Privacy

12 Personal data and privacy

12.1 DERBY may process registration details including name, age/eligibility, contact details, team membership, payment-status information, participation history, disciplinary records where necessary, agreement records, and photographs or video in which a participant appears. DERBY should collect only what is relevant to league administration and specified purposes.

12.2 The purposes include eligibility checks, team registration, fixtures, results, safety, participant communications, authorised payments, dispute handling, statistics, season history, publication of appropriate football coverage, and lawful recordkeeping. DERBY should provide a separate accessible privacy notice with the lawful basis, retention approach, contact information and applicable individual rights.

12.3 Player contact details and dates of birth are not to be published on public team lists or shared with sponsors. DERBY may share limited information with service providers where necessary for the service, such as hosting, registration, video processing and communications, subject to appropriate safeguards. Aggregate or anonymised participation statistics may be shared with prospective partners.

12.4 Marketing emails, commercial offers and sponsor outreach based on a player’s personal contact data require a separate, freely chosen opt-in where applicable. Refusing optional promotional marketing must not prevent someone from registering for the league. Promotional preferences should be recorded and respected, including withdrawal requests.

12.5 DERBY should retain personal data no longer than reasonably necessary for disclosed purposes and legal obligations, limit staff access, secure the system and provide a way to request access, correction or deletion where legally applicable. Video data may be harder to delete once lawfully published, incorporated into a public match record or shared by others. Rights and exceptions must be explained in the separate privacy notice.