1) Who we are & how to contact us
We are Beckenham Rugby Football Club Limited (Beckenham RFC), Balmoral Avenue, Beckenham, Kent, BR3 3RD. We are the data controller for the personal data we process about members, parents/carers, players, volunteers, officials, visitors and website users. For day-to-day queries or to use your privacy rights, please contact us via the Contact page on our website (this shows the current Secretary and committee contacts). beckenhamrfc.com+1
If you’re unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office (ICO) or get advice: ico.org.uk/make-a-complaint and 0303 123 1113. ICO+1
Principles of UK GDPR
We follow the UK GDPR principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (security); and accountability. In practice, that means we only collect what we need, explain why, keep it up-to-date, secure it appropriately, and keep records to show we’ve done the right things.

2) What this policy covers
This notice explains what personal data we collect, why we use it, our lawful bases, who we share it with (including the RFU’s Game Management System, “GMS”), how long we keep it, and your rights. It follows ICO guidance on what a privacy notice must include and links to Beckenham RFC policies on our website. ICO+2ICO+2

3) The data we collect
Depending on your role and relationship with the club, we may collect:

Identity & contact details (e.g., name, DOB, address, phone, email), membership details, RFU/GMS ID, age-grade details for U18s, role(s) held at the club.
Participation records (training/matches, teams, qualifications, discipline outcomes), safeguarding information where relevant, DBS status where applicable.
Payment details you provide to pay subs/fees or reimburse expenses.
Health information you choose to share for first aid, welfare, injury reporting or reasonable adjustments (e.g., allergies, concussion status).
Media you share or that we take at club activities (photos/video), per our Photography Policy.
Website/app usage data and cookie preferences (see “Website, cookies & PECR” below).

We also receive data from parents/guardians (for U18s), match officials, other clubs/CBs, and from RFU systems (e.g., GMS). (See RFU GMS privacy notice for how RFU uses data in GMS.) englandrugby.com

4) Why we use your data (our lawful bases)
We only use personal data where we have a lawful reason under UK GDPR and the Data Protection Act 2018. In plain English:

To run club membership and rugby activities (creating accounts, registering players, allocating teams, fixtures, training, tours, volunteer management): contract (membership), legitimate interests (to run a rugby club), and legal obligation (e.g., safeguarding/health & safety). We document our legitimate interests and balance them against your rights, per ICO guidance. ICO
Age-grade rugby & safeguarding (including DBS checks coordinated with RFU/Kent CB): legal obligation and public interest in safeguarding children, in line with RFU Regulation 21. englandrugby.com
Health/medical details you give us (e.g., emergency contacts, first-aid notes, concussion status): usually explicit consent; in emergencies vital interests; and for some club activities we may rely on not-for-profit body provisions for members/regular contacts (special category data condition Article 9(2)(d)). We use the ICO’s framework for special category data. ICO+1
Serious injury/injury surveillance & safety reviews: legitimate interests (player welfare) and legal obligation where applicable; we follow RFU RugbySafe guidance and the RFU’s reporting expectations. englandrugby.com
Finance (collecting subs/fees, gift aid, paying expenses): contract and legal obligation (tax/audit).
Club communications about operations and fixtures: legitimate interests (reasonable club updates you would expect).
Marketing (optional): consent only where PECR requires it (e.g., email/SMS promotions). You can withdraw consent any time. ICO

5) Children’s information (U18s)
We take extra care with children’s data. Parents/carers typically provide and manage consents; older children may exercise their own rights where appropriate. We align with RFU safeguarding requirements. englandrugby.com

6) Who we share data with

RFU & Kent CB via GMS: to register players/volunteers, administer competitions, eligibility, safeguarding and discipline. See the RFU GMS Privacy Notice for how the RFU uses GMS data. englandrugby.com
Our service providers (“processors”) who support our website, emails, membership tools, payments and IT. Notably, Pitchero provides our club website platform; see Pitchero’s Privacy Policy for its own processing as a controller/processor. Pitchero
Event and tour organisers, referee societies, leagues (only what’s necessary to run rugby activity).
Authorities (e.g., police/Local Authority/DBS) where required by law or to protect vital interests.
We keep a current list of key club policies and documents on our Policies page and will signpost processors there. beckenhamrfc.com
ProActive Reporting platform (incident & injury reporting)
We use the ProActive Reporting platform to collect and manage safety‑related information such as incident, injury and hazard reports, and safety checklists. ProActive acts as our data processor: your report data remains owned by Beckenham RFC; ProActive only processes it to provide the service to us. ProActive does not sell your content or data and will only disclose it in limited circumstances (e.g., where required by law or with permission).

When you interact with ProActive’s web app or dashboards, ProActive may collect technical data such as cookies, IP addresses and log files to operate and secure the service. ProActive may also use trusted sub‑processors and affiliates to deliver the platform. See ProActive’s Privacy Policy for details.
Retention: ProActive indicates form data may be stored for up to seven years (or as instructed by the organisation). We align this with our retention schedule and will instruct deletion earlier where appropriate. If you want data removed, please contact the club via the website Contact page; we will liaise with ProActive on your request.

