Data Handling and Retention Policy – AFC Reading

Effective Date: 27/4/26

AFC Reading (“we”, “us”, “our”) is committed to ensuring that all personal data is handled responsibly, securely, and in compliance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Purpose of This Policy

This policy outlines how AFC Reading collects, handles, stores, and retains personal data to ensure it is:

Processed lawfully, fairly, and transparently
Collected for specified, explicit purposes
Adequate, relevant, and limited to what is necessary
Accurate and kept up to date
Stored securely and only for as long as necessary

2. Types of Data We Handle

We may process the following types of personal

Contact information (name, address, email, phone number)
Membership and player registration details
Emergency contact and safeguarding information (where applicable)
Communication records (emails, enquiries)
Website and usage data (e.g. IP address, cookies)

Special category data (e.g. health or safeguarding information) will only be processed where strictly necessary and with appropriate safeguards.

3. Data Handling Principles

We ensure that personal data is:

Accessed only by authorised individuals
Used solely for legitimate club purposes
Not disclosed to unauthorised third parties
Protected against loss, misuse, or unauthorised access

All staff, volunteers, and affiliates handling data are expected to follow this policy.

4. Data Storage and Security

We store personal data securely using:

Password-protected systems and accounts
Secure cloud storage or encrypted devices (where applicable)
Access controls limiting data to those who need it

We take reasonable technical and organisational measures to safeguard all data.

5. Data Retention Periods

We retain personal data only for as long as necessary. Typical retention periods include:

General enquiries: up to 12 months
Membership records: duration of membership + up to 2 years
Player registration duration of registration + up to 3 years
Safeguarding records: in line with legal and governing body requirements (may be longer)
Financial records: up to 6 years (for legal/accounting compliance)

After these periods, data will be securely deleted or anonymised.

6. Data Disposal

When data is no longer required, we ensure secure disposal by:

Permanently deleting electronic files
Shredding or securely destroying physical documents
Ensuring third-party processors also delete data where applicable

7. Data Sharing

We only share personal data when necessary and lawful, including:

With service providers supporting our operations
With governing bodies or leagues where required
When legally required by authorities

All data sharing is carried out with appropriate safeguards.

8. Breach Management

In the event of a data breach, we will:

Assess and contain the breach promptly
Notify affected individuals where required
Report to the Information Commissioner’s Office (ICO) if necessary
Take steps to prevent recurrence

9. Responsibilities

All individuals involved with AFC Reading (staff, volunteers, contractors) are responsible for:

Handling data in accordance with this policy
Reporting any data concerns or breaches immediately
10. Policy Review

This policy will be reviewed regularly and updated as necessary to reflect legal or operational changes.

Contact

For questions regarding this policy or data handling practices, please contact AFC Reading via the official website.

AFC Reading

AFC Reading Equality Policy

AFC Reading Equality Policy