1.  Introduction
Enfield Sport is a voluntary partnership, who's Members are sports clubs and various other organisations with an interest in sport, located in the London Borough of Enfield. Enfield Sport is not an incorporated body and is not regulated by a third party.

Members of Enfield Sport ("Members") are deemed to be those clubs and organisations who have completed (and signed) the relevant membership forms and have paid their annual membership fees.

Enfield Sport is deemed to be a data “controller” under the General Data Protection Regulation and the Data Protection Act 2018. The Executive Committee will be responsible for undertaking the "Data Protection Officer" role, albeit they have the power to delegate that responsibility to a specific individual, if they so wish.

Enfield Sport will ensure that an up to date version of the Policy will be available on the Enfield Sport web site and hard copies will be made available to any person who makes such a request.

2.  The personal data collected, stored and processed by Enfield Sport
Data will only be collected and stored by Enfield Sport for legitimate reasons, which are required to ensure the processes and communications agreed by Enfield Sport and its Members.

The following personal data will be collected and stored by Enfield Sport:
(i) personal data which is directly relevant to the management and marketing of Enfield Sport and its activities;
(ii) personal data of individuals who represent or act on behlaf of the Members (see section 3 below);
(iii) personal data that is directly relevant to the supply of goods and services to Enfield Sport;
(iv) personal data that is directly relevant to the deployment of volunteers;
(v) personal data that is relevant to the effective governance of Enfield Sport, including Executive Committee members personal details.

The personal data that will be collected includes:
(i) Personal details of individuals representing or acting on behalf of Members, including name, address, phone numbers and email addresses;;
(ii) Personal details of principal contacts of organisations that Enfield Sport is in contact with, including name, address, phone numbers and email addresses;
(iii) Financial details, such as bank account details;

Enfield Sport will ensure, as far as it reasonably can, that all personal data is accurate and up to date. Enfield Sport will not accept responsibility if a third party provides it with inaccurate personal data; but will rectify any mistakes immediately if such mistakes are brought to Enfield Sport's attention.

If personal data provided to Enfield Sport is, or appears to be incorrect, the relevant person will be contacted to check the relevant details.

3. The personal data relating to individuals authorised to act on behalf of the Members of Enfield Sport that is collected, stored and processed by Enfield Sport
The following Members' personal data will be collected and stored by Enfield Sport:
(i) personal contact details that will allow Enfield Sport to make direct contact with individuals representing or acting on behalf of Members, including phone numbers and email addresses;
(ii) next of kin and emergency contact details for key individuals, where relevant;
(iii) any letters of application, references, CVs, cover letters and other information relating to the application process to become a Member;
(iv) membership start and end dates;
(v) records of Members' communications and interactions with Enfield Sport, including emails, letters, formal complaints, phone conversations and attendance at events / meetings;
(vi) credit, debit and other payment details that Members provide to make payments to Enfield Sport, as well as details of any other financial transaction between Enfield Sport and Members;
(vii) records of Members use of the web site, on-line portals, passwords, personal identification numbers, IP addresses, user names and other IT system identifying information.

In addition Enfield Sport may ask Members to provide socio demographic information relating to age, gender, ethnicity and/or disability, to ensure that Enfield Sport can better understand how to market its activities within the London Borough of Enfield.

Enfield Sport will not include the personal details of individuals representing or acting on behalf of Members' in any publication that could be accessed by the general public.  

4.  Enfield Sport's basis for collecting, storing and processing Data
The basis upon which Enfield Sport collects, stores and processes personal data will relate to one or more of the following:
(i) it is in Enfield Sport's legitimate interests to do so;
(ii) it is necessary so that Enfield Sport can comply with a legal obligation;
(iii) it is necessary to ensure that Members are kept fully informed about Enfield Sport's activities and so that they can fully benefit from everything that Enfield Sport has to offer;
(iv) it has been set out in a contract and/or a formal agreement with a third party;
(v) external consent has been given.

5.  How Enfirld Sport will use personal data
Enfield Sport will use personal data for the following purposes:
(i) to effectively manage and market Enfield Sport, for the benefit of the Members and potential members;
(ii) to receive goods and services;
(iii) to ensure the effective deployment of volunteers;
(iv) to ensure effective two way communications with all partners and other third parties;
(v) to ensure compliance with auditing requirements..

6.  Who Enfield Sport will share personal data with
Enfield Sport will only share personal data with external parties in the following circumstances:
(i) if Enfield Sport has to recover income or debts, personal data may be shared with solicitors and any agency that Enfield Sport might use to recover the income / debt;
(ii) if accountants or auditors require access to personal data to comply with their statutory duties;
(iii) if Enfield Sport is required to respond to any legal claims by external bodies then personal data may be shared with an external party acting on behalf of Enfield Sport.

Enfield Sport will not share personal data with third parties for the purposes of advertising or marketing  goods, products or services.

Although Enfield Sport will not be "sharing" data with IT companies, such companies will have the ability to access to personal data when updating and /or installing software and/or hardware. Enfield Sport shall ensure that such IT companies treat personal data as being private and confidential information that cannot be accessed by such companies for any purpose other than where it is legitimate and essential to do so to carry out the work they have been employed to do. 

