Privacy Policy

1. Who we are

White Rose All Stars JFC is the controller of the personal information described in this notice. This means the club decides why and how it is used.

Privacy enquiries can be sent to info@whiterosejfc.co.uk. Please put “Data protection” in the subject line.

2. Information we collect

Depending on how you use the website, we may collect:

• Player information: name, date of birth, gender, address, postcode, previous club, chosen team, emergency contact details and a registration photograph.
• Health and welfare information: medical conditions, allergies, additional needs or other details a parent or guardian provides so the club can support a player safely.
• Parent and guardian information: name, relationship to the player, postal address, email address and telephone number.
• Registration and membership information: application answers, consents, registration status, team allocation, membership status and payment records.
• Party and event information: the child's name, parent or guardian's name and contact details, booking notes, payment status and attendance.
• Enquiries: the name, contact details, subject and message submitted through our contact form.
• Club administrator information: name, email address, account details, role and security records needed to control access.
• Technical information: security, session and limited device or request information created when the website is used.

Please do not include information in a free-text box unless it is relevant to the registration, booking or enquiry.

3. How and why we use information

We use personal information to:

• process applications, organise teams and administer membership;
• communicate with parents, guardians, players and event customers;
• support player safety, safeguarding, welfare and emergency response;
• collect fees, reconcile payments and maintain financial records;
• manage parties, events and attendance registers;
• answer enquiries, administer the website and protect club systems; and
• publish club photographs where the club has an appropriate legal basis and any required permission.

Under UK data protection law, we normally rely on performance of a contract or steps requested before a contract, the club's legitimate interests in running a safe football club, compliance with legal obligations, and consent where appropriate. In an emergency, information may be used to protect someone's vital interests.

Health information receives extra protection. We use it only where necessary for health, welfare, safeguarding or emergency purposes and where a valid condition under data protection law applies.

We do not sell personal information and we do not use it for automated decision-making or profiling.

4. Children's information and photographs

Much of the information we handle relates to children. A parent or guardian should complete the registration and must have authority to provide the child's information.

The required registration photograph is used for player and league administration and is kept private. Permission to use other photographs on club channels is optional and separate from registration. Refusing or withdrawing publicity permission does not affect a child's place at the club.

To withdraw photo permission or ask for an image to be removed, email the club. Removal from channels controlled by the club will be arranged as soon as reasonably possible, although the club may not be able to recall material already lawfully printed or shared by others.

A child may have their own data protection rights where they have sufficient understanding. The club will consider the child's age, maturity and best interests when handling a request.

5. Who we share information with

Access inside the club is limited to authorised officers and administrators who need the information for their duties. Relevant player details may also be shared with coaches, welfare officers, first aiders, leagues, county football bodies, competition organisers, insurers or professional advisers where necessary.

We use carefully selected service providers:

• Supabase provides the database, account authentication and secure file storage used by this website.
• Stripe processes card payments and subscriptions. Stripe receives the details needed to take and reconcile a payment. Full card numbers and security codes are entered into Stripe's payment form and are not stored by the club.
• Website hosting and email delivery providers process limited information to operate the site and send service messages.

These providers process information under their own security and privacy terms. Information may also be disclosed where required by law, to protect a person from harm, or in connection with a legal claim.

6. Storage, international transfers and security

Website information and private uploads are stored through Supabase. Payment information is stored by Stripe. These suppliers may process information in the UK, European Economic Area or other countries. Where information is transferred internationally, the club relies on the safeguards required by UK data protection law, such as adequacy regulations or approved contractual protections.

The club uses access controls, private storage, encrypted connections and restricted administrator accounts. No online service can promise absolute security. Please contact us promptly if you believe information has been accessed or disclosed incorrectly.

7. How long we keep information

We keep information only for as long as it is reasonably needed for the purpose collected and to meet legal, safeguarding, insurance, tax and accounting duties. The period depends on the record:

• current player, guardian, registration and welfare records are reviewed when membership ends;
• health information and private registration photographs are removed when no longer needed for safe participation, league administration or a continuing safeguarding requirement;
• payment and accounting records are kept for the period required by tax and financial law;
• party bookings and contact enquiries are deleted or anonymised when no longer needed to manage the event, answer the enquiry or resolve a dispute; and
• safeguarding, insurance or legal records may need to be kept for longer.

Our suppliers may keep limited records for their own legal, fraud-prevention and regulatory obligations.

8. Your data protection rights

Depending on the circumstances, you may have the right to:

• ask for a copy of personal information;
• correct information that is inaccurate or incomplete;
• ask for information to be deleted or its use restricted;
• object to use based on legitimate interests;
• receive certain information in a portable format; and
• withdraw consent at any time, without affecting earlier lawful use.

These rights are not absolute and legal or safeguarding reasons may require us to keep or use some information. We may ask for proof of identity and authority before acting on a request. There is normally no charge.

9. Cookies and similar technology

The website uses essential technology to keep the site secure, remember authorised administrator or maintenance access and operate payment forms. Stripe may set cookies or use similar technology when its secure payment form is opened for fraud prevention and payment processing.

We do not currently use advertising or behavioural-tracking cookies. If non-essential analytics or marketing cookies are introduced, this notice and the website's consent controls will be updated first.

10. Contact, complaints and changes

To exercise a right or raise a concern, email info@whiterosejfc.co.uk. We aim to respond without undue delay and normally within one month.

If you remain unhappy, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

We may update this notice when our services or legal duties change. The date at the top shows the latest revision. See also our Terms of Service.