Newport (Isle of Wight) Football Club ("Newport IW FC", "the Club") is committed to protecting personal data and handling information lawfully, fairly and securely.

This policy sets out how the Club manages personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and good practice in relation to football club operations.

This policy applies to all Club committee members, staff, volunteers, coaches, team managers and anyone handling personal data on behalf of Newport IW FC.

2. Scope

This policy applies to personal data relating to:

Players
Parents and guardians
Supporters
Members
Supporters Association members
Volunteers
Coaches and team managers
Club officials
Committee members
Website users
Event attendees
Customers
Sponsors and commercial contacts

Personal data includes any information that can identify an individual directly or indirectly.

3. Data Protection Principles

The Club will ensure personal data is:

Processed lawfully, fairly and transparently
Collected for specified, legitimate purposes
Adequate, relevant and limited to what is necessary
Accurate and kept up to date where required
Retained only for as long as necessary
Protected against unauthorised access, loss, misuse or disclosure
Handled in a way that demonstrates accountability

4. Types of Data We May Hold

Depending on Club activity, personal data may include:

Names
Addresses
Email addresses
Telephone numbers
Dates of birth
Emergency contact details
Parent or guardian details
Membership information
Attendance records
Registration details
Payment records
Purchase history
Volunteer records
Coaching and role information
Safeguarding-related information
Disciplinary records where appropriate
Photographs or media permissions

The Club will only collect information necessary for legitimate operational purposes.

5. Special Category Data

Where necessary, the Club may process limited special category personal data, including:

Medical information relevant to participation or welfare
Safeguarding-related records
Accessibility or disability-related information

Such information will only be processed where lawful and necessary, with appropriate safeguards.

Access will be strictly limited.

6. Lawful Processing

The Club will process personal data only where a lawful basis applies, including:

Contractual necessity
Legal obligation
Legitimate interests
Consent where required
Protection of vital interests where appropriate

7. Access to Personal Data

Access to personal data will be restricted to those who genuinely need it for Club purposes.

Examples may include:

Committee members
Safeguarding officers
Coaches
Team managers
Membership administrators
Treasurer or finance leads
Authorised volunteers

Individuals must not access data outside their role.

8. Data Security

The Club expects appropriate security measures, including:

Strong passwords
Restricted access to systems
Secure storage of documents
Use of reputable digital platforms
Care when handling printed records
Prompt reporting of suspected breaches

Personal data should not be stored carelessly on personal devices.

Sensitive information should not be shared through insecure channels.

9. Website and Digital Platforms

The Club uses third-party platforms, including:

Pitchero
Stripe
GoCardless
Google Analytics 4

These providers may process personal data on behalf of the Club or as independent providers.

Appropriate privacy documentation will be maintained.

10. Data Sharing

Personal data may be shared only where appropriate and necessary, including with:

League or football governing bodies
Safeguarding authorities
Professional advisers
Payment processors
Website service providers
Regulatory or legal authorities where required

Personal data will not be sold.

11. Children and Youth Football

The Club recognises that junior football involves handling children's data.

Additional care will be taken with information relating to young players.

This may include:

Parent or guardian contact information
Emergency medical details
Registration information
Safeguarding records
Consent records where required

Access will be limited to appropriate personnel.

12. Retention of Data

Personal data will only be kept for as long as necessary.

Retention will depend on operational, safeguarding, legal and financial requirements.

Examples may include:

Membership records
Financial records
Incident records
Safeguarding documentation
Volunteer information

Data no longer required will be securely deleted or destroyed.

13. Subject Access Requests

Individuals may request access to personal data held about them.

Requests should be made in writing to:

info@newportiwfc.com

The Club will respond in accordance with applicable legal timescales.

14. Data Accuracy

Reasonable steps will be taken to ensure data is accurate and up to date.

Individuals should notify the Club if their details change.

15. Personal Data Breaches

Any suspected personal data breach must be reported promptly to the Club.

Examples include:

Lost devices
Unauthorised access
Emails sent to the wrong recipient
Lost paperwork
Accidental disclosure
Cybersecurity incidents

The Club will assess incidents and take appropriate action, including ICO reporting where legally required.

16. Training and Responsibilities

Anyone handling personal data on behalf of the Club must:

Handle information responsibly
Follow this policy
Maintain confidentiality
Use data only for legitimate Club purposes
Report concerns promptly

Failure to follow this policy may result in action being taken.

17. Policy Review

This policy will be reviewed periodically and updated where necessary.

18. Contact

For data protection enquiries:

Newport IW FC
info@newportiwfc.com