Player registration privacy information
This information is written for players and their parents or guardians. Bishops Castle Town FC is responsible for the personal information collected through the player-registration form.
What we collect and why
Bishops Castle Town FC uses registration information to organise membership and football, contact parents or adult players, support safe participation and respond to emergencies. Necessary information may be shared with the relevant football association, league or registration platform and, where justified, safeguarding or emergency services. Photography is a separate choice and can be refused without affecting registration.
Records are held in dedicated tables in the website’s database, not a public spreadsheet or downloadable file. Player identity, guardian/emergency contacts, medical/support answers and signature payloads are encrypted. Operational fields such as season, status, references and timestamps are not all encrypted. Nominated registration officers can access registration records; medical/support access requires a separate permission. The encryption key is kept in server configuration, outside this repository and database.
Club policy reserves routine staff access to player records to the Chairman, Vice-chairman, Treasurer and Secretary, with access approved individually and medical/support access separately restricted. Coaches request information from one of these officials rather than accessing a player-record portal. The official reviews the request and shares only information needed for the agreed club purpose through an appropriate private channel. Website administrators retain technical access. Job titles, committee listings and the shared committee-page password do not automatically grant access.
Email verification confirms access to the email address, not independently the signer’s identity or parental responsibility. The typed signature, declarations, versions and verification time are recorded. Full submissions and medical details are not emailed. Authorised staff can send minimal team reports containing player names and registration/signature status to a specifically checked recipient. Those emails, downloaded exports and hosting backups require their own access and retention controls; website database encryption does not encrypt every copy.
Incomplete, unverified submissions normally become due for automatic deletion after 30 days. Returning-player lookup requires an exact identity/contact match and email verification before details are shown, and excludes registration seasons whose three-year period has expired.
The enabled retention rule makes each season’s registration due for deletion three years after its 30 June season end: for example, 2026/27 is due from 1 July 2030 (UK time). This includes that season’s medical/support answers, contact details, signature evidence and linked audit entries. A later renewal does not extend older records. Player identity is removed when no seasonal registrations remain. Daily scheduled cleanup runs in batches, so actual erasure follows a successful scheduled run.
A record may be held beyond the normal period only for a specific documented safeguarding, insurance or legal requirement, with a review date. A hold does not restore access through parent lookup. Medical information must also be reviewed for ongoing necessity, rather than assuming that every field is needed for the full period. Copies in mailboxes, exports or backups are managed separately; deletion from the website cannot recall them.
The club is completing its documented privacy-policy review, including the lawful bases for registration and the additional legal condition for medical/support data. This information will be updated when those decisions are confirmed. Please contact the secretary for clarification before providing information if you are unsure.
Your choices and rights
Photography is optional and can be refused without affecting registration. Where the club relies on consent, it must be possible to withdraw it. Players have data-protection rights over their own information, including rights to be informed and, in appropriate circumstances, to access, correct or erase it. A parent or guardian may act for a child where appropriate, but the club must consider the child’s understanding, wishes and best interests.
Contacting the club
For privacy questions, access, correction, consent withdrawal or erasure requests, email secretary@bctfc.co.uk. Please ask for a private conversation rather than sending unnecessary medical details. Rights depend on the circumstances; where relevant you may also request restriction, object to processing or request data portability. If the club cannot resolve your concern, you can complain to the Information Commissioner’s Office (ICO).