NXT GEN FC (“we”, “our”, “us”) is committed to ensuring the lawful, fair, and transparent handling of all personal data we collect and process. As a grassroots football club working closely with young people and families, we take data protection seriously and comply fully with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Purpose of the Policy
This policy explains how NXT GEN FC handles personal data relating to players, parents, coaches, volunteers, and supporters. It applies to all staff, volunteers, and anyone handling data on behalf of the club.

2. Scope
This policy covers all personal and sensitive data processed by the club, whether in digital or paper form, including:

Player registration details
Emergency contact and medical information
Volunteer and coaching records
Match footage and photographs
Email and communication records
3. Key Data Protection Principles
We adhere to the following principles when processing personal

Lawfulness, fairness, and transparency – We explain what we collect and why.
Purpose limitation – Data is collected for specific, explicit purposes.
Data minimisation – We only collect what is necessary.
Accuracy – We keep information up to date.
Storage limitation – We retain data only as long as necessary.
Integrity and confidentiality – We keep data secure.
Accountability – We take responsibility for compliance.
4. Lawful Bases for Processing
We process personal data under the following lawful bases:

Consent – e.g., for media or marketing
Contract – e.g., when registering players
Legal obligation – e.g., safeguarding or health and safety
Legitimate interests – e.g., communicating with members
5. Children’s Data
We collect and store children’s data only with parental/guardian consent and strictly for club purposes such as registration, team management, and safety. Additional care is taken with storing and accessing children's personal and medical information.

6. Data Security
We implement appropriate measures to safeguard personal data, including:

Password-protected files and systems
Secure online registration platforms
Limited access to sensitive data
Locked physical storage (for paper forms)
Staff and volunteer training on data handling
7. Data Sharing
We only share personal data when necessary and appropriate, such as:

With league organisers, governing bodies (e.g., The FA)
For safeguarding or emergency situations
With service providers (e.g., for online registration or kit ordering)
We do not sell or share data for commercial purposes.

8. Data Retention
We retain data only for as long as necessary:

Registration and emergency contact details: kept for the duration of participation + 1 season
Safeguarding records: retained per legal requirements
Consent and media forms: reviewed annually or upon withdrawal of consent