ASHTON UNITED FOOTBALL CLUB

Privacy Notice – 1/2

ASHTON UNITED FOOTBALL CLUB ("we", "our", "us") take your privacy very seriously. 

This Privacy Notice sets out how we use and look after the personal information we collect from you. We are the data controller, responsible for the processing of any personal data you give us. We take reasonable care to keep your information secure and to prevent any unauthorised access to or use of it.

What personal data we hold on you

Personal data means any information about an individual from which that individual can be identified. 

We collect, use, store and transfer some personal data of our participants [and their parents or guardians], and other Club members.

 

You provide information about yourself when you register with the Club, and by filling in forms at an event or online, or by corresponding with us by phone, e-mail or otherwise. 

The information you give us may include your name, date of birth, address, e-mail address, phone number, gender, and the contact details of a third party in the case of emergency. We may also ask for relevant health information, which is classed as special category personal data, for the purposes of your health, wellbeing,welfare and safeguarding. Where we hold this data it will be with the explicit consent of the participant or, if applicable, the participant’s parent or guardian.

Where we need to collect personal data to fulfil Club responsibilities and you do not provide that data, we may not be able honour or administer your membership. 

Why we need your personal data

We will only use personal data for any purpose for which it has been specifically provided.

The reason we need participants’ and members’ personal data is to be able to run the football club and arrange matches; to administer memberships, and provide the membership services you are signing up to when you register with the club. Our lawful basis for processing your personal data is that we have a contractual obligation to you as a participant or member to provide the services you are registering for.

Personal data that is shared and more importantly needed is listed and may not be limited to the following:-

Who we share your personal data with

When you become a member of the Club, your information, if you are a coach or volunteer will be or if you are another participant may be (depending upon which league(s) your team plays in) entered 

Privacy Notice – 2/2

onto the Whole Game System database, which is administered by the FA. We also pass your information to the County FA and to leagues to register participants and the team for matches, tournaments or other events, and for affiliation purposes.

We may share your personal data with selected third parties, suppliers and sub-contractors such as referees, coaches or match organisers. Third-party service providers will only process your personal data for specified purposes and in accordance with our instructions.

We may disclose your personal information to third parties to comply with a legal obligation; or to protect the rights, property, or safety of our participants, members or affiliates, or others. 

The Club’s data processing may require your personal data to be transferred outside of the UK. Where the Club does transfer your personal data overseas it is with the sufficient appropriate safeguards in place to ensure the security of that personal data.

Protection of your personal data

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. 

How long we hold your personal data

We keep personal data on our participants and members while they continue to be a participant or member or are otherwise actively involved with the Club. We will delete this data 12 months after a participant or member has left or otherwise ended their membership or affiliation, or sooner if specifically requested and we are able to do so. We may need to retain some personal data for longer for legal or regulatory purposes. The personal data that is stored on Whole Game System is subject to their privacy policy so we advise you review that policy together with this notice. If you would like your personal data to be deleted from Whole Game System then please contact them.

Your rights regarding your personal data

As a data subject you may have the right at any time to request access to, rectification or erasure of your personal data; to restrict or object to certain kinds of processing of your personal data, including direct marketing; to the portability of your personal data and to complain to the UK’s data protection supervisory authority, the Information Commissioner’s Office about the processing of your personal data. 

As a data subject you are not obliged to share your personal data with the Club. If you choose not to share your personal data with us we may not be able to register or administer your membership. 

We may update this Privacy Notice from time to time, and will inform you to any changes in how we handle your personal data.

If you have any questions about this Privacy Notice then please contact Jackie Tierney.

Data Protection Policy 

About this Policy

This Policy is to help clubs, County Football Associations and football leagues deal with data protection matters internally. This should be kept with other club / County Football Association / football league policies and a copy should be given (or made available) to all staff members, volunteers and others who come into contact with personal data during the course of their involvement with the club (ASHTON UNITED) / County Football Association (MANCHESTER FA) / football league

ASHTON UNITED FOOTBALL CLUB (“we”, “our”, “us”) handle personal data about current, former, and on occasion prospective players, employees, volunteers, committee members, coaches, managers, contractors, third parties, suppliers, and any other individuals that we communicate with. 

In your official capacity with the football club you may process personal data on our behalf and we will process personal data about you. We recognise the need to treat all personal data in an appropriate and lawful manner, in accordance with the EU General Data Protection Regulation 2016/679 (GDPR). 

