Introduction
Welcome to Swansea City AFC Foundation’s privacy policy. Swansea City AFC Foundation respects your privacy and is committed to protecting your personal data. This privacy policy will inform you as to how we look after your personal data when you, or your dependant, participate in one of our programmes and tell you about your privacy rights and how the law protects you.
1. Important information and who we are
Purpose of this policy
This privacy policy aims to give you information on how Swansea City AFC Foundation collects and processes your personal data.
Controller
Swansea City AFC Foundation is the controller and is responsible for your personal data (collectively referred to as “we”, “us” or “our” in this privacy policy).
Contact details
If you have any questions about this privacy policy or our privacy practices, or would like to exercise your legal rights, please contact us in the following ways:
Email address: data@swansfoundation.org.uk
Postal address: Swansea City AFC Foundation, Swansea.com Stadium, Plasmarl, Swansea, SA1 2FA.
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.
Changes to the privacy policy and your duty to inform us of changes
We keep our privacy policy under regular review. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
2. The data we collect about you
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We may collect, use, store and transfer different kinds of personal data about you depending upon the nature of our interaction with you. We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity.
Some of the personal data we collect from you includes – name, contact details, address, date of birth, gender, ethnicity, information about disabilities or medical conditions, photo / marketing consent, payment details.
If you fail to provide personal data
Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you but we will notify you at the time if that is the case.
3. How is your personal data collected?
We use different methods to collect data from and about you including through:
- Direct interactions. You may give us your personal data by filling in forms or by corresponding with us by post, phone, email or otherwise.
- Third parties or publicly available sources. We will receive personal data about you from various third parties [and public sources].
4. How we use your personal data, and our legal basis
Swansea City AFC Foundation collects our participants’ and donors’ details because it is necessary for:
- Completing a contract which you may have entered into
- The pursuit of our legitimate interests
- To comply with our legal obligations
- To protect your vital interests
We may also seek your consent for certain processing. You have the right to withdraw your consent at any time.
Completing a contract
When you purchase a service or product from us we are both entered into a legally binding contract. You may have entered into this by purchasing a football place from our website, registering for an education or health programme we provide or signing up for a fundraising event we in which we are taking part.
Legitimate interest
We process your data under the ground of legitimate interest, this includes:
- For the completion of our charitable aims and objectives.
- Monitor participants progress and be able to report back to our funders on the progress of our projects
- Sending communications which are linked to a previous service you have been provided, or carrying out digital or postal marketing.
- Providing products or services you have requested (and where this does not involve a contract with you).
- Monitoring use of our websites and online services, and using information we receive about our offline activities to help us analyse, monitor, improve and protect our products, content, services and websites, both online and offline.
- Investigating any complaints received from you or from others about our products or services.
- Protecting our participants safety, health and welfare.
- Carrying out project evaluations (e.g. questionnaires, surveys, feedback forms).
- Processing in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of data in connection with legal process or litigation).
To comply with legal obligations
We process your data where we are required to hold or collect personal data to meet legal requirements on us, such as keeping health and safety records, details of purchases or meeting safeguarding requirements. We also may process your data where in response to requests by government or law enforcement authorities conducting an investigation.
Vital interests
Exceptionally, we may process sensitive data for the purposes of protecting your vital interests. This will occur when we need to collect or use sensitive data in a way to which you have not consented, and we cannot seek your consent.
Withdrawing consent
You can ask withdraw any consent at any time by emailing data@swansfoundation.org.uk.
Change of purpose
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
5. Who might we share your data with
We may share your personal data with third parties. We do not allow our third party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law.
6. Data security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
7. Data retention
How long will you use my personal data for?
We will retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
8. Your legal rights
Under data protection legislation you have a range of rights. You have a right to ask us for a copy of the information we hold about you. You can also ask us to correct or update your personal data, or to erase it or transfer it to a third party. You can object to processing of your personal information by us, including to object to any direct marketing. Where we are using your information based on your consent you can withdraw your consent.
The way some of your rights apply may depend on the circumstances. To exercise your rights please contact us.
More about your rights
Right of access - You have a right to access the personal information we hold about you and be told why we use it.
Right of rectification - You can ask us to correct or update your information to ensure it is accurate and complete.
Right to erasure and right to restrict processing - You can ask us to stop processing and to delete your data in certain circumstances (for example where it is processed with your consent, or it is no longer necessary for us to process it).
Right to object - You have a right to object to our processing of your information.
Rights: profiling and automated decisions - You have a right not to be subject to automated decisions which have a legal effect and to be protected by safeguards in respect of any profiling.
Right to object to direct marketing - Where you have consented to receive direct marketing you can change your mind at any time as described in the marketing section above. Please allow a few days for us to action your request.
You can find out more or exercise the above rights by contacting us. Further information is also available from the ICO's website (www.ico.org.uk).
Making a request
To make a request, please contact us via data@swansfoundation.org.uk.