Your data must be:
1. used fairly and lawfully
2. used for limited, specifically stated purposes
3. used in a way that is adequate, relevant and not excessive
4. accurate
5. kept for no longer than is absolutely necessary (3 years)
6. handled according to people’s data protection rights
7. kept safe and secure
8. not transferred outside the European Economic Area without adequate protection
This will apply to our club/association, in so much as, we collect personal data in the running our club
We only collect the minimum data required to carry out the processes we need and the data is kept as up to date as our members update or access it. Any data that is old and out of date (over 3 years) will be deleted.

Data transfer
One of the principles of the Data Protection Act 1998 (and the GDPR) relates to details of an individual held so that they can become a member of our club. We won’t use this information to allow our affiliates and sponsors to contact them for marketing purposes, unless with prior agreement. We advise people when they join our club and complete our online membership application form, that we may be required by England Hockey, County and League etc to provide data, for example to an umbrella organization or even within our club if it’s not held in a central system. We will use Pitchero communications to send out emails to our members. These will be relevant to our hockey club.

Data breaches
We will make sure (to the best of our ability) that personal data is held securely on our Marlow Hockey Club Pitchero website. We will consider restricting the storage of personal information to GDPR compliant secure systems and not keeping personal details on spreadsheets etc. We will ask that our volunteers can identify when a breach has happened and that they know what they should do and who they should talk to.
We will pay particular attention to any sensitive information such as health records. These are kept on the Pitchero site and for health and safety concerns are shared with relevant coaches and first aiders to ensure that the players are kept safe.

England Hockey systems
We have been advised that England Hockey will be working with their own systems providers so that the Player Pathway system, Hockey Hub, EHL system etc will be GDPR compliant.

Umbrella organisations
We may be sharing your information with leagues, county associations, regional associations, umpiring associations if for example we are providing details of our club officials or we may be sharing information on disciplinary forms.

ICO notifications
We have been advised that Marlow Hockey Club does not need use a data controller under the current not-for profit organisation rules.

Obligations
There will be direct obligations on data processors as well as on data controllers. This may mean that if you use any third parties to process data on your behalf, for example Pitchero who are hosting our website, we have a written contract in place which sets out each party’s GDPR obligations.

Getting consent
Consent will be much harder to achieve, as we rely on consent from individuals to use their personal data in certain ways, for example to send marketing emails.
Consent must now be explicit, positively given for each separate use and can be removed at any time. It should be expressed in simple, easy to understand terms and avoid legal jargon – see our membership online application form.

Data retention
Retention policies need to be clear. We can’t keep data for longer than is necessary for the purpose for which it was collected. Our data retention for non-current records will be 3 years unless you advise otherwise.

Breaches
We will only have 72 hours from being aware of a breach to report it to the ICO. This includes the loss of any personal data.

Children
There are additional protections for children’s personal data We collect children’s personal data for the use in playing hockey and ensuring that the players are within their correct age groups e.g. U10; U8 etc. We also use their details to organise matches and tournaments, we do not pass on this information without the permission of the parent or guardian and the child must be over 13 to register for our online membership service.

Summary

In simple terms:
1. We tell our members what we are doing with their data
2. Get their consent to use it for each purpose
3. Keep their data secure
4. Delete their data when we no longer need it.

GDPR guidance V1 May 2018