Correct and lawful treatment of this data will maintain confidence in the football club, and protect the rights of players and any other individuals associated with the Club / Manchester FA / current Football League. This Policy sets out our data protection responsibilities and highlights the obligations of the Club / Manchester FA / Football League, which means the obligations of our employees, committee, volunteers, members, and any other contractor or legal or natural individual or organisation acting for or on behalf of the Club / Manchester FA / Football League..

You are obliged to comply with this policy when processing personal data on behalf of the Club / Manchester FA / Football League and this policy will help you to understand how to handle personal data.

The Club / Manchester FA / Football League & board of Director’s will be responsible for ensuring compliance with this Policy. Any questions about this Policy or data protection concerns should be referred to the committee.

We process employee, player, volunteer, member, referee, coach, manager, contractor, committee, supplier and third party personal data for administrative Club / Manchester FA / Football League management purposes. Our purpose for holding this personal data is to be able to contact relevant individuals on Club / Manchester FA / Football League business or administer the terms of your employment, and our legal basis for processing your personal data in this way is the contractual relationship we have with you. We will keep this data for 12 months after the end of your official relationship with the Club / Manchester FA / League unless required otherwise by law and / or regulatory requirements. If you do not provide your personal data for this purpose, you will not be able to carry out your role or the obligations of your contract with the Club / Manchester FA / Football League.

All the key definitions under GDPR can be found here.

What we need from you

To assist with our compliance with GDPR we will need you to comply with the terms of this policy. We have set out the key guidance in this section but please do read the full policy carefully.

Please help us to comply with the data protection principles (set out briefly in section 3 of this policy and in further detail below):

please ensure that you only process data in accordance with our transparent processing as set out in our Privacy notice;

please only process personal data for the purposes for which we have collected it (i.e. if you want to do something different with it then please speak to Jackie Tierney first);

please do not ask for further information about players and / or members and / or staff and / or volunteers without first checking with Jackie Tierney;

if you are asked to correct an individual’s personal data, please make sure that you can identify that individual and, where you have been able to identify them, make the relevant updates on our records and systems;

please comply with our retention periods listed in our Privacy Notice and make sure that if you still have information which falls outside of those dates, that you delete/destroy it securely;

please treat all personal data as confidential. If it is stored in electronic format then please consider whether the documents themselves should be password protected or whether your personal computer is password protected and whether you can limit the number of people who have access to the information. Please also consider the security levels of any cloud storage provider (and see below). If it is stored in hard copy format then please make sure it is locked away safely and is not kept in a car overnight or disposed of in a public place;

if you are looking at using a new electronic system for the storage of information, please talk to Jackie Tierney first so that we can decide whether such a system is appropriately secure and complies with GDPR;

if you are planning on sharing personal data with anybody new or with a party outside the FA structure then please speak to Jackie Tierney before doing so who will be able to check that the correct contractual provisions are in place and that we have a lawful basis to share the information;

if you receive a subject access request (or you think somebody is making a subject access request for access to the information we hold on them) then please tell Jackie Tierney as soon as possible because we have strict timelines in which to comply;

if you think there has been a data breach (for example you have lost personal data or a personal device which contains personal data or you have been informed that a coach has done so, or you have sent an email and open copied all contacts in) then please speak to Jackie Tierney who will be able to help you to respond.

If you have any questions at any time then please just ask Jackie Tierney.  We are here to help.

Data protection principles

Anyone processing personal data must comply with the enforceable principles of data protection. Personal data must be:

processed lawfully, fairly and in a transparent manner;

collected for only specified, explicit and legitimate purposes; 

adequate, relevant and limited to what is necessary for the purpose(s) for which it is processed;

accurate and, where necessary, kept up to date;

kept in a form which permits identification of individuals for no longer than is necessary for the purpose(s) for which it is processed; 

processed in a manner that ensures its security by appropriate technical and organisational measures to protect against unauthorised or unlawful processing and against accidental loss, destruction or damage;

We are responsible for and must be able to demonstrate compliance with the data protection principles listed above.

Fair and lawful processing

This Policy aims to ensure that our data processing is done fairly and without adversely affecting the rights of the individual.

Lawful processing means data must be processed on one of the legal bases set out in the GDPR. When special category personal data is being processed, additional conditions must be met. 

Processing for limited purposes

Ashton United Football Club collects and processes personal data. This is data we receive directly from an individual and data we may receive from other sources.

We will only process personal data for the purposes of Ashton United Football Club as instructed by the committee, Football League, the County FA or The FA, or as specifically permitted by the GDPR. We will let individuals know what those purposes are when we first collect the data or as soon as possible thereafter.

