable. Guidance and refreshers are provided annually.

12. Review and Policy Updates
This Data Policy will be reviewed annually or when required by legislative or operational changes. The latest version will always be available on the club website.

Last reviewed: July 2025