1) Who we are & how to contact us
We are Beckenham Rugby Football Club Limited (Beckenham RFC), Balmoral Avenue, Beckenham, Kent, BR3 3RD. We are the data controller for the personal data we process about members, parents/carers, players, volunteers, officials, visitors and website users. For day-to-day queries or to use your privacy rights, please contact us via the Contact page on our website (this shows the current Secretary and committee contacts). beckenhamrfc.com+1
If you’re unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office (ICO) or get advice: ico.org.uk/make-a-complaint and 0303 123 1113. ICO+1
Principles of UK GDPR
We follow the UK GDPR principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (security); and accountability. In practice, that means we only collect what we need, explain why, keep it up-to-date, secure it appropriately, and keep records to show we’ve done the right things.

2) What this policy covers
This notice explains what personal data we collect, why we use it, our lawful bases, who we share it with (including the RFU’s Game Management System, “GMS”), how long we keep it, and your rights. It follows ICO guidance on what a privacy notice must include and links to Beckenham RFC policies on our website. ICO+2ICO+2

3) The data we collect
Depending on your role and relationship with the club, we may collect:

• Identity & contact details (e.g., name, DOB, address, phone, email), membership details, RFU/GMS ID, age-grade details for U18s, role(s) held at the club.
• Participation records (training/matches, teams, qualifications, discipline outcomes), safeguarding information where relevant, DBS status where applicable.
• Payment details you provide to pay subs/fees or reimburse expenses.
• Health information you choose to share for first aid, welfare, injury reporting or reasonable adjustments (e.g., allergies, concussion status).
• Media you share or that we take at club activities (photos/video), per our Photography Policy.
• Website/app usage data and cookie preferences (see “Website, cookies & PECR” below).

We also receive data from parents/guardians (for U18s), match officials, other clubs/CBs, and from RFU systems (e.g., GMS). (See RFU GMS privacy notice for how RFU uses data in GMS.) englandrugby.com

4) Why we use your data (our lawful bases)
We only use personal data where we have a lawful reason under UK GDPR and the Data Protection Act 2018. In plain English:

• To run club membership and rugby activities (creating accounts, registering players, allocating teams, fixtures, training, tours, volunteer management): contract (membership), legitimate interests (to run a rugby club), and legal obligation (e.g., safeguarding/health & safety). We document our legitimate interests and balance them against your rights, per ICO guidance. ICO
• Age-grade rugby & safeguarding (including DBS checks coordinated with RFU/Kent CB): legal obligation and public interest in safeguarding children, in line with RFU Regulation 21. englandrugby.com
• Health/medical details you give us (e.g., emergency contacts, first-aid notes, concussion status): usually explicit consent; in emergencies vital interests; and for some club activities we may rely on not-for-profit body provisions for members/regular contacts (special category data condition Article 9(2)(d)). We use the ICO’s framework for special category data. ICO+1
• Serious injury/injury surveillance & safety reviews: legitimate interests (player welfare) and legal obligation where applicable; we follow RFU RugbySafe guidance and the RFU’s reporting expectations. englandrugby.com
• Finance (collecting subs/fees, gift aid, paying expenses): contract and legal obligation (tax/audit).
• Club communications about operations and fixtures: legitimate interests (reasonable club updates you would expect).
• Marketing (optional): consent only where PECR requires it (e.g., email/SMS promotions). You can withdraw consent any time. ICO

5) Children’s information (U18s)
We take extra care with children’s data. Parents/carers typically provide and manage consents; older children may exercise their own rights where appropriate. We align with RFU safeguarding requirements. englandrugby.com

6) Who we share data with

• RFU & Kent CB via GMS: to register players/volunteers, administer competitions, eligibility, safeguarding and discipline. See the RFU GMS Privacy Notice for how the RFU uses GMS data. englandrugby.com
• Our service providers (“processors”) who support our website, emails, membership tools, payments and IT. Notably, Pitchero provides our club website platform; see Pitchero’s Privacy Policy for its own processing as a controller/processor. Pitchero
• Event and tour organisers, referee societies, leagues (only what’s necessary to run rugby activity).
• Authorities (e.g., police/Local Authority/DBS) where required by law or to protect vital interests.
• We keep a current list of key club policies and documents on our Policies page and will signpost processors there. beckenhamrfc.com
• ProActive Reporting platform (incident & injury reporting)
• We use the ProActive Reporting platform to collect and manage safety‑related information such as incident, injury and hazard reports, and safety checklists. ProActive acts as our data processor: your report data remains owned by Beckenham RFC; ProActive only processes it to provide the service to us. ProActive does not sell your content or data and will only disclose it in limited circumstances (e.g., where required by law or with permission).

