Your club decides who goes on the register and who plays in a box. That makes those records your club's, and it makes the law's duties yours rather than ours. We hold the data and do what you tell us with it.
None of this is hard for a club your size. It is four things.
1. Pay the ICO fee
Nearly every club that keeps members' details on a computer has to pay an annual data protection fee. It goes to the Information Commissioner, who is the regulator. Most clubs are on the smallest tier.
It takes ten minutes at ico.org.uk. Their self-assessment will tell you if you are one of the few clubs that is exempt.
Check the amount there rather than anywhere else, including here. It moves.
2. Tell your members what you hold
They are entitled to know four things: what you keep, why, who else sees it, and how long you keep it. A page on your club website is the usual way to say it. There is a starter one below you can adapt.
3. Only keep what you use
The register asks for a date of birth because a membership category is usually an age band. For a child it does a second job: it is what closes doors.
It does not ask for anything medical. Neither should the notes box, and it says so on the screen: one line about a person, readable by everybody your club has given a role.
Your club may need to record a medical condition or a safeguarding concern. That belongs in whatever your club already uses for it, under your safeguarding policy, and not here.
4. Answer people when they ask
A member can ask what you hold, ask you to fix it, or ask you to delete it. You have a month to answer. A member's data request is how to do each one, and most of it is a button.
Two settings that decide who can see your league
Worth deciding on purpose rather than leaving as they came.
- Members only. Off to begin with. That means your tables, ladders and draws can be read by anyone who knows your club's web address. Search engines are told to stay out and never list a club, but the address itself is not a secret. Turn it on and everything asks people to sign in first.
- Levels. On to begin with, so members can see each other's level. It is worked out from results they can all already read.
Who can see what goes through both properly.
A starter privacy notice
Copy this and put your club's name in it. Cut anything you do not do, then put it on your website. It is a starting point for a club that runs a league and a register here, not legal advice.
[Club name] and your personal data
We keep records about our members so we can run the club. That means your name, your contact details, your date of birth, your membership category and what you have paid. It also means the results of matches you play in club competitions.
We use them to run your membership, to organise our leagues, ladders and tournaments, and to contact you about the club.
We are allowed to do this for two reasons. We need it to give you the membership you signed up for. And the club has a legitimate interest in running its own competitions.
Our league and membership software is Clayside, run by Agentu Ltd. They hold the data on our behalf and do only what we tell them with it. Their privacy policy is at clayside.app/privacy.
We do not sell your details. We do not share them with anyone else, except where the law requires it.
Results of matches you play are shown to other members, and may appear on our own website. Your contact details are never shown to other members.
We keep your record while you are a member and afterwards. That is so rejoining is straightforward, and so we can answer questions about past seasons. Ask us and we will delete it.
You can ask us what we hold about you. You can ask us to correct it, ask us to delete it, or object to what we do with it. Write to [club contact].
If you are not happy with our answer, you can complain to the Information Commissioner at ico.org.uk.
Add a line if your club has junior members. Say that you hold a parent or guardian's details for them, and that requests come from whoever looks after the child.
What we hold, and what we do not
Your club's data is in a database of its own, holding nothing but your club. It is not a shared table with everybody else's members in it. That is why no other club can reach yours.
The full picture is the privacy policy. The clause-by-clause version your committee can file is the data processing terms. You do not have to sign either, because they already apply.