The law is the UK GDPR, which sits alongside the Data Protection Act 2018. It applies to your club because your club keeps records about people.
Your club decides who goes on the register and who plays in a box. In the law's words that makes it the controller, and the duties are yours rather than ours. We are the processor: we hold the data and do what you tell us.
None of this is hard for a club your size. It is five things.
Nearly every club that keeps members' details on a computer pays it once a year to the Information Commissioner, the regulator.
It takes ten minutes at ico.org.uk, and their self-assessment tells you if you are exempt. Check the amount there rather than here. It moves.
What you keep, why, who else sees it, and how long you keep it. A page on your club website is the usual way to say it.
There is a starter notice below you can adapt.
The register asks for a date of birth because a membership category is usually an age band, and for a child it closes doors.
Nothing medical, and not in the notes box either: everybody with a role can read it. A safeguarding concern belongs under your safeguarding policy, not here.
Members can ask to see their record, correct it, delete it, take a copy elsewhere, or object to what you do with it.
You have a month, and you cannot charge. A member's data request is how to do each one, and most of it is a button.
A breach is not only a hacker. It is a member list emailed to the wrong person, a shared admin login, or a laptop left on a train.
If personal data is lost, or seen by somebody who should not see it, you have 72 hours to tell the ICO. The clock starts when you realise, not when you finish working out what happened.
If the problem is at our end, we will tell you within 24 hours of knowing about it. That is a promise in our data processing terms, so your own 72 hours are still possible.
Not every breach has to be reported. The ICO's self-assessment walks you through it, and reporting late is worse than reporting something thin.
Who can see it
Every role you hand out lets somebody read more about your members. Check the list once a season and take the role off anybody who has left the committee.
Off to begin with
Anyone with your club's address can read your tables, ladders and draws. Search engines are told not to list them. Turn it on and everything asks people to sign in first.
On to begin with
Members can see each other's level. It is worked out from results they can all already read.
Who can see what goes through both settings properly.
A starter privacy notice
Copy it, cut anything you do not do, and put it on your website. It is a starting point, not legal advice.
[Club name] and your personal data
We keep records about our members so we can run the club. That means your name, your contact details, your date of birth, your gender, your membership category and what you have paid. It can also mean a short note or a label we add to your record. It also means the results of matches you play in club competitions, and a playing level worked out from them.
We use them to run your membership, to organise our leagues, ladders and tournaments, and to contact you about the club.
We are allowed to do this for two reasons. We need it to give you the membership you signed up for. And the club has a legitimate interest in running its own competitions.
Our league and membership software is Clayside, run by Agentu Ltd. They hold the data on our behalf and do only what we tell them with it. Their privacy policy is at clayside.app/privacy.
We do not sell your details. We do not share them with anyone else, except where the law requires it.
Results of matches you play are shown to other members, and may appear on our own website. Your level is shown to other members and never to anyone outside the club. Your contact details are never shown to other members.
We keep your record while you are a member and afterwards. That is so rejoining is straightforward, and so we can answer questions about past seasons. Ask us and we will delete it.
You can ask us what we hold about you. You can ask us to correct it, ask us to delete it, or object to what we do with it. Write to [club contact].
If you are not happy with our answer, you can complain to the Information Commissioner at ico.org.uk.
If you have junior members, add a line saying you hold a parent or guardian's details for them, and that requests come from whoever looks after the child. Our safeguarding page sets out what a junior's record here holds.
A record of what you hold
A club has to keep a short record of what it holds and why. It is for you rather than for sending anywhere, and it is what the ICO asks for if they ever ask. Most of it is already decided by using Clayside: copy it, cut what you do not do, and add anything you keep outside the software.
[Club name]: what we hold, and why
Who we are. [Club name], [address]. Questions go to [club contact]. Our ICO registration is [number].
Members. Name, contact details, date of birth, gender, membership category and what they have paid, and any note or tag we add. To run their membership. Kept while they are a member and afterwards, so rejoining is easy and we can answer questions about past years. Held in Clayside, run by Agentu Ltd.
Results. Who played whom, and the score. To run our leagues, ladders and tournaments. Kept as club history. Shown to members, and on our own website if we choose.
Levels. A playing level for each member, worked out by Clayside from their results here. To suggest fair games. Shown to members if we leave that on, and never to anyone outside the club.
People who asked to join. Name, date of birth and email address given through our club link, and a parent's name for a child. To decide whether to add them. Deleted by Clayside 90 days after we decide.
Juniors. All of the above, plus a parent or guardian's name and contact details. Kept while the child is a member.
Court bookings. Who booked which court, and when. Kept as club history.
Subscriptions and payments. What was owed, what was paid, and when. Direct Debits are collected by GoCardless into the club's own account, and we never see bank details. Kept for six years for tax.
Anything we keep outside Clayside. [Safeguarding records, committee papers, the mailing list, photos. A line each.]
Who else sees it. Agentu Ltd hold it for us and do only what we tell them. GoCardless take the payments. Nobody else.
Keeping it safe. Only committee members with a role in Clayside can see members' details. We check who has a role once a season.
Last reviewed: [date].
Review it once a season, when you check the roles.
What we hold, and what we do not
Your club's data is in a database of its own, holding nothing but your club, so no other club can reach yours.
The full picture is the privacy policy, and the version your committee can file is the data processing terms. Neither needs signing: they already apply.