Data Protection Policy

1. POLICY AIM

K7X Ltd (“Pro-Soccer”) operates 5 and 7 a-side football pitches in Glasgow. We also provide coaching for children and function hire for social events.

Pro-Soccer processes the personal data of our employees, members and customers and those who play and coach at our venues. We will also process the personal data of children where they are receiving coaching or where a parent or guardian has made a booking on their behalf.

This policy sets out our commitment to ensuring that any personal data which we process is carried out in compliance with Data Protection Law (Data Protection Act 1998, the General Data Protection Regulation 2016/679 and all relative European Union and Member State data protection legislation in force and as amended or replaced from time to time). We are committed to ensuring that good data protection practice is embedded in the culture of our staff and our organisation. Pro-Soccer’s other policies and procedures are listed below:

Data Retention Policy
Data Subject Rights Policy
Breach Notification Policy
Data Protection Impact Assessment Policy

This policy applies to all personal data processed by Pro-Soccer and is part of our approach to compliance with Data Protection Law. All Pro-Soccer staff are expected to comply with this policy.

2. DATA PROTECTION PRINCIPLES

Pro-Soccer confirms that it complies with the following data protection principles and undertakes to ensure that when it processes personal data:

it is processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
it is collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; (‘purpose limitation’)
It is all adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed; (‘data minimisation