GDPR & Data Protection Policy

1. Purpose

Lancing Football Club collects and uses personal information as part of its football, administrative, commercial, safeguarding and community activities.

The Club is committed to protecting that information and handling personal data responsibly, securely and lawfully.

This policy explains how Lancing FC will comply with applicable UK data-protection legislation.

2. Legal framework

The Club will comply with:

• The UK General Data Protection Regulation
• The Data Protection Act 2018
• The Data (Use and Access) Act 2025
• The Privacy and Electronic Communications Regulations 2003, as amended
• Relevant guidance issued by the Information Commissioner's Office

3. Scope

This policy applies to personal information relating to individuals including:

• Players
• Parents and guardians
• Coaches and managers
• Committee members
• Employees
• Volunteers
• Match officials
• Supporters
• Season-ticket holders
• Sponsors and commercial contacts
• Suppliers
• Customers
• Website visitors
• Competition entrants
• Applicants for Club positions
• Visitors to Club facilities

It applies to information held electronically, on paper, in photographs, video, audio recordings and other formats.

4. Data protection principles

Lancing FC will ensure personal data is:

Lawful, fair and transparent

People should understand how and why their information is being used.

Collected for specified purposes

Information should be collected for clear and legitimate reasons.

Adequate, relevant and limited

The Club should only collect information reasonably required for the intended purpose.

Accurate

Reasonable steps will be taken to keep information accurate and up to date.

Kept for no longer than necessary

Personal information will be retained according to operational, legal, safeguarding, insurance and regulatory requirements.

Secure

Appropriate organisational and technical measures will be taken to prevent unauthorised access, loss, disclosure or misuse.

Accountable

The Club must be able to demonstrate reasonable compliance with its data-protection obligations.

5. Types of personal information

Information processed by Lancing FC may include:

• Names
• Addresses
• Telephone numbers
• Email addresses
• Dates of birth
• Emergency contacts
• Player registrations
• Team and competition information
• Membership records
• Payment and transaction information
• Season-ticket information
• Photographs and video
• Website and online enquiry information
• Volunteer and employment records
• Qualification records
• Safeguarding records
• Medical or injury information
• Accessibility requirements
• Disciplinary information
• CCTV where applicable
• Marketing preferences

The Club may occasionally process special-category personal data, including health information or information relating to equality and diversity. Such information will receive additional protection and will only be processed where an appropriate legal condition exists.

6. Lawful basis

Lancing FC will identify an appropriate lawful basis before processing personal information. Depending upon the activity, this may include:

• Consent — where an individual has freely agreed to a particular use
• Contract — where information is necessary to enter into or fulfil an agreement
• Legal obligation — where processing is required by law
• Vital interests — where processing is necessary to protect someone's life
• Legitimate interests — where the Club has a legitimate reason for processing which is not overridden by the individual's rights and interests

The appropriate lawful basis may differ between activities. Consent will not be used automatically where another lawful basis is more appropriate.

7. Children's personal data

Lancing FC recognises that children's personal data requires particular protection.

Information about children will only be collected where reasonably required for football, safeguarding, membership, participation or another legitimate Club purpose.

Information will be presented in an appropriate and understandable manner where required.

The Club will consider the rights and interests of children when designing or operating online services likely to be accessed by children.

8. Player and member information

Information may be processed to:

• Register players
• Administer teams
• Enter competitions
• Meet league and FA requirements
• Manage training and fixtures
• Contact players and parents
• Provide medical or emergency assistance
• Administer membership
• Manage disciplinary matters
• Support safeguarding responsibilities

Necessary information may be shared with The Football Association, Sussex County FA, leagues, competition organisers and other football bodies.

9. Safeguarding information

Where the protection of a child or adult at risk requires information to be shared with safeguarding organisations or statutory authorities, the Club may do so without consent where permitted by law.

10. Photography and media

Lancing FC may take photographs and video at matches, training sessions, presentations and Club events. Images may be used for:

• Match reports
• Club publications
• Website content
• Social media
• Historical archives
• Promotional material
• Football journalism

Additional safeguards will apply where children or safeguarding concerns are involved.

11. Data security

Lancing FC will take reasonable measures to protect personal information. These may include:

• Password protection
• Restricted access
• Secure cloud services
• Device security
• Appropriate backups
• Access controls
• Secure disposal
• Staff and volunteer awareness
• Limiting access to those who require information for their role

Personal data must not be casually shared through private email, messaging applications, portable devices or social media where this could expose information to unauthorised people.

12. Sharing information

Personal information may be shared where appropriate with:

• The Football Association
• Sussex County FA
• Relevant leagues and competitions
• Other football clubs where necessary
• Insurers
• Medical providers
• Professional advisers
• Website and IT providers
• Payment providers
• Service providers acting on behalf of the Club
• Local authorities
• Safeguarding organisations
• Police and other statutory bodies
• Government or regulatory authorities where legally required

Service providers processing information for the Club must be subject to appropriate contractual and security arrangements where required.

The Club will not sell personal data to third parties.

13. International data transfers

Where a supplier or technology provider processes personal information outside the United Kingdom, the Club will take reasonable steps to ensure an appropriate UK data-transfer mechanism or other lawful safeguard is in place where required.

14. Data retention

Lancing FC will not retain personal information indefinitely without justification. Retention periods will consider:

• Legal requirements
• Football regulations
• Safeguarding requirements
• Insurance requirements
• Financial and tax obligations
• Contractual requirements
• Potential claims
• Historical or archival value

Information no longer required will be securely deleted, anonymised or destroyed.

15. Individual rights

Depending upon the circumstances, individuals have rights including:

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to object
• The right to data portability where applicable
• Rights relating to significant solely automated decision-making where applicable

Requests should be sent to LancingFcExec@outlook.com. The Club may need to verify an individual's identity before responding. Requests will be dealt with in accordance with applicable statutory timescales.

16. Data protection complaints

Anyone who is concerned about Lancing FC's use of their personal information may make a complaint. Complaints can be sent electronically to LancingFcExec@outlook.com.

The Club will:

• Make reasonable arrangements to enable individuals to complain
• Acknowledge data-protection complaints within the period required by law
• Investigate complaints appropriately
• Respond without undue delay
• Keep an appropriate record of the complaint and outcome

Individuals also have the right to complain to the Information Commissioner's Office.

17. Personal data breaches

A personal-data breach includes accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to personal information.

Suspected breaches must be reported immediately to the Club Committee or person responsible for data protection. The Club will:

1. Contain the breach where possible
2. Assess the information involved
3. Consider the risk to individuals
4. Record the incident
5. Take corrective action
6. Notify affected individuals where legally required
7. Notify the Information Commissioner's Office where legally required

18. Marketing

Electronic marketing will be carried out in accordance with applicable data-protection and electronic-communications rules.

Individuals will be provided with appropriate opportunities to unsubscribe from marketing.

Opting out of marketing will not prevent the Club sending essential administrative, membership, fixture, safety or service communications where it has another lawful basis to do so.

19. Responsibilities

Everyone handling personal information on behalf of Lancing FC must:

• Keep information confidential
• Use it only for authorised purposes
• Store it securely
• Avoid unnecessary copies
• Report suspected breaches
• Respect individual rights
• Follow this policy

20. Policy breaches

Serious or deliberate misuse of personal information may result in disciplinary action, removal from a Club position, termination of access or referral to appropriate authorities.

21. Review

This policy will be reviewed annually and whenever there is a significant change in data-protection law, ICO guidance, Club operations or technology.