Consent

One of the lawful bases on which we may be processing data is the individual’s consent.

An individual consents to us processing their personal data if they clearly indicate specific and informed agreement, either by a statement or positive action. 

Individuals must be easily able to withdraw their consent at any time and withdrawal must be promptly honoured. Consents should be refreshed every season. 

Explicit consent is usually required for automated decision-making and for cross-border data transfers, and for processing special category personal data. Where children are involved then the consent must be in writing from parent/guardian

Where consent is our legal basis for processing, we will need to keep records of when and how this consent was captured.

Our Privacy Notice sets out the lawful bases on which we process data of our players and members.

Notifying individuals

Where we collect personal data directly from individuals, we will inform them about:

the purpose(s) for which we intend to process that personal data;

the legal basis on which we are processing that personal data;

where that legal basis is a legitimate interest, what that legitimate interest is;

where that legal basis is statutory or contractual, any possible consequences of failing to provide that personal data;

the types of third parties, if any, with which we will share that personal data, including any international data transfers;

their rights as data subjects, and how they can limit our use of their personal data;

the period for which data will be stored and how that period is determined;

any automated decision-making processing of that data and whether the data may be used for any further processing, and what that further processing is.

If we receive personal data about an individual from other sources, we will provide the above information as soon as possible and let them know the source we received their personal data from;

We will also inform those whose personal data we process that we, Ashton United / Manchester FA / Football League, are the data controller in regard to that data, and which individual(s) in Ashton United / Manchester FA / Football League are responsible for data protection.

Adequate, relevant and non-excessive processing

We will only collect personal data that is required for the specific purpose notified to the individual.

You may only process personal data if required to do so in your official capacity with Ashton United / Manchester FA / Football League. You cannot process personal data for any reason unrelated to your duties.

Ashton United / Manchester FA / Football League must ensure that when personal data is no longer needed for specified purposes, it is deleted or anonymised.

Accurate data

We will ensure that personal data we hold is accurate and kept up to date. We will check the accuracy of any personal data at the point of collection and at the start of each season. We will take all reasonable steps to destroy or amend inaccurate or out-of-date data. 

Timely processing

We will not keep personal data longer than is necessary for the purpose(s) for which they were collected. We will take all reasonable steps to destroy or delete data which is no longer required, as per our Privacy Notice.

Processing in line with data subjects’ rights

As data subjects, all individuals have the right to:

be informed of what personal data is being processed;

request access to any data held about them by a data controller;

object to processing of their data for direct-marketing purposes (including profiling);

ask to have inaccurate or incomplete data rectified;

be forgotten (deletion or removal of personal data);

restrict processing;

data portability; and

not be subject to a decision which is based on automated processing.

Ashton United is aware that not all individuals’ rights are absolute, and any requests regarding the above should be immediately reported to the committee, and if applicable escalated to the Manchester FA / FA for guidance. 

Data security

We will take appropriate security measures against unlawful or unauthorised processing of personal data, and against the accidental loss of, or damage to, personal data.

We have proportionate procedures and technology to maintain the security of all personal data. 

Personal data will only be transferred to another party to process on our behalf (a data processor) where we have a GDPR-compliant written contract in place with that data processor.

We will maintain data security by protecting the confidentiality, integrity and availability of the personal data.

Our security procedures include:

Entry controls. Any stranger seen in entry-controlled areas should be reported.

Secure desks, cabinets and cupboards. Desks and cupboards should be locked if they hold personal data.

Methods of disposal. Paper documents should be shredded. Digital storage devices should be physically destroyed.

Equipment. Screens and monitors must not show personal data to passers-by, and should be locked when unattended. Excel spreadsheets will be password protected.

Personal Devices. Anyone accessing or processing Ashton United / Manchester FA / Football League’s personal data on their own device, must have and operate a password only access or similar lock function, and should have appropriate anti-virus protection. These devices must have Ashton United / Manchester FA / Football League’s personal data removed prior to being replaced by a new device or prior to such individual ceasing to work with or support Ashton United / Manchester FA / Football League. Disclosure and sharing of personal information

We share personal data with Manchester FA & The FA, and with applicable leagues using Whole Game System.

We may share personal data with third parties or suppliers for the services they provide, and instruct them to process our personal data on our behalf as data processors. Where we share data with third parties, we will ensure we have a compliant written contract in place incorporating the minimum data processer terms as set out in the GDPR, which may be in the form of a supplier’s terms of service.

