Data Collection and Use NRFU collects and uses personal data to operate and support the game of rugby. This includes data from players, clubs, members, the public, clients, customers, and suppliers. We ensure that all personal data is handled lawfully, fairly, and transparently.

Principles of Data Protection NRFU adheres to the following principles:

1. Lawfulness, Fairness, and Transparency: Data is processed lawfully, fairly, and in a transparent manner.
2. Purpose Limitation: Data is collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.
3. Data Minimisation: Data collected is adequate, relevant, and limited to what is necessary.
4. Accuracy: Data is accurate and, where necessary, kept up to date.
5. Storage Limitation: Data is kept in a form that permits identification of data subjects for no longer than necessary.
6. Integrity and Confidentiality: Data is processed in a manner that ensures appropriate security.

Rights of Data Subjects Individuals have the following rights:

• Right to be Informed: Individuals have the right to be informed about the collection and use of their personal data.
• Right of Access: Individuals can access their personal data and supplementary information.
• Right to Rectification: Individuals can have inaccurate personal data rectified or completed if it is incomplete.
• Right to Erasure: Individuals can request the deletion or removal of personal data where there is no compelling reason for its continued processing.
• Right to Restrict Processing: Individuals can block or suppress processing of their personal data.
• Right to Data Portability: Individuals can obtain and reuse their personal data for their own purposes across different services.
• Right to Object: Individuals can object to the processing of their personal data in certain circumstances.

Data Security NRFU implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

• Encryption: Protecting personal data through encryption.
• Access Controls: Ensuring that access to personal data is limited to authorised personnel.
• Regular Testing: Regularly testing, assessing, and evaluating the effectiveness of technical and organisational measures for ensuring the security of processing.

Data Breach Notification In the event of a data breach, NRFU will notify the Information Commissioner’s Office (ICO) within 72 hours and communicate the breach to affected individuals if it is likely to result in a high risk to their rights and freedoms.

Review and Updates This policy will be reviewed regularly and updated as necessary to ensure continued compliance with GDPR and other relevant legislation. For further guidance, please refer to the England RFU GDPR Policy.

Contact Information For any questions or concerns regarding this policy or data protection practices, please contact the NRFU Data Protection Officer at: dataofficer@northumberlandrfu.co.uk.

Review Date This policy was reviewed on 25/03/2025.

Date of Next Review – March 2026.