Players, Coaches & Medical Staff

If you have any questions about the protection of your data, please email our Data Protection Officer:   This email address is being protected from spambots. You need JavaScript enabled to view it.

The purpose of this Privacy Notice is to inform you how and why your data is used when you play for us or you are part of the playing support teams at RFCL.  This notice applies to all playing sections of the club:

First XV squad & all of the Mens Sections including the Heavies

Womens Section

Youth section

Mini Section
We operate as Data Controllers for the information you provide to us and Joint Data Controllers with the RFU and the medical organisations involved in your medical treatment and fitness to play.  
If you have any questions about the protection of your data, please email our Data Protection Officer:  This email address is being protected from spambots. You need JavaScript enabled to view it.

Taking your Data Protection seriously
We have reviewed and updated our policies, processes and procedures to comply with the General Data Protection Regulation (EU) 2016 / 679 (GDPR and DPA) and the Data Protection Act 2018 (DPA) and have updated this Privacy Notice accordingly.
Purpose for processing and lawful basis

Type of Data Processing Lawful basis
Contact details – name, address, email address, phone number, family members
Emergency contact details
Player registration
Team and player administration
Performance of contract

Legitimate Interests
Email address Club information newsletters, events, upcoming matches, member benefits Legitimate Interests
Playing History including club/school/college details Administration of teams
Make decisions about development and training
Legitimate Interests
Ranking, ratings, playing details, game performance data, records of game and event attendance Administration of teams,
Make decisions about development and training
Performance reviews
Legitimate Interests
Identification documents eg. Passport, proof of address DBS checks, safeguarding of children
RFU Registration process
Performance of contract (with RFU)
Immigration documents eg. Visas Eligibility to play / work
RFU Registration process
Performance of contract (with RFU)
RFU registration number / GMS ID number Administration of players and support staff Performance of Contract (with RFU)
Payroll details – bank account, NI number, HMRC data Payment of players and support staff Your consent
Credit Card details Merchandise payments, tickets Your consent
Contract details Administration of players and support staff Performance of Contract
Recruitment information Administration of support staff Legitimate Interests
Disciplinary and grievance information Administration of grievance procedures Legitimate Interests
Accreditations, qualifications and experience for coaching and medical staff To safeguard players Legal requirement from Governing body – RFU
Records of communications eg emails, phone calls Communication / respond to queries and requests Legitimate Interests
Video footage and photographic images from matches Recording of matches for training, performance and other monitoring activities
Promotional activities
Performance of Contract
Other video and voice recordings Publicity for either the club or the player Your consent
Email communications Respond to queries, complaints, receipt of information Legitimate Interests
Special categories of data – Child and Sensitive data
Medical information, including injury information, in game assessments for all players including for Children Safeguarding of players
Provide and administer Insurance policies
HIA research
Substantial public Interest (Schedule 1 Part 2 DPA 2018)
Legitimate Interests
Your consent / parental consent
Criminal convictions and offenses DBS checks, safeguarding of children Legal requirement
Race, ethnicity, sexual orientation Equality of opportunity and treatment and to participate in rugby Your consent / parental consent
Legal requirement from governing body - RFU

Source of your data
We receive information about you from you when you:  complete the player registration process; agree to work or volunteer for us as part of the playing support teams; play/train for/with any of the club teams; provide coaching; provide medical services and provide strength, conditioning and fitness assessments.
We may receive information about you from:  other clubs, RFU or other companies with your consent.
We do not receive or buy in lists of personal data from third party sources.
Recipients of your data
As joint Controllers with the RFU we are required to pass on any data requested by them based on RFCL’s obligations as a club registered with the RFU. Their Privacy Notice/s sets out how they use this data here.  The RFU has a role to ensure that RFCL comply with the regulations, codes, policies and processes of the governing body.
We are also required to use the RFU’s Game Management System (GMS) and RugbySquad which are administered by the RFU.  A copy of the GMS Privacy Notice can be found here.
As joint Controllers with medical organisations involved in your medical treatment and fitness to play, we are required to pass on your data for player safeguarding and appropriate medical treatments.
We do not pass on your information to any other party unless required to by law for example: HMRC.
Third parties / sub processors
We use third party companies to perform certain services for us, such as IT support, Banks, Payment processors and Accountants.  All third party processors are subject to a binding contractual obligation to process your personal data in accordance with our instructions and to comply with their responsibilities as Data Processors under GDPR and DPA.
Automated decision making
We do not undertake any automated decisions using your data.
Security of your data
We have taken all reasonable steps to ensure that we and our Data Processors adapt Industry standard security protection systems to ensure the security of your data.
Where personal data is stored in locations other than the EEA we have assured ourselves that the Data Processor is aware of their responsibilities for the privacy and security of your data under GDPR and DPA.
Credit card details
For credit card transactions made by telephone, the payment card details are cross-shredded immediately. We only use PCI-DSS compliant payment systems procured from reliable third- party providers.
The credit/debit card information you provide for any transaction will be used by us solely to process that transaction.  
We cannot accept credit/debit card payments by email and will decline to accept payment by that means.
Retention of your data
We only retain your data for as long as we are legally obliged to do so.  This is typically 7 years after you cease to become a member where we have financial transactional data.  
Your rights under GDPR and DPA
You are entitled to ask about the data that is held about you, subject to certain exceptions.  This is called a Subject Access Request (SAR).  
These should be made by email or in writing to the following address:
Email:  This email address is being protected from spambots. You need JavaScript enabled to view it.
Address:  Data Protection Officer, The Athletic Ground, Twickenham Road, Richmond, TW9 2SF
In addition, the GDPR and DPA provides the following rights for individuals - click here
•    The right to be informed
•    The right of access
•    The right to rectification
•    The right to erasure
•    The right to restrict processing
•    The right to data portability
•    The right to object
•    Rights in relation to automated decision making and profiling

If you would like to exercise any of your rights under GDPR and DPA, please email our Data Protection Officer at This email address is being protected from spambots. You need JavaScript enabled to view it.
You have the right to complain to the Information Commissioners Office (ICO) if you are not satisfied with our handling of your requests about the protection of your data.  Follow the link here to report a concern to the ICO.

June 2018