Junior Player Privacy Notice

Swansea Uplands RFC Junior Player Privacy Notice

What is the purpose of this document?

Swansea Uplands RFC Ltd (“SURFC”) is a "data controller". We are responsible for deciding how we hold and use personal information about your child. You are being given a copy of this privacy notice because you wish your child to be registered to play rugby under the governance of SURFC. It makes you aware of how and why your child’s personal data will be used and how long it will usually be retained for. It provides you with certain information that must be provided under the General Data Protection Regulation ((EU) 2016/679) (GDPR).

Data protection principles

We will comply with data protection law and principles, which means that your child’s data will be:

• Used lawfully, fairly and in a transparent way.

• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.

• Relevant to the purposes we have told you about and limited only to those purposes.

• Accurate and kept up to date.

• Kept only as long as necessary for the purposes we have told you about.

• Kept securely.

The kind of information we hold about you

In connection with your application for your child to be registered to play rugby, we will collect, store, and use the information that you have provided us with when completing the appropriate SURFC Player Registration Form.

How is your personal information collected?

We collect personal information about junior players from you as your child’s club and the WRU to which the club is affiliated as well as any appropriate data that can be obtained from a publicly accessible source.

How we will use information about you

We will use the personal information we collect to register your child to play rugby, to comply with our own Rules and Regulations and to comply with our legal or regulatory requirements to the WRU and any other appropriate body involved in the governance of rugby in Wales or elsewhere. Your child’s information may be used by the SURFC in relation to disciplinary offences, to register transfers and for the proper administration of competitions overseen by the WRU,

If you fail to provide personal information

If you fail to provide the information as requested on the appropriate SURFC Player Registration Form we will not be able to process your application and in those circumstance your child will not be registered to play rugby under the governance of SURFC or the WRU.

Information about criminal convictions

We do not envisage that we will process information about criminal convictions in relation to an application for your child to be registered to play rugby under the governance of SURFC or the WRU

Automated decision-making

You or your child will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.

Data Sharing

We will only share your child’s personal information for the purposes of processing your application for your child to be registered to play rugby, to comply with our own Rules and Regulations, to comply with our legal and regulatory obligations to the WRU or other appropriate body involved in the governance of rugby in Wales or elsewhere, with the SURFC board in accordance with any legal obligation on the SURFC.

All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your child’s personal information in line with our policies. We do not allow our third-party service providers to use your child’s personal data for their own purposes. We only permit them to process your child’s personal data for specified purposes and in accordance with our instructions.

Data security

We have put in place appropriate security measures to prevent your child’s personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your child’s personal information to those employees, agents, contractors and other third parties who have a legitimate need to access your child’s personal data for the purposes of

player registration and the proper administration of rugby in Wales. They will only process your child’s personal information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

How long will you use my information for?

We will retain your child’s personal information for no longer than necessary and in accordance with our legal obligations and our regulatory obligations to the WRU or any other appropriate body involved in the governance of rugby in Wales or elsewhere. After this period, we will securely destroy your child’s personal information in accordance with applicable laws and regulations.

Rights of access, correction, erasure, and restriction

Your rights in connection with personal information

Under certain circumstances, by law you or your child, if they are deemed to have competency, have the right to:

• Request access to your child’s personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about your child and to check that we are lawfully processing it.

• Request correction of the personal information that we hold about your child. This enables you to have any incomplete or inaccurate information we hold about your child corrected.

• Request erasure of your child’s personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your child’s personal information where you have exercised your right to object to processing (see below).

• Object to processing of your child’s personal information where we are relying on a legitimate interest (or those of a third party) and there is something about you or your child’s particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your child’s personal information for direct marketing purposes.

• Request the restriction of processing of your child’s personal information. This enables you to ask us to suspend the processing of personal information about your child, for example if you want us to establish its accuracy or the reason for processing it.

• Request the transfer of your child’s personal information to another party.

If you want to review, verify, correct or request erasure of your child’s personal information, object to the processing of your child’s personal data, or request that we transfer a copy of your child’s personal information to another party, please contact the Privacy Officer in writing.

Privacy Officer

We have appointed a Privacy Officer to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact the Privacy Officer. You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.