Barnsley FC Community Trust

Reds in the Community Privacy Notice

You will be required to provide personal data, and this is a requirement so we can provide the services that we offer you. We will be unable to register or deliver services to you unless we hold the appropriate data.

What is the purpose of this document?

Reds in the Community is committed to complying with the UK’s Data Protection Law and the EU General Data Protection Regulation (GDPR) for the protection of personal data, as well as the principles of data security in the configuration of our services.  To ensure we remain compliant with this regulation, we must let you know the following information:

This notice describes how Reds in the Community obtains, stores and shares your personal data in accordance with the General Data Protection Regulation (GDPR).

Reds in the Community is a “data controller”. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice. . We can be contacted at our registered office address Reds in the Community, Oakwell Stadium, Grove St, Barnsley S71 1ET

It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information

This Privacy Notice includes 8 sections:

• Section 1 – Data Protection Principles
• Section 2 – Rights of access, correction, erasure, and restriction
• Section 3 – Links to other Websites
• Section 4 – Inclusion and Participation
• Section 5 – Health
• Section 6 – Learners
• Section 7 – Photography and Video
•  Section 8- Complaints Procedure

Section 1- Data Protection Principles

Reds in the Community values an individual right to privacy and actively seeks to protect their data.

We will comply with data protection law. This says that the personal information we hold about you must be:

1. Used lawfully, fairly and in a transparent way.
2. Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes. If at any time, we intend to further process your personal data for a reason not originally communicated, we shall provide you, prior to that processing taking place, all relevant information on the additional processing.
3. Relevant to the purposes we have told you about and limited only to those purposes.
4. Accurate and kept up to date.
5. Kept only as long as necessary for the purposes we have told you about.
6. Kept securely

Section 2 – Rights of access, correction, erasure, and restriction

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.

Your right of access

• You can request copies of your personal information that Reds in the Community holds about you and this right always applies. You can do this verbally or in writing. This is called a Subject Access Request (SAR), In doing this you can see what personal information we hold about you, how we use your personal information, who we share it with and where we got your data from. This will be provided in a structured, commonly used, and machine- readable format (where technically feasible). There will be no charge for this service. If, however, you log multiple requests, then there may be nominal charge, which we will request to cover the administration of these requests.

Your right to rectification

• You have the right to ask us to rectify information you think is inaccurate in writing or verbally. You can challenge the accuracy of personal data held about you by Reds in the Community and ask for it to be corrected or deleted. This is known as the ‘right to rectification’. If your data is incomplete, you can ask for us to complete it by adding more details

Your right to erasure

• You have the right to ‘block’ or request the deletion or removal of personal data to prevent further processing in writing or verbally. This right to erasure is also known as ‘the right to be forgotten.’ Specific circumstances in which you can request the deletion or removal of personal data include:

1. Where the personal data is no longer necessary for the purposes for which it is collected or otherwise processed;
2. Where you withdraw consent;
3. When you object to the processing and there is no overriding legitimate interest for continuing the processing;
4. Where the personal data was unlawfully processed (i.e. otherwise in breach of the GDPR);
5. Where the personal data has to be erased in order to comply with a legal obligation; and
6. In case a deletion is not possible due to legal, statutory or contractual retention periods, or if it requires disproportionate efforts or prejudices your legitimate interests, the data will be blocked instead of deleted.

Your right to restriction of processing

You have the right to ask us to restrict the processing of your information in certain circumstances, and you can do this verbally or in writing. You can limit the way Reds in the Community uses your personal data, if you are concerned about the accuracy of the data or how it is being used. If necessary, you can also stop us from deleting your data. Together, these opportunities are known as your ‘right to restriction’.

Your right to object to processing

You have the right to object to our Company’s processing of your personal data, under certain conditions.

1. For a task carried out in the public interest;
2. For the exercise of official authority;
3. For their legitimate interests;
4. For scientific or historical research, or statistical purposes; and
5. For direct marketing purposes.

Your right to data portability

This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated

If we are processing your information for criminal law enforcement purposes, your rights are slightly different.

