- We use secure systems (Pitchero membership platform) with encrypted storage
- Access is restricted to authorised staff and volunteers
- Devices used to access club data are password-protected
- We do not share data unnecessarily with external parties
- We comply with UK GDPR and Data Protection Act 2018

**However:** No system is completely secure. We cannot guarantee absolute security, but we take appropriate measures proportionate to the sensitivity of the data.

---

## Data retention schedule

| Data type | Retention period | Reason |
|-----------|-----------------|--------|
| **Active members** | During membership | Operational necessity (fixtures, comms, payments) |
| **Former members** | 3 years after leaving | Safeguarding, legal obligations, dispute resolution |
| **Minors' records** | Until age 18, then 3 years more | Safeguarding (extended protection for children) |
| **Player injury/medical notes** | 3 years after last entry | Safeguarding + liability |
| **Financial records** (invoices, payments) | 6 years | Tax/legal requirement |
| **Sponsorship enquiries** (no agreement reached) | 1 year | Business reference only |
| **Sponsorship records** (signed agreements) | 3 years after end of term | Contract + renewal tracking |
| **Safeguarding incident records** | Indefinitely | Safeguarding legal obligation |
| **CCTV footage** (if applicable) | 30 days | Security + legal requirement |

---

## Data deletion

Once a retention period ends:
- Data is deleted from our active systems
- No notification is given (deletion is automatic under policy)
- If a member requests deletion earlier, we will comply unless a legal obligation requires retention

**Exception:** Data may be kept longer if required by law, court order, or an ongoing safeguarding concern.

---

## Data breach

If we suffer a data breach (unauthorised access, loss, or disclosure of personal data), we will:
- Investigate immediately
- Notify affected members within 72 hours if there is risk of harm
- Report to the Information Commissioner's Office (ICO) if legally required
- Take steps to prevent further breaches

---

## Your rights

Under UK GDPR, you have the right to:
- **Know what data we hold** — request a copy anytime
- **Correct wrong data** — ask us to fix errors
- **Request deletion** — ask us to delete your data (subject to retention obligations above)
- **Restrict processing** — ask us not to use your data for certain purposes (e.g., sponsorship prospecting — see Privacy Notice)
- **Data portability** — request your data in a portable format

To exercise these rights, contact: vice-chairman@oakwoodfc.co.uk

---

## Data Protection Officer contact

For data protection queries:

**Neill Wilkinson**
Vice Chairman (Operations), Oakwood FC
Email: vice-chairman@oakwoodfc.co.uk

Or contact the **Information Commissioner's Office (ICO)**:
**Website:** ico.org.uk
**Phone:** 0303 123 1113

---

## Policy review

This policy is reviewed annually. Changes will be posted on this page.