Club Policies.

Status: MCFC working policy for committee review and approval.

1. Purpose

Maidenbower Colts Football Club (MCFC) is committed to handling personal information fairly, lawfully, securely and transparently. This policy explains the standards the Club applies when collecting, using, storing, sharing and deleting personal data relating to players, parents and guardians, volunteers, coaches, officials and other people who interact with the Club.

2. Information we may hold

Depending on a person's relationship with the Club, records may include names, contact details, dates of birth, age groups, photographs, emergency contacts, registration history, team membership, attendance or participation information, payment and subscription records, consents and permissions, identity or age-verification records, correspondence, portal account information and administrative notes.

Where genuinely necessary for player welfare or safeguarding, the Club may also hold information concerning health, disability, accessibility needs or safeguarding. Access to this information must be restricted to people who need it for their role.

3. Why we use information

MCFC uses personal information to administer membership and registrations, organise teams and football activity, communicate with families, manage fees, support player welfare and safeguarding, meet football-governance and legal obligations, operate the Club Portal and website, and maintain appropriate records.

4. Data minimisation

The Club should collect only information that is reasonably required. Access must be role based. A coach or team official should not automatically receive access to full registration records, identification documents or financial information merely because they work with a player.

5. Children

Children's personal information requires particular care. The Club will consider the interests, rights and understanding of the child when deciding how their information is used or disclosed. Privacy information should be clear and accessible to parents, guardians and, where appropriate, players themselves.

6. Identity and age documents

Where a passport, birth certificate or other document is uploaded for verification, the Club should retain the original only for as long as reasonably necessary to complete verification. Once verified, the preferred permanent record is the verification outcome, date and authorised verifier rather than an unnecessary copy of the source document.

7. Sharing

Information may be shared where necessary with football governing bodies, leagues, County FA, payment providers, insurers, professional advisers, service providers supporting Club systems, or public authorities and safeguarding bodies where required or appropriate. MCFC does not sell members' personal information.

8. Security

The Club will use appropriate technical and organisational controls including restricted permissions, account security, audit logging, secure hosting and controlled exports. Personal data must not be downloaded, copied or shared for convenience when there is no operational need.

9. Retention and deletion

Information will not be kept indefinitely merely because storage is available. The Club will apply its Data Retention Policy and securely delete or anonymise records when there is no continuing legal, safeguarding, financial or operational reason to retain them.

10. Individual rights

People may have rights in relation to their personal data, including access, correction, deletion in appropriate circumstances, restriction, objection and portability where applicable. Requests should be sent to the Club through the published contact route and logged in the Data Protection area of the Club Portal.

11. Accountability

Authorised Club officers are responsible for following this policy. Personal-data exports, subject access requests and significant data-protection actions should be recorded so the Club can demonstrate how requests and information have been handled.

Status: MCFC working policy for committee review and approval.

Principle

MCFC keeps personal information only for as long as it is reasonably needed for the purpose for which it was collected, or where a legal, financial, football-governance or safeguarding reason requires longer retention.

Operational approach

• Current player and family records are retained while membership is active and while needed to administer the relevant season.
• Identity or age-verification source documents should be deleted promptly after authorised verification unless a documented reason requires temporary retention.
• The Club should retain a verification record showing what was verified, when and by whom, rather than keeping unnecessary identity-document copies.
• Financial and accounting records are retained for the period required for the Club's accounting and legal obligations.
• Safeguarding records are not subject to routine deletion merely because a player leaves the Club; retention must follow applicable safeguarding requirements and advice.
• Routine contact details, expired permissions, obsolete uploads and duplicate records should be reviewed and removed when no longer needed.

Annual review

The Club should carry out an annual retention review, with authorised administrators able to identify expired documents and records due for deletion from the Data Protection dashboard.

Status: MCFC working procedure for committee review and approval.

Receiving a request

A request for a person's personal information should be logged in the Club Portal Subject Access Register as soon as it is recognised. A request does not need to use the words “subject access request” to be valid.

Identity and authority

Before releasing information, the Club must be satisfied about the requester's identity and, where somebody is acting for another person, their authority to do so. Checks should be reasonable and proportionate.