This right is similar to your right of access but there are some differences. Specifically, the right only applies to data that:

1. Is held electronically, and
2. You have provided to the organisation.

 If you wish to exercise any of the rights set out above please contact  Paul France CEO on 01226 211333 or email our Compliance Officer

The vast majority of your personal data will never leave the European Economic Union. However, our NCS subscribers may have their data stored in our Google Suite, which as a result will mean your information may be transferred to a third country. We can confirm the existence of a relevant adequacy agreement is in place with Google Inc. Google’s certification under the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks includes G Suite and Google Cloud Platform. Google have also gained confirmation of compliance from European Data Protection Authorities for their model contract clauses, affirming that their current contractual commitments for G Suite and Google Cloud Platform fully meet the requirements under the Data Protection Directive to legally frame transfers of personal data from the EU to the rest of the world. These can be reviewed at the Google website.

We have a Data Protection Policy you are welcome to view!

Section 3 – Links to other websites

Our website may, from time to time, contain links to and from the websites of our partner networks, advertisers, and affiliates.  If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to this website.

Section 4 – Inclusion and Participation

When participating in activities provided by Reds in the Community, it is understood that the trust cannot be liable for any loss, damage or injury that the applicant may sustain whilst attending our activities. In the event of injury to yourself or your child/young person, I allow consent to emergency treatment by a qualified first aider and give my permission for them or myself to be taken to a hospital if necessary. It is also understood that it is my /parent/guardian’s responsibility to inform Reds in the Community of any medical conditions ,any exceptions to why you, your child or young person should not receive medical treatment, any dietary requirements that could affect yours or your child’s/young person’s participation in any activity.

From time to time, Barnsley FC players will visit the children and provide opportunities to gain signatures and other memorabilia. Barnsley FC and/or Reds in the Community will not be liable for any other items that the child wishes to have signed other than materials that are provided.

When dropping off children/young person at our activities, it is understood that the chid/ young person is under the responsibility of Reds in the Community between the hours of which the courses take place.

• Where parents or adults provide their own data, to enable us to provide services to you or your child/young person. The purpose for processing your personal information is to allow us to administer your account with us and to provide the products and services you have requested from us. In order to enter into an agreement with Reds in the Community, we will collect, store and use elements of your personal data. The lawful basis for processing of this personal data is known as contractual basis and is necessary by Reds in the Community in order to administer your account and to provide the products and services you have requested from us.

When engaging with Reds in the Community, you will usually need to disclose the following:

• Title;
• First name(s), surname or company name (including representation as the case may be);
• Address (street, street number, postal code, city and country/region);
• Email address;
• Telephone and mobile number; and
• Bank details (account number, account holder and card number).

We may also monitor, record, store and use any telephone call, email or other electronic communications with you for training purposes so that we can check any instructions given to us and to improve the quality of our customer service.

• Where parents provide us their child’s (anyone under 13) information, or for a child they hold parental responsibility for, to enable us to provide services to their children/young person. The purpose for processing your child’s/young person’s personal information is to allow us to provide the products and services you have requested from us, to them. In order to enter into an agreement with Reds in the Community, we will collect, store and use elements of your child’s personal data. The lawful basis for processing of this personal data is known as explicit consent and will be required from the parent or person with parental responsibility and is necessary by Reds in the Community in order for us to provide the required service to your child/young person.

When engaging Reds in the Community you will usually need to disclose the following information for your child:

• First name(s) surname;
• Address (street, street number, postal code, city and country/region);
• Emergency contact details;
• Previous and existing medical conditions;
• Dietary requirements;
• Sex and ethnicity;
• Date of birth; and
• Details of education.

• Where anyone over the age of 13 provides us with their information to enable us to provide services to them. The purpose for processing their personal information is to allow us to provide the products and services you have requested from us. In order to enter into an agreement with Reds in the Community, we will collect, store and use elements of your personal data. The lawful basis for processing of this personal data is known as explicit consent and is necessary by Reds in the Community in order for us to provide the required service to you.

When engaging with Reds in the Community, you will usually need to disclose the following information:

• Title;
• First name(s), surname or company name (including representation as the case may be);
• Address (street, street number, postal code, city and country/region);
• Email address;
• Telephone and mobile number;
• Emergency contacts;
• Bank details (account number, account holder and card number;
• Previous and existing medical conditions;
• Dietary requirements;
• Sex and ethnicity;
• Date of birth; and
• Details of education.