7.  External marketing
Enfield Sport will only send out marketing material, including advertising, publicity and promotional material, to generic contact addresses (including email addresses) of third parties and external organisations that do not include the personal details of an individual within the organisation that the material is being sent to.

Enfield Sport will send marketing material to contact addresses that are publically advertised on third party and external organisations web sites (or in other ways), even where the contact address (including email address) might include reference to a persons name. This is on the basis that the indivuduals concerned will have given their permission to have the contact address (including email address) included on the relevant web sites, so that they can be legitimately contacted by third parties or external organisations.

Enfield Sport will not send marketing material, including advertising, publicity and promotional material, to individuals who are not representing or acting on behalf of the Members, unless the individual concerned has given their prior written consent to receiving such material.        

8.  How long will Enfield Sport keep personal data for

Personal data, personal information and records will be kept by Enfield Sport for a period of 6 years after the end of the Member's membership, or after the last contact made by the Member; except for:
(i) unsuccessful membership applications, where personal data, information and records relating to individuals acting on behalf of the Members will be held for 12 months;
(ii) incidences of personal injury or discrimination, which may be subject to a claim or other form of legal action, where personal data, information and records will be held for a period deemed to be appropriate in the sole view of Enfield Sport. 

Personal data relating to external organisations and individuals acting on behalf of or representing the Members will be kept for a period of up to 6 years.

9.  Security arrangements
Enfield Sport will ensure that all personal data which a person gives to them is kept secure at all times, using all appropriate technical and organisational measures.

In the unlikely event of a personal data breach, Enfield Sport will minimise the effects of the breach as far as it reasonably can. Enfield Sport will inform the affected person (s) as soon as possible and where there has been a security breach, will report that breach to the Information Commissioner's Office within 72 hours.

10.  Rights under the General Data Protection Regulation (GDPR)
Any person has the right to:
(i) to know what personal data is held about them by Enfield Sport;
(ii) to see that personal data (right of access to the data);
(iii) to have any errors or omissions in the personal data rectified;
(iv) to have personal data erased from Enfield Sport's records;
(v) to restrict what Enfield Sport can use personal data for;
(vi) to object to Enfield Sport processing their personal data.

(NB. The above are the rights that Enfield Sport believe are most relevant to its use of personal data; but the GDPR provides people with other rights that are not listed. Enfield Sport will ensure that those other rights are complied with if any person wishes to exercise any of them).

11.  The right (of access) to see what personal data Enfield Sport holds
As set out in point 10 above, any person has the right to see personal data held by Enfield Sport. .

Should an individual wish to see personal information held by Enfield Sport they will be required to submit a written request, together with proof of identity. Enfield Sport will deal with the request free of charge and within 28 days; unless the request is complex, in which case Enfield Sport may extend the period of time for dealing with the request to 90 days.

Enfield Sport will not respond to a written request if proof of identity has not been provided or the request is deemed to be solely vexatious.

12.  The right to rectification if the personal data is inaccurate or incomplete
As set out in point 10 above, any person has the right to correct personal data if they believe it to inaccurate or incomplete (the right to rectification).

Should an individual wish to correct personal data held by Enfield Sport they will be required to submit a written request, together with proof of identity. Enfield Sport will deal with the request free of charge and within 28 days; unless the request is very complex, in which case Enfield Sport may extend the period of time for dealing with the request to 90 days.

Enfield Sport will not respond to a written request if proof of identity has not been provided or the request is deemed to be solely vexatious.

13.  The right to have personal data erased
As set out in point 10 above, any person has the right to erase their personal data (also known as the right to "be forgotten"); albeit that particular circumstances need to apply, as set out in  Article 17 of the GDPR, before that can happen.

Should an individual wish to have their personal data erased from Enfield Sport's records they will be required to submit a written request, together with proof of identity. Enfield Sport will deal with the request free of charge and within 28 days; unless the request is very complex, in which case Enfield Sport may extend the period of time for dealing with the request to 90 days.

Enfield Sport will consider Article 17 of the GDPR prior to determining whether the personal data that is held can be erased.

Enfield Sport will not respond to a written request if proof of identity has not been provided or the request is deemed to be solely vexatious.

14. Changes to this Policy
Enfield Sport may amend this Policy from time to time, by the Executive Committee.

Where the Policy has been amended a new date will be recorded at the top of the Policy and the amended Policy will be made available on Enfield Sport's  web site.

Where required by law, Enfield Sport will advise and where necessary seek consent from any persons affected by changes to the Policy, where it has a direct impact on them.    

15.  Further Information and Complaints.
If anyone wants to receive further information about GDPR and /or this Policy, they should contact Enfield Sport, either by phone or in writing.

If anyone wishes to submit a complaint, they should write to Enfield Sport setting out the basis of their complaint and what action they believe Enfield Sport should be taking to address and /or rectify that complaint. Enfield Sport  will provide a written response to the complaint within 28 days unless the request is very complex, in which case Enfield Sport may extend the period of time for dealing with the request to 90 days.

If anyone is unhappy with the response to their complaint they will be advised to contact the Information Commissioner's Office. Their contact details are available on the Information Commissioners web site.