Members of

Right To Be Informed

Please read below regarding your rights to be informed regarding the private information we collect & our privacy policy.

At a glance

  • Individuals have the right to be informed about the collection and use of their personal data. This is a key transparency requirement under the UK GDPR.
  • We must provide individuals with information including: our purposes for processing their personal data, our retention periods for that personal data, and who it will be shared with. We call this ‘privacy information’.
  • We must provide privacy information to individuals at the time we collect their personal data from them.
  • If we obtain personal data from other sources, we must provide individuals with privacy information within a reasonable period of obtaining the data and no later than one month.
  • There are a few circumstances when we do not need to provide people with privacy information, such as if an individual already has the information or if it would involve a disproportionate effort to provide it to them.
  • The information we provide to people must be concise, transparent, intelligible, easily accessible, and it must use clear and plain language.
  • It is often most effective to provide privacy information to people using a combination of different methods.
  • We must regularly review, and where necessary, update our privacy information. we must bring any new uses of an individual’s personal data to their attention before we start the processing.
  • Getting the right to be informed correct will help us to comply with other aspects of the GDPR and build trust with people.

 

We provide individuals with all the following privacy information:

☐ The name and contact details of our organisation – Alfold FC

☐ The name and contact details of our representative – Keely Willis & Sam Foster

☐ The purposes of the processing – To allow assigning of players to various Football Leagues & the Whole Game System

☐ The lawful basis for the processing.

☐ The legitimate interests for the processing (if applicable).

☐ The categories of personal data obtained (if the personal data is not obtained from the individual it relates to).

☐ The recipients or categories of recipients of the personal data – Various Football Leagues & the Whole Game System

☐ The retention periods for the personal data – 12 Months maximum

☐ The rights available to individuals in respect of the processing.

☐ The right to withdraw consent (if applicable).

☐ The right to lodge a complaint with a supervisory authority.

☐ The source of the personal data (if the personal data is not obtained from the individual it relates to).

☐ The details of whether individuals are under a statutory or contractual obligation to provide the personal data (if applicable, and if the personal data is collected from the individual it relates to).

☐ The details of the existence of automated decision-making, including profiling (if applicable).


When to provide it

☐ We provide individuals with privacy information at the time we collect their personal data from them.

If we obtain personal data from a source other than the individual it relates to, we provide them with privacy information:

☐ within a reasonable of period of obtaining the personal data and no later than one month;

☐ if we plan to communicate with the individual, at the latest, when the first communication takes place; or

☐ if we plan to disclose the data to someone else, at the latest, when the data is disclosed.


How to provide it

We provide the information in a way that is:

☐ concise;

☐ transparent;

☐ intelligible;

☐ easily accessible; and

☐ uses clear and plain language.


Changes to the information

☐ We regularly review and, where necessary, update our privacy information.

☐ If we plan to use personal data for a new purpose, we update our privacy information and communicate the changes to individuals before starting any new processing.


Best practice – drafting the information

☐ We undertake an information audit to find out what personal data we hold and what we do with it.

☐ We put ourselves in the position of the people we’re collecting information about.

☐ We carry out user testing to evaluate how effective our privacy information is.

Best practice – delivering the information

When providing our privacy information to individuals, we use a combination of appropriate techniques.

 

What is the right to be informed and why is it important?

The right to be informed covers some of the key transparency requirements of the UK GDPR. It is about providing individuals with clear and concise information about what you do with their personal data.

Articles 13 and 14 of the UK GDPR specify what individuals have the right to be informed about. We call this ‘privacy information’.

Using an effective approach helps us to comply with other aspects of the UK GDPR, foster trust with individuals and obtain more useful information from them.

 

What privacy information should we provide?

The table below summarises the information that we must provide. What we need to tell people differs slightly depending on whether we collect personal data from the individual it relates to or obtain it from another source.

What information do we need to provide? Personal data collected from individuals Personal data obtained from other sources
The name and contact details of your organisation
The name and contact details of your representative
The contact details of your data protection officer
The purposes of the processing ✓ 
The lawful basis for the processing
The legitimate interests for the processing
The categories of personal data obtained
The recipients or categories of recipients of the personal data ✓ 
The details of transfers of the personal data to any third countries or international organisations ✓  ✓ 
The retention periods for the personal data ✓ 
The rights available to individuals in respect of the processing ✓ 
The right to withdraw consent
The right to lodge a complaint with a supervisory authority ✓ 
The source of the personal data
The details of whether individuals are under a statutory or contractual obligation to provide the personal data
The details of the existence of automated decision-making, including profiling

Are there any exceptions?

When collecting personal data from individuals, we do not need to provide them with any information that they already have.

When obtaining personal data from other sources, we do not need to provide individuals with privacy information if:

  • the individual already has the information;
  • providing the information to the individual would be impossible;
  • providing the information to the individual would involve a disproportionate effort;
  • providing the information to the individual would render impossible or seriously impair the achievement of the objectives of the processing;
  • you are required by law to obtain or disclose the personal data; or
  • you are subject to an obligation of professional secrecy regulated by law that covers the personal data.

 

 

What common issues might come up in practice?

If we share personal data with other organisations:

  • As part of the privacy information we provide, we must tell people who we are giving their information to, unless we are relying on an exception or an exemption.
  • We can tell people the names of the organisations or the categories that they fall within; choose the option that is most meaningful.

If you obtain personal data from publicly accessible sources:

  • We still have to provide people with privacy information, unless we are relying on an exception or an exemption.
  • If we think that it is impossible to provide privacy information to individuals, or it would involve a disproportionate effort, we must carry out a DPIA to find ways to mitigate the risks of the processing.
  • Be very clear with individuals about any unexpected or intrusive uses of personal data, such as combining information about them from a number of different sources.
  • Provide people with privacy information within a reasonable period of obtaining the data, and no later than one month.