We will also process your details through our internal systems to enable us to send you relevant communications. The lawful basis for processing this information internally will be Legitimate Interests. Any email or text communications we send will however comply with the Privacy and E-Communications Regulation (PECR.) If you have chosen to opt-in to our direct marketing communications, we will use your information to tell you about products and services available from us which may be of interest to you. We may also use your information to tell you about products and services from our approved partners. You have a right to opt-out of our direct marketing communications at any time. You can opt-out by following the unsubscribe instructions at the bottom of the communication or by emailing our Compliance Officer

We may send or share your personal information to the following recipients:

• Customer Service Relations (CRM) software;
• Mobile phone SMS text provider;
• Card payment providers;
• The English Football League;
• The Premier League Charitable Fund;
• RIDDOR; or
• Barnsley Metropolitan Borough Council (BMBC)

Or:

• Other parties where you have given us your consent to do so;
• If it is necessary for the performance of an agreement of which you will be made aware;
• In order to obtain professional advice (e.g. legal advice);
• We or others need to investigate or prevent crime (e.g. to fraud prevention agencies);
• The law permits or requires it;
• Regulatory or governmental body requests or requires it, even without your consent; and
• There is a duty to the public to reveal the information.

Section 5 – Health

Our health programmes will often require the disclosure of further personal information in addition to that which is listed in the sections above:

• Medical data, including height and weight measurements; and
• GP name, address & contact number.

Section 6 – Learners

Enquiries/Applications

When you enquire or apply for a course, we will collect the following information:

• Details about you including name, date of birth, and gender
• Contact details including address, telephone number and email;
• Details of previous qualifications and education;
• Information about your nationality, residency and previous address;
• Information about medical or health conditions, including a learning difficulty or disability; and
• Character /work references.

If you do not enrol on a course with us, your details will be removed after 12 months, to ensure we have adequate information to deal with complaints and enquiries. This will also allow us to advise you of any new provision you may be interested in.

Enrolment

At enrolment we will collect the following additional information. In some cases, we will collect application and enrolment data at the same time:

• Start and end dates of any course you are following;
• Information about medical or health conditions, including a learning difficulty or disability;
• Emergency Contacts.

Most of the information collected at application or enrolment is required by us to deliver your course and evidence you are studying with us. We use this information to create an Individual Learning Record (ILR) and create or update a Personal Learning Record (PLR). We are required to do this by our funding body Barnsley College. We share information with the Barnsley College and Barnsley Metropolitan Borough Council and other local authorities.

During your course

We will record information about attendance, progress and achievement together with any work experience and placements you have undertaken. We will also require emergency contacts and Information about medical or health conditions when undertaking any external visits or trips.

During your stay in college your data will be shared with other members of staff. We will use your personal data to help you with any issues arising from your programme of study.

Where we use external agencies to process data on our behalf, we require them to use a written agreement which guarantees confidentiality.

A list of these organisations and the reasons we share data can be requested from us.

We will keep your course attendance and other reference information for 5 years following your course completion and upon leaving us.

Section 7 – Photography and Video

A child is defined as a person under the age of 18 (The Children Act 1989). We want to provide event participants/parents/guardians with quality images of their sporting achievements. This often means photographing minors. We cover events with the permission of the event organiser and that of the parent or guardian on all our application forms (please note that if you leave this section blank, we will assume permission is granted).

At times, Reds in the Community may wish to take photos or videos of the team or individuals in it. We adhere to The FA and Premier League guidelines to ensure that these are safe and respectful and used solely for the purposes for which they are intended, which is promotion and celebration of the activities of Reds in the Community. Any photographs and videos including participants will be stored for a maximum of two years.

Any participant or parent/guardian of a participant can request at any time for their permission to be revoked and this will be actioned with immediate effect.

• Websites – www.barnsleyfccommunity.co.uk
• Twitter – @bfccommunity
• Instagram – @redsinthecommunity
• Facebook – facebook.com/redsinthecommunity

Content may be shared beyond these channels with other associated partners.

If you have any questions about this Privacy Notice or how we use your personal data, please contact Paul France CEO on 01226 211333 or email our Compliance Officer

Section 8 – Complaints Procedure

If you have a complaint about any aspect of data protection or if you feel your privacy has been breached by us, we would like to hear from you. To help us investigate and resolve your concerns as quickly as possible, please contact  Paul France CEO on 01226 211333 or emailing our Compliance Officer

If you are unhappy with the final response you have received from Reds in the Community, you have the right to complain to the supervisory authority, the Information Commissioner’s Office (ICO). You can contact the ICO on 0303 123 1113 or by visiting their website: https://ico.org.uk/.