Data Protection Policy

1. Introduction

South London Topcats – Brixton Topcats Basketball Club is committed to protecting the personal data of all its members, volunteers, coaches, and contacts. This policy sets out how the Club collects, uses, stores, and protects personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Following the UK's departure from the European Union, the EU GDPR was retained and adapted into UK law as the UK GDPR, which came into effect on 1 January 2021. The Data Protection Act 2018 supplements the UK GDPR. This policy reflects these current legislative requirements.

The Club acts as a Data Controller in respect of personal data it holds. The Club is not required to register with the Information Commissioner's Office (ICO) unless it processes data in ways that trigger a registration requirement. The Club will keep this under review.

2. Data Protection Principles

The Club must ensure that all personal data is:

• Processed lawfully, fairly, and in a transparent manner
• Collected for specified, explicit, and legitimate purposes and not further processed in a way incompatible with those purposes
• Adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed (data minimisation)
• Accurate and, where necessary, kept up to date
• Kept in a form which permits identification of individuals for no longer than is necessary (storage limitation)
• Processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and accidental loss, destruction, or damage

3. Lawful Basis for Processing

The Club will identify and document a lawful basis for each type of personal data processing. The lawful bases the Club may rely on include:

• Consent: where the individual has given clear consent for the Club to process their data for a specific purpose (e.g., photography consent)
• Contract: where processing is necessary to perform a contract with the individual (e.g., membership agreement)
• Legal obligation: where processing is required to comply with law (e.g., DBS check records)
• Legitimate interests: where processing is necessary for the Club's legitimate interests, provided these are not overridden by the individual's rights

4. Special Categories of Data

Some personal data requires extra protection. "Special category" data includes information about health, disability, ethnicity, religion, or sexual orientation. The Club will only process special category data where strictly necessary (e.g., medical information for junior safeguarding purposes) and with a clear lawful basis and additional safeguard.

5. Data we Collect

The Club may collect and process the following categories of personal data:

• Name, date of birth, contact details (address, email, telephone)
• Emergency contact details
• Medical or health information relevant to participation (with consent)
• Photographs or video footage (with appropriate consent)
• DBS check references (for relevant volunteers and staff)
• Payment information (for membership or session fees)
• Basketball England registration numbers

6. Data Retention

The Club will not retain personal data for longer than necessary. General retention guidelines are:

• Active member records: retained while membership is active and for one year after lapse
• Junior member records: retained until the individual is 25, or for three years after their last participation, whichever is longer (for safeguarding purposes)
• DBS records: retained for the period required by Basketball England and the DBS Code of Practice
• Financial records: retained for six years in accordance with HMRC requirements
• Accident and incident records: retained for a minimum of three years (or until the individual is 21 if a minor at the time)

7. Individual Rights

Under UK GDPR, individuals have the following rights in respect of their personal data:

• Right of access: to request a copy of data held about them (Subject Access Request)
• Right to rectification: to request correction of inaccurate data
• Right to erasure: to request deletion of data in certain circumstances
• Right to restrict processing: to request a limit on how their data is used
• Right to data portability: to request data in a commonly used format
• Right to object: to object to processing based on legitimate interests
• Rights in relation to automated decision-making

Requests should be submitted in writing to the Club Chair or Secretary and will be responded to within one calendar month.

8. Data Security

The Club will implement appropriate technical and organisational security measures to protect personal data against unauthorised access, loss, or disclosure. This includes:

• Restricting access to personal data to those who need it for legitimate Club purposes
• Using password-protected electronic systems for storing digital data
• Storing physical records securely
• Disposing of personal data securely when no longer needed
• Reporting any data breach to the ICO within 72 hours where required

9. Third Party Sharing

The Club may share personal data with third parties only where necessary and lawful, including:

• Basketball England (for registration and safeguarding purposes)
• DBS (for background check applications)
• Venue operators (where required for health and safety)
• ICO (if legally required)

The Club will not sell or share personal data for commercial marketing purposes.

10. Photography and Media Consent

The Club will obtain separate written consent before photographing or filming junior members. Adult members should also be informed of any photography taking place at Club events. Consent may be withdrawn at any time. Photographs or videos of children will not be shared on social media without specific parental consent.

11. Responsibility

The Club CEO/Chair has overall responsibility for data protection compliance. All Club volunteers and committee members who handle personal data must comply with this policy. Breaches will be taken seriously and may result in disciplinary action.

12. Complaints

If you have a concern about how the Club is handling your personal data, please contact the Club CEO or Chair in the first instance. You also have the right to make a complaint to the Information Commissioner's Office (ICO) at www.ico.org.uk or call 0303 123 1113.

13. Review

This policy will be reviewed annually, or earlier where required by changes in legislation or Club practice.

See also the club's Privacy Policy, which explains how personal data is handled for members and website visitors.