We may share personal data we hold if we are under a duty to disclose or share an individual’s personal data in order to comply with any legal obligation, or in order to enforce or apply any contract with the individual or other agreements; or to protect our rights, property, or safety of our employees, players, other individuals associated with the Ashton United / Manchester FA / Football League or others. 

Transferring personal data to a country outside the EEA

We may transfer any personal data we hold to a country outside the European Economic Area (EEA), provided that one of the appropriate safeguards applies.

Reporting a personal data breach

In the case of a breach of personal data, we may need to notify the applicable regulatory body and the individual. 

If you know or suspect that a personal data breach has occurred, inform a member of the committee immediately, who may need to escalate to the Manchester FA / FA as appropriate. You should preserve all evidence relating to a potential personal data breach. 

Dealing with subject access requests

Individuals may make a formal request for information we hold about them. Anyone who receives such a request should forward it to the board/committee immediately, and where necessary escalated to the Manchester FA / FA for guidance. Nobody should feel bullied or pressured into disclosing personal information.

When receiving telephone enquiries, we will only disclose personal data if we have checked the caller's identity to make sure they are entitled to it.

Accountability

Ashton United / Manchester FA / Football League must implement appropriate technical and organisational measures to look after personal data, and is responsible for, and must be able to demonstrate compliance with the data protection principles.

Ashton United / Manchester FA / Football League must have adequate resources and controls in place to ensure and to document GDPR compliance, such as:

providing fair processing notice to individuals at all points of data capture;

training committee and volunteers on the GDPR, and this Data Protection Policy; and

reviewing the privacy measures implemented by the Ashton United / Manchester FA / Football League.

Changes to this policy

We reserve the right to change this policy at any time. Where appropriate, we will notify you by email.

 

介绍

本政策规定了我们如何收集、处理和保存您的个人数据，如果您访问我们的在线商店或以其他方式向我们提供个人数据。我们是位于伦敦N13 4BS Green Lanes 459b的Kaizen Ticketing Solutions LTD。我们是您个人数据的数据控制者。

本政策影响您的法律权利和义务，请仔细阅读。如果您有任何问题，请通过电子邮件联系我们或拨打0208 858 0709。

我们收集的个人数据

当您预订门票或购买商品时，我们会收集、处理、存储和使用个人数据，包括您的姓名、地址和电子邮件地址以及支付信息。如果您为他人注册参加活动，我们也可能收集您提供的关于其他人的个人数据。您同意您已通知任何其他人您向我们提供的个人数据的隐私声明，并在必要时获得他们的同意，以便我们可以根据本政策合法处理他们的个人数据。

您提供给我们的所有个人数据必须真实、完整和准确。如果您向我们提供不准确或虚假的数据，并且我们怀疑身份欺诈，我们将记录此情况。

您无需提供任何个人数据即可查看我们的在线商店。但是，我们可能仍会根据本政策的数据自动收集部分收集信息，并根据本政策的营销通信部分进行营销通信。

当您通过电子邮件或邮寄方式联系我们时，我们可能会保留通信记录，并且我们可能会记录与您的任何电话通话。

我们自动收集的数据

当您访问我们的在线商店时，我们或代表我们的第三方会自动收集并存储有关您的设备和活动的信息。此信息可能包括(a)您的计算机或其他设备的唯一ID号；(b)有关您的设备的技术信息，例如设备类型、网络浏览器或操作系统；(c)您的偏好和设置，例如时区和语言；以及(d)有关您的浏览行为和模式的统计数据。我们根据本政策的Cookie部分使用Cookie收集此信息，并以匿名方式使用我们收集的信息来改进我们的在线商店和我们提供的服务，并用于分析和研究目的。

营销通信

如果您选择接收我们的营销通信，您同意处理您的数据以发送此类通信，其中可能包括新闻通讯、博客文章、调查和有关新活动的信息。我们保留您的同意记录。

您可以选择不再接收营销通信，方法是通过电子邮件联系我们，点击营销电子邮件中的取消订阅或在您的在线账户中更新您的偏好。如果您取消订阅营销通信，可能需要长达5个工作日才能使您的新偏好生效。因此，我们将在记录中保留您的个人数据用于营销目的，直到您通知我们您不再希望接收我们的营销电子邮件。

合法处理您的个人数据

我们将使用您的个人数据以履行我们向您提供您预订的活动门票或您订购的商品的合同义务，包括与您联系有关活动或商品的任何信息，并处理您对活动或商品的任何问题、评论或投诉。

