Privacy Policy – Grassroots Guardians CIC

Last Updated: September 2025

At Grassroots Guardians CIC (“we”, “us”, “our”), we are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Grassroots Guardians CIC is a Community Interest Company registered in England & Wales (Company Number: [Insert Number]).

Registered Address: [Insert Address]
Email: brian.lee1966@yahoo.co.uk

We act as the data controller for the personal information we collect and process.

2. Information we collect

We may collect and process the following types of personal data:

• Identity & contact details: name, address, telephone number, email address.

• Children’s information: date of birth, parent/guardian contact details, medical or dietary needs (if relevant to safe participation).

• Participation records: club/team registrations, attendance, involvement in sessions, events, or programmes.

• Financial details: payment and donation information where applicable.

• Communications: preferences, feedback, enquiries, and correspondence.

• Website & technical data: IP addresses, cookies, and analytics to improve our online services.

Sensitive information (such as medical data) is only collected with your consent and used solely for safeguarding and participation purposes.

3. How we use your information

We process personal data for the following purposes:

• To register and manage participants in football sessions, teams, and events.

• To communicate with you about schedules, updates, and opportunities.

• To process payments, donations, and issue receipts.

• To ensure safeguarding, health, and safety requirements are met.

• To improve and evaluate our programmes and services.

• To send newsletters and fundraising appeals (only if you opt in).

4. Lawful basis for processing

We only use your personal data where we have a lawful reason to do so, including:

• Consent – where you have agreed (e.g. receiving newsletters).

• Contract – to provide services you have signed up for.

• Legal obligation – for safeguarding, accounting, or reporting requirements.

• Legitimate interests – where necessary for the running of our programmes and not overridden by your rights.

5. Sharing your information

We may share personal data with:

• Service providers (e.g. IT, website hosting, payment processors).

• Partner organisations (e.g. schools, local clubs, funding bodies).

• Regulators or safeguarding authorities where legally required.

We never sell your data and only share it when necessary, with safeguards in place.

6. Data retention

We only keep personal data for as long as necessary:

• Financial/payment records: up to 7 years.

• Participant records: while actively involved and for up to 5 years afterwards.

• Marketing preferences: until you withdraw consent.

After these periods, data will be securely deleted or anonymised.

7. Your rights

Under UK GDPR you have the right to:

• Access the information we hold about you.

• Request corrections if it is inaccurate.

• Ask for deletion of your personal data (where applicable).

• Restrict or object to how we use your data.

• Withdraw consent at any time (where consent is the legal basis).

• Lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk.

To exercise your rights, contact us at brian.lee1966@yahoo.co.uk.