7) Website, cookies & PECR
Our public website is hosted on Pitchero. Cookies and similar tech are managed on-site (you’ll see “manage consents”). Where electronic marketing or non-essential cookies are used, we comply with PECR (which sits alongside UK GDPR) — meaning consent is required for most marketing emails/SMS and for non-essential cookies. See Pitchero’s policy and our Policies page. beckenhamrfc.com+2ICO+2

8) Photography, filming & social media
We follow our Photography Policy and RFU guidance. We seek appropriate consent for U18s; avoid publishing personal details with images; and will act on any reasonable request to remove images from club channels. See our Policies page for current documents. beckenhamrfc.com

9) How long we keep your data (retention)
We keep personal data only as long as necessary for the purpose collected, then securely delete or anonymise it. As a guide, membership/finance records are usually retained up to six years after your active involvement ends (to meet tax/audit or legal requirements). Historic match reports, team sheets and honours lists may be kept indefinitely as a club archive. We review retention in line with the ICO’s storage limitation principle. ICO

10) Security
We take appropriate technical and organisational measures to keep data secure and limit access to those who need it. Where we use processors (e.g., website, email and cloud providers) we require suitable safeguards in their contracts and platforms. (Pitchero sets out its own security measures in its privacy and GDPR pages.) Pitchero
11) International transfers
If data is stored or accessed outside the UK (for example by a cloud provider), we will ensure an appropriate transfer safeguard — such as the ICO’s International Data Transfer Agreement (IDTA), the UK Addendum to EU SCCs, or the UK-US Data Bridge where applicable. ICO+2ICO+2

12) Your rights
You have rights over your data, including: access, correction, erasure, restriction, objection, portability, and rights in relation to automated decisions. To exercise them, contact us via the website Contact page.

Subject Access Requests (SAR)
You can ask for a copy of the personal data we hold about you (a ‘subject access request’). Please email the Club Secretary via the Contact page on our website and state you are making a subject access request. We may ask for proof of ID and clarification to help us locate the data. We will respond within one month of receipt; we may extend by up to two further months for complex or multiple requests (we will tell you if we do). There is no fee unless a request is manifestly unfounded or excessive. You also have rights to rectification, erasure, restriction, objection and portability; see our full Privacy Policy for details
If you’re unhappy with our response, you can complain to the ICO (see Section 1). ICO

13) RFU-specific notes
We use the RFU’s Game Management System (GMS) to manage player/volunteer registrations and club administration. The RFU is a separate controller for its own use of GMS data — please read the RFU’s GMS privacy notice. englandrugby.com
Our approach follows the RFU’s Data Protection/RugbySafe resources for clubs. englandrugby.com

14) How this links to our website policies
Please read this notice together with the policies on our Policies page (e.g., Code of Conduct, Equality, Parents & Guardians, Photography). Where this notice conflicts with older versions, this notice takes precedence. beckenhamrfc.com

15) Important insurance & safety note
Rugby is a physical contact sport. While coaching and matches are supervised to minimise risk, injuries can occur. The RFU’s compulsory insurance offers limited benefits and may not cover loss of earnings. We strongly recommend members consider their own additional personal cover. The RFU encourages an up‑to‑date tetanus vaccination; a properly fitted gumshield is strongly recommended, and headguards may be worn where compliant with World Rugby Law 4/RFU Reg. 12. For U18 activity, parents/carers remain responsible before and after sessions; club supervision applies only during scheduled activities. See our RugbySafe page for more on player welfare and HEADCASE.

16) Consent statements (how we record your choices)
We mirror the following consents in online sign‑up (GMS/Pitchero) so your choices are stored with your member record. You may change or withdraw consent at any time; this will not affect previous lawful use.
• Parent/Carer (U18 players): First aid & sharing essential information with clinicians if needed; emergency treatment/ambulance if a parent/carer cannot be reached; photography/short video for club purposes (option to allow images but not names); RFU/CB use of images for rugby development/competition coverage (optional); team sheets using first name + initial only; club communications to parents about fixtures/training (non‑marketing).
• Senior players (18+): First aid & emergency treatment if required; photography/short video for club purposes; sharing necessary data with RFU/Kent CB via GMS; club communications about fixtures/training (non‑marketing).
• Members/Volunteers: Club operations communications (non‑marketing); optional marketing/newsletter emails (PECR consent).