我们也可能出于我们的合法利益使用您的个人数据，包括处理您需要的任何客户服务，执行我们之间任何其他协议的条款，出于监管和法律目的（例如反洗钱），用于审计目的，并与您联系有关本政策的更改。

我们与谁共享您的数据？

我们可能会与我们可能委任的任何服务提供商、分包商和代理商共享您的个人数据，以代表我们并根据我们的指示执行功能，包括支付提供商、电子邮件通信提供商、IT服务提供商、会计师、审计师和律师。

在某些情况下，我们可能需要根据适用的法律和/或法规披露您的个人数据，例如，作为反洗钱流程的一部分或保护第三方的权利、财产或安全。

我们也可能在与任何合并、资产出售、合并或重组、融资或我们业务的全部或部分被另一家公司收购的谈判中或与之相关的情况下共享您的个人数据。

我们在哪里保存和处理您的个人数据

您的部分或全部个人数据可能会因任何原因存储或转移到欧盟（EU）以外的地方，例如，如果我们的电子邮件服务器位于欧盟以外的国家，或者我们的任何服务提供商或其服务器位于欧盟以外。我们将仅将您的个人数据转移给已提供足够保障的组织。

Cookies

Cookie是一个包含唯一识别号的小文本文件，通过您的浏览器从网站传输到您计算机的硬盘。Cookie识别您的浏览器，但不会让网站知道您的任何个人数据，例如您的姓名和/或地址。这些文件随后被网站用来识别用户何时重新访问该网站。

我们的在线商店使用Cookie，以便我们可以在您返回时识别您并个性化您的设置和偏好。大多数浏览器最初设置为接受Cookie。您可以更改浏览器设置，以便在您收到Cookie时通知您，或拒绝接受Cookie。请注意，如果您拒绝接受Cookie，我们的在线商店可能无法高效运行。

我们还使用Google Analytics来监控在线商店的使用情况。Google Analytics匿名收集信息并生成报告，详细说明访问在线商店的次数、访问者通常来自哪里、在网站上停留的时间以及访问了哪些页面。Google Analytics在您计算机的硬盘上放置了几个持久性Cookie。这些不收集任何个人数据。如果您不同意此操作，您可以在浏览器中禁用持久性Cookie。这将阻止Google Analytics记录您的访问。

安全

我们将以确保个人数据适当安全的方式处理您的个人数据，包括防止未经授权或非法处理以及意外丢失、破坏或损坏，使用适当的技术或组织措施。您提供给我们的所有信息都存储在我们的安全服务器上。任何支付交易都使用SSL技术加密。

如果我们已提供或您选择了密码，您有责任对该密码保密。

但是，您承认没有系统可以完全安全。因此，尽管我们采取这些步骤来保护您的个人数据，但我们不承诺您的个人数据将始终保持完全安全。

您的权利

您有权从我们这里获得我们持有的您的个人数据的副本，并要求我们纠正不准确或不完整的个人数据中的错误。您也有权随时要求我们删除您的个人数据。要行使这些权利或您根据适用法律可能拥有的任何其他权利，请通过电子邮件联系我们。

请注意，如果您的请求明显没有根据或过度，我们保留收取管理费的权利。
如果您对本政策或我们处理您的个人数据有任何投诉，您应联系英国监管机构：信息专员（www.ico.org.uk）。

我们的在线商店可能包含其他感兴趣网站的链接。一旦您使用这些链接离开我们的网站，您应该注意我们对该其他网站没有任何控制。因此，我们不能对您在访问此类网站时提供的任何信息的保护和隐私负责，此类网站不受本政策的约束。您应谨慎行事，并查看相关网站的隐私政策。

保留

如果您在我们这里注册，我们将保留您的个人数据，直到您关闭您的账户。
如果您接收我们的营销通信，我们将保留您的个人数据，直到您选择不再接收此类通信。
如果您与我们进行了预订或联系我们提出问题或评论，我们将在此类联系后的48个月内保留您的个人数据，以便回应您可能有的任何进一步查询。

一般

如果本政策的任何条款被有管辖权的法院认定为无效或不可执行，则该条款应尽可能地解释为反映各方的意图，所有其他条款应保持完全有效。

本政策应受英格兰和威尔士法律管辖并根据其解释，您同意提交给英格兰法院的专属管辖权。
我们可能会不时更改本政策的条款。您有责任定期查看本政策，以便了解其任何更改。如果您在我们声明更改生效的时间后继续使用我们的在线商店，您将接受这些更改。