Children's information

Where a request concerns a child, the Club must consider whose right of access is being exercised and whether the requester is entitled to receive the information. Parent or guardian status alone should not be treated as an automatic reason to release every item in a child's record.

Search and review

The Club Portal's Data Held function should be used to assemble records linked to the person. The result must be reviewed before release for third-party information, safeguarding restrictions, duplicated records, legal restrictions or information that does not belong to the requester.

Response

Requests should be handled without undue delay and within the applicable statutory timescale. The SAR Register records the request, verification status, due date, outcome, export reference and responsible user.

Export

The Club may provide a clear PDF report and, where appropriate, a structured electronic copy. All exports should be logged. The report should explain the categories of information held and relevant supporting privacy information.

Status: MCFC working procedure for committee review and approval.

What counts as a personal-data breach?

A breach can include loss, accidental deletion, unauthorised access, disclosure to the wrong recipient, compromised credentials, publication of private records, or loss of availability of personal information.

Immediate action

Anyone who becomes aware of a suspected breach should report it promptly to an authorised Club officer. The Club should contain the incident, preserve relevant evidence, establish what information and people are affected, and prevent further access or disclosure.

Assessment and record

The incident should be documented, including what happened, when it was discovered, categories and approximate volume of data affected, likely consequences, containment measures and decisions taken. Where notification to the ICO or affected people may be required, the Club should obtain appropriate advice promptly and work within the applicable statutory timescales.

Maidenbower Colts FC adopts and works within The Football Association's current safeguarding framework and procedures. The welfare of children and young people is the paramount consideration.

Safeguarding concerns should be reported promptly to the Club Welfare Officer or through the appropriate FA, County FA or statutory safeguarding route. In an emergency or where a child is in immediate danger, contact the emergency services.

This Club summary does not replace The FA's current safeguarding policy, regulations or procedures. The public Safeguarding page should provide the current Club Welfare Officer contact details and links to official FA resources.

Status: MCFC working policy for committee review and approval.

Photography and video can positively celebrate grassroots football, but player welfare and privacy come first. MCFC will use player images only for legitimate Club purposes and in line with recorded permissions, safeguarding guidance and any restrictions notified to the Club.

• Permissions should be recorded separately from general registration acceptance where appropriate.
• Images should not be accompanied by unnecessary personal information.
• Club-controlled photographs and video must be suitable and respectful.
• Coaches and volunteers should use approved Club channels and follow current safeguarding guidance when capturing or sharing youth-football content.
• A parent, guardian or player should have a clear route to raise concerns or request that future Club use of an image stops, subject to lawful exceptions.

MCFC does not tolerate bullying in person, online, at training, at matches or in Club-related communications. Reports will be taken seriously and handled with the welfare of children and young people as the priority.

Coaches, officials, parents, guardians and players should report concerns promptly to the appropriate coach, Club Welfare Officer or safeguarding route. The Club may involve the County FA, The FA, statutory agencies or emergency services when appropriate.

Maidenbower Colts FC is committed to providing football in an environment where people are treated fairly, respectfully and with dignity. Discrimination, harassment, victimisation and abusive behaviour have no place in the Club.

The Club seeks to make reasonable adjustments and remove unnecessary barriers to participation where it can do so safely and practically. Concerns about discriminatory behaviour should be reported through the Club's welfare, complaints or disciplinary routes as appropriate.

Club-related digital communication should be professional, necessary and appropriate for the age of the people involved. Coaches and volunteers must follow current FA safeguarding guidance for communication with under-18s and should use approved Club channels.

• Do not use private or secret communication methods with youth players where this would bypass appropriate parental or Club oversight.
• Do not publish personal information, team data or images simply because they are available in the Club Portal.
• Never use Club systems for bullying, discriminatory, sexualised, threatening or abusive communication.
• Safeguarding concerns arising online must be reported through the same safeguarding routes as offline concerns.

MCFC aims to resolve concerns fairly, promptly and at the appropriate level. Routine football or administrative issues should normally be raised with the relevant team or Club officer first. Safeguarding concerns must use the safeguarding route and should not be delayed by a general complaints process.

Where a formal complaint is required, the Club should record the issue, acknowledge it, identify who will review it, manage conflicts of interest, communicate the outcome and retain an appropriate record. Matters falling under FA, County FA, league or statutory jurisdiction may be referred accordingly.