7) Website, cookies & PECR
Our public website is hosted on Pitchero. Cookies and similar tech are managed on-site (you’ll see “manage consents”). Where electronic marketing or non-essential cookies are used, we comply with PECR (which sits alongside UK GDPR) — meaning consent is required for most marketing emails/SMS and for non-essential cookies. See Pitchero’s policy and our Policies page. beckenhamrfc.com+2ICO+2

8) Photography, filming & social media
We follow our Photography Policy and RFU guidance. We seek appropriate consent for U18s; avoid publishing personal details with images; and will act on any reasonable request to remove images from club channels. See our Policies page for current documents. beckenhamrfc.com

9) How long we keep your data (retention)
We keep personal data only as long as necessary for the purpose collected, then securely delete or anonymise it. As a guide, membership/finance records are usually retained up to six years after your active involvement ends (to meet tax/audit or legal requirements). Historic match reports, team sheets and honours lists may be kept indefinitely as a club archive. We review retention in line with the ICO’s storage limitation principle. ICO

10) Security
We take appropriate technical and organisational measures to keep data secure and limit access to those who need it. Where we use processors (e.g., website, email and cloud providers) we require suitable safeguards in their contracts and platforms. (Pitchero sets out its own security measures in its privacy and GDPR pages.) Pitchero
11) International transfers
If data is stored or accessed outside the UK (for example by a cloud provider), we will ensure an appropriate transfer safeguard — such as the ICO’s International Data Transfer Agreement (IDTA), the UK Addendum to EU SCCs, or the UK-US Data Bridge where applicable. ICO+2ICO+2

12) Your rights
You have rights over your data, including: access, correction, erasure, restriction, objection, portability, and rights in relation to automated decisions. To exercise them, contact us via the website Contact page.

Subject Access Requests (SAR)
You can ask for a copy of the personal data we hold about you (a ‘subject access request’). Please email the Club Secretary via the Contact page on our website and state you are making a subject access request. We may ask for proof of ID and clarification to help us locate the data. We will respond within one month of receipt; we may extend by up to two further months for complex or multiple requests (we will tell you if we do). There is no fee unless a request is manifestly unfounded or excessive. You also have rights to rectification, erasure, restriction, objection and portability; see our full Privacy Policy for details
If you’re unhappy with our response, you can complain to the ICO (see Section 1). ICO

13) RFU-specific notes
We use the RFU’s Game Management System (GMS) to manage player/volunteer registrations and club administration. The RFU is a separate controller for its own use of GMS data — please read the RFU’s GMS privacy notice. englandrugby.com
Our approach follows the RFU’s Data Protection/RugbySafe resources for clubs. englandrugby.com

14) How this links to our website policies
Please read this notice together with the policies on our Policies page (e.g., Code of Conduct, Equality, Parents & Guardians, Photography). Where this notice conflicts with older versions, this notice takes precedence. beckenhamrfc.com

15) Important insurance & safety note
Rugby is a physical contact sport. While coaching and matches are supervised to minimise risk, injuries can occur. The RFU’s compulsory insurance offers limited benefits and may not cover loss of earnings. We strongly recommend members consider their own additional personal cover. The RFU encourages an up‑to‑date tetanus vaccination; a properly fitted gumshield is strongly recommended, and headguards may be worn where compliant with World Rugby Law 4/RFU Reg. 12. For U18 activity, parents/carers remain responsible before and after sessions; club supervision applies only during scheduled activities. See our RugbySafe page for more on player welfare and HEADCASE.

16) Consent statements (how we record your choices)
We mirror the following consents in online sign‑up (GMS/Pitchero) so your choices are stored with your member record. You may change or withdraw consent at any time; this will not affect previous lawful use.
• Parent/Carer (U18 players): First aid & sharing essential information with clinicians if needed; emergency treatment/ambulance if a parent/carer cannot be reached; photography/short video for club purposes (option to allow images but not names); RFU/CB use of images for rugby development/competition coverage (optional); team sheets using first name + initial only; club communications to parents about fixtures/training (non‑marketing).
• Senior players (18+): First aid & emergency treatment if required; photography/short video for club purposes; sharing necessary data with RFU/Kent CB via GMS; club communications about fixtures/training (non‑marketing).
• Members/Volunteers: Club operations communications (non‑marketing); optional marketing/newsletter emails (PECR consent).

17) Acknowledgements & liability (plain‑English)
• Participation: I understand rugby is a contact sport. I will follow safety guidance from coaches and officials.
• Medical consent (U18s): In the absence of a parent/carer, I consent to appropriate first‑aid and, if required, emergency treatment being arranged for my child.
• Photography & video: I consent according to the choices I make at sign‑up. For U18s, we follow RFU guidance and will remove images from club channels on reasonable request.
• Codes of Conduct: I confirm I have read and agree to the relevant Codes (Players/Coaches/Parents & Spectators).
• Liability: Nothing in our terms seeks to exclude or limit liability where it would be unlawful to do so (for example, for death or personal injury caused by negligence).
For the current versions of the Codes of Conduct, Safeguarding, Equality/EDI, RugbySafe and this Privacy Policy, see the Policies page on our website.

18) Changes to this notice
We’ll update this page if anything material changes (law, RFU/ICO guidance, or our systems). We’ll show the new version/date at the top. This policy is intended to be easy to read and meets ICO guidance on privacy notices.