17) Acknowledgements & liability (plain‑English)
• Participation: I understand rugby is a contact sport. I will follow safety guidance from coaches and officials.
• Medical consent (U18s): In the absence of a parent/carer, I consent to appropriate first‑aid and, if required, emergency treatment being arranged for my child.
• Photography & video: I consent according to the choices I make at sign‑up. For U18s, we follow RFU guidance and will remove images from club channels on reasonable request.
• Codes of Conduct: I confirm I have read and agree to the relevant Codes (Players/Coaches/Parents & Spectators).
• Liability: Nothing in our terms seeks to exclude or limit liability where it would be unlawful to do so (for example, for death or personal injury caused by negligence).
For the current versions of the Codes of Conduct, Safeguarding, Equality/EDI, RugbySafe and this Privacy Policy, see the Policies page on our website.

18) Changes to this notice
We’ll update this page if anything material changes (law, RFU/ICO guidance, or our systems). We’ll show the new version/date at the top. This policy is intended to be easy to read and meets ICO guidance on privacy notices.

General Data Protection Regulation, Beckenham Rugby Football Club Limited Privacy Policy
This statement explains how Beckenham Rugby Football Club (BRFC) handles and uses the personal details which it collects about its Members, Associated Clubs, Individual Associates, Corporate Associates and officials of BRFC in any capacity (hereinafter collectively called Members) and players of the game of Rugby Union Football (the Game). Retention of this information regarding Members and players enables BRFC to keep in touch with them in order to keep them advised of BRFC activities, and to enable BRFC to discharge its responsibilities and to pursue its legitimate interests as a Community Rugby Club of a National Sport, i.e. the Game. Data may be shared with Constituent Bodies such as, Kent County Rugby Football Union (KCRFU) and Rugby Football Union (RFU), which may use such data to regulate, develop and manage the Game. BRFC is committed to protecting all personal information and being open about the nature of the information it holds. In the event that BRFC, Constituent Bodies or RFU rely upon an individual’s consent for holding such data, such consent may be withdrawn at any time.

The extent of this Policy:
This policy describes how BRFC will make use of the data it handles in pursuit of its legitimate interests, including its use of the Game Management System (GMS) provided by RFU, and also describes the RFU’s use of data on GMS. It also describes Members’ data protection rights, including a right to object to some processing which BRFC may carry out.

Personal Data Collected and Held:
The personal information held by BRFC will primarily be that provided by Members and players (or, in the case of minors, by their parents) in correspondence from Members by post, telephone, email or otherwise. On occasion, details regarding Members and players may be received from rugby clubs within other Counties or RFU. The records may contain:

• Contact details as supplied and periodically updated by Members and players.
• The name, gender, and date of birth of individuals.
• An individual’s RFU ID (as assigned in GMS).
• Passport and/or NI details.
• Club affiliations and details of membership, offices & positions held within the Game.
• Bank account details when provided for payment of membership or other fees or to enable BRFC to make payments.
• Personal data supplied by Members and players for specific purposes (e.g. injuries, medical conditions and disability requirements).
• Any qualifications or work experience supplied by an individual

Information received from third parties:
BRFC may receive information from third parties, e.g. information regarding a minor supplied by parents. BRFC may also receive information relating to existing registrations with other clubs or rugby bodies, or disciplinary history from RFU through GMS, and, especially in the case of those working with children, information from the Disclosure and Barring Service and RFU.

Use of Personal Data by BRFC:
Members’ Personal Data may be used by BRFC for:

• Sending to Members and players details of its activities and inviting them to attend events.
• Collecting subscriptions and other payments, which may be due.
• Discharging its responsibilities as a Community Rugby Club and as prescribed by RFU.
• Internal record keeping.
• Administrative purposes.
• Photographing and filming of matches and training sessions for the purposes of (a) training and performance reviews and (b) promoting the activities of BRFC.
• Purposes required by law, e.g. maintenance of accounting and health and safety records, compliance with the requirements of government and law enforcement authorities.

• The name, date of birth and gender of individuals.
• An individual’s RFU ID (as assigned in GMS).
• Contact details.
• Involvement in BRFC teams and administration.

1. To conduct its business and to pursue its legitimate interests, in particular:
2. Communicating with or about individuals where necessary to administer the Game in England, including responding to valid questions sent to the RFU about GMS.
3. Administering and ensuring the eligibility of players, match officials, and others involved in the Game in England, which may involve the receipt of limited amounts of sensitive data in relation to disabled players where they are registered for a disabled league or team, or in relation to anti-doping matters.
4. Maintaining records of the Game, in particular, maintaining details of discipline and misconduct.
5. Monitoring use of GMS and using this to help it, monitor, improve and protect its content and services and investigate any complaints received about GMS.
6. Maintaining statistics and conducting analysis on the make-up of the Game’s participants.
7. Ensuring compliance with all current RFU Rules and Regulations.
8. Communicating to seek opinions on RFU initiatives.
9. For purposes required by law, e.g. to ensure that those working with children have undergone, with their consent, an appropriate DBS check, providing information to government or law enforcement agencies carrying out an investigation.

Direct Marketing:
BRFC will not use personal data for any direct marketing purposes whatsoever.

Sharing of
BRFC may share some limited information with other stakeholders in the Game, such as other Constituent Bodies, clubs, schools, academies, recognised development organisations with whom BRFC deals for legitimate purposes, referee societies, league organisers, in order that they may maintain appropriate records, and assist in organising matches, administering the Game and developing players.
Personal data may be shared with government authorities and/or law enforcement agencies if mandated by law, or if required for the legal protection of the legitimate interests of BRFC, Constituent Bodies and RFU in compliance with applicable laws. Personal data may also be shared with third-party service providers who will process it on behalf of BRFC.

Members’ and players’ Rights:
Members and players have the right to:

• Ask BRFC, Constituent Bodies or RFU for access to, or rectification or erasure of, their individual data Provided that BRFC, Constituent Bodies and RFU will not delete information that it is required to keep by law, or to comply with RFU Rules and Regulations.
• Restrict the data provided, subject to the proviso above.
• Object to the receipt of communications by any specific method.
• Request the transfer of their individual data to a third party.
• Members have the right to lodge a complaint with the Information Commissioner’s Office

Retention of
Members’ and players’ personal data will be processed for as long as they retain their membership or active involvement with BRFC and for up to six years thereafter. BRFC will retain information to maintain statutory records in line with appropriate statutory requirements or guidance. The RFU will maintain records of individuals registered on GMS, records of DBS checks, and the resulting outcomes and other disciplinary matters for such period as is set out in the RFU’s privacy notice Records of an individual’s involvement in a particular match, on team sheets, on results pages or in match reports may be held indefinitely by BRFC, Constituent Bodies and RFU in order to maintain a record of the game.

Further Information:
The legal basis for processing your personal data for the purposes set out above is that it is necessary for the pursuit of BRFC’s legitimate interests. BRFC always handles personal data securely and minimises its use, and there is no overriding prejudice to Members and players by using their personal information for these purposes. However, there is no statutory or contractual requirement for Members and players to provide BRFC with any personal data.

Those who have concerns or questions about the information contained in this statement, or who do not want BRFC to process their personal data for specific purposes, should contact the Honorary Secretary, who at this time is Megan Pain, email: megan_ingham@hotmail.com

Where Members or players have specific requests relating to the management of their personal data, BRFC will endeavour to resolve these but there may be circumstances where it is unable to comply with a specific request. Anyone who has any concerns about how the RFU processes their data should get in touch with the RFU in the first instance by email legal@rfu.com or write to The Data Protection Officer, Rugby Football Union, Twickenham Stadium, 200 Whitton Road, Twickenham, TW2 7BA.

These terms sit alongside the club’s Rules and apply to all membership categories. They use the same plain‑English approach as this policy and follow RFU community‑game guidance. For full details, see the Membership page on our website.

• Membership period & payment: annual membership is due at the start of each season. Instalments may be offered by the club. If payments fall into arrears, access to member benefits (including selection and facilities) may be suspended until payments are brought up to date.

• Rules & codes: by applying you agree to follow the Club Rules and the published Codes of Conduct (Players, Coaches, Parents/Spectators) and our Safeguarding and Equality/EDI policies.

• Eligibility & selection: selection is based on rugby factors (safety, development, form, availability) and follows RFU regulations for age‑grade and adult rugby.

• Data & privacy: we process personal data to administer membership and rugby activity under UK GDPR lawful bases set out in this Privacy Policy. Your consents are mirrored in the RFU’s Game Management System (GMS) and/or Pitchero so permissions are stored with your member record.

• Communication: we will send essential club/fixture information under legitimate interests. Marketing/newsletter emails or SMS are sent only with consent under PECR—you can opt out at any time via your preferences or by contacting the club via the website.

• Non‑payment & suspension: if membership payments are not maintained, the club may suspend access to member benefits (including selection) until the account is settled, in line with our Rules and competition regulations.