Privacy notice
Draft awaiting the association's approval. The retention periods and service providers below are proposals until the association confirms them.
Who we are
Rochdale Schools Metro Football Association ("the association", "we") runs schools football competitions in the Rochdale borough and is the data controller for the information described here. Contact for anything about your data: info@example.org.
Pupils
We do not collect or publish personal information about pupils: no names, photographs, dates of birth or contact details. Fixtures, results and tables refer only to schools and their teams (for example "Year 8 Boys").
What we hold and why
- Staff user accounts: name, work email address, the school(s) you act for, your role, when you last signed in, and a securely hashed password (we cannot read it). Used to let you sign in, submit results and enter competitions for your school. Lawful basis: our legitimate interests in running the competitions.
- Organiser and coordinator contact details: the names, work email addresses and (optional) mobile numbers of your school's football coordinators, the school telephone number, kit colours and school times, given when you register. Used to arrange fixtures and contact the right person about matches. Lawful basis: legitimate interests.
- Registrations and entries: which competitions your school entered, how many teams, and when. Used to organise the competitions and work out fees.
- Invoices and payment records: the invoice contact, address, email and purchase order number you give, each invoice issued, and the payments the association records (amount, date received, bank reference and a short note). Used to charge entry fees and keep the association's accounts. Lawful basis: legitimate interests and our obligation to keep financial records. Payments are recorded by hand from the association's bank account; we do not take card details or connect to your bank.
- Activity log: significant actions (for example result submissions, corrections, fee and payment changes) with the account that made them, so disputes can be resolved fairly. Contact details and bank details are not copied into it.
Who can see it
- The public sees only fixtures, results, tables and school names. Account names, email addresses and contact details are never shown on the public website.
- Your school's own staff accounts see your school's registration, contacts and invoices. Other schools cannot.
- The association's administrators see all registrations, invoices and payment records. League and cup results officials see only what they need for results.
Service providers
The website's hosting company and email provider process data on the association's behalf. Their names and locations will be listed here once the association confirms them. We do not sell data or use it for marketing.
How long we keep it
| Information | Kept for |
|---|---|
| User accounts (name, work email, school, password hash) | While the person has the role. Deactivated when they leave; deleted 12 months after deactivation. |
| Sign-in sessions and password links | Sessions expire after 14 days of inactivity. Set-up and reset links expire after 7 days (1 hour if requested from the login page) and work once. |
| Coordinator and school contact details on a registration | The season they were given for, plus one further season, then deleted. |
| Invoices, payment records and registration entries | Six years after the end of the season, as financial records, then deleted. |
| Activity (audit) log | Six years, so that results and fee disputes can be resolved. |
| Results, fixtures and tables (no personal data) | Kept as the association's competition history. |
Security
The website is served only over HTTPS. Passwords are stored as Argon2id hashes, sign-in links work once and expire, and every page and action checks your permissions on the server. The database is backed up regularly to a separate location.
Cookies
We use a single strictly necessary cookie to keep signed-in staff logged in. We do not use advertising or analytics cookies.
Your rights
Under UK GDPR you can ask to see, correct or delete personal information we hold about you, or object to its use. Contact info@example.org. You can also complain to the Information Commissioner's Office (ico.org.uk).