Crawley Rugby Football Club (CRFC) Data Protection Policy
Policy Statement
Crawley Rugby Football Club (CRFC) is committed to protecting the privacy and security of personal data. This policy outlines our approach to data protection and compliance with applicable data protection laws, ensuring that all members and stakeholders understand their rights and responsibilities.
Purpose
This policy aims to ensure that CRFC processes personal data in a manner that respects individual privacy rights and complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Status of the Policy and Implications of Breach
This data protection policy is a formal document that outlines CRFC's commitment to data protection. Any breach of this policy, whether by individual members or the club as a whole, may lead to disciplinary action. Consequences may include:
• For individuals: Warnings, suspension, or termination of membership.
• For the club: Regulatory fines, reputational damage, and potential legal action.
2. Applicable Data Protection Laws
CRFC adheres to the following data protection laws:
• The UK General Data Protection Regulation (UK GDPR).
• The Data Protection Act 2018.
• Any relevant guidance issued by the Information Commissioner’s Office (ICO).
3. Lawful Basis for Processing
CRFC will only process personal data where there is a lawful basis to do so. The lawful bases include:
• Consent
• Contractual necessity
• Legal obligation
• Legitimate interests

4. Definition of Personal Data and Special Category Data
• Personal Any information relating to an identified or identifiable individual, such as names, contact details, dates of birth, and addresses.
• Special Category Sensitive personal data that requires additional protection, including information about racial or ethnic origin, political opinions, religious beliefs, health information, and sexual orientation.
5. Principles of Data Protection
CRFC adheres to the following data protection principles:
• Lawfulness, Fairness, and Transparency: Data will be processed lawfully and transparently.
• Purpose Limitation: Data will be collected for specified and legitimate purposes.
• Data Minimization: Only necessary data will be collected and processed.
• Accuracy: Data will be kept accurate and up to date.
• Storage Limitation: Data will not be retained longer than necessary.
• Integrity and Confidentiality: Data will be processed securely.
6. Data Subject Rights
Individuals have the following rights regarding their personal
• Right to Access: Request a copy of their personal data.
• Right to Rectification: Request correction of inaccurate data.
• Right to Erasure: Request deletion of their data under certain conditions.
• Right to Restrict Processing: Request restriction of data processing.
• Right to Data Portability: Request transfer of data to another service.
• Right to Object: Object to data processing for specific purposes.
To exercise these rights, individuals should contact the club using the details provided below.
7. Club Obligations in Relation to Data Protection
CRFC has the following obligations:
• To process personal data lawfully and transparently.
• To implement appropriate security measures to protect personal data.
• To notify individuals of any data breaches where there is a risk to their rights.
• To maintain accurate records of data processing activities.
8. Data Security
CRFC will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
• Secure storage of personal data.
• Access controls to limit data access to authorized personnel only.
• Regular training for staff on data protection.
9. Data Sharing
CRFC may share personal data with:
• Governing bodies (e.g., England Rugby) for compliance purposes.
• Emergency services in the event of an incident involving club members.
• Third-party service providers (e.g., insurance providers) only when necessary and subject to appropriate safeguards.
10. Data Retention
Personal data will be retained only for as long as necessary to fulfil the purposes for which it was collected. Specific retention periods will be determined based on the type of data and the legal requirements.
11. Correct Procedure in Example Scenarios
• Scenario: Data Breach: In the event of a data breach, the club must report it to the ICO within 72 hours and inform affected individuals if there is a high risk to their rights.
• Scenario: Access Request: If an individual requests access to their data, the club must respond within one month and provide the requested information in a clear format.
12. Foreign Transfer of Personal Data
CRFC will not transfer personal data outside the UK unless:
• The destination country ensures an adequate level of data protection.
• Appropriate safeguards (such as Standard Contractual Clauses) are in place.
• The transfer is necessary for specific legal or contractual reasons.
13. Policy Review
This policy will be reviewed annually or in response to changes in legislation or club operations.
14. Contact Information
For questions or concerns regarding this policy or data protection practices, please contact:

Jack Chapman
Hon. Secretary, Crawley Rugby Football Club
secretary@crawleyrfc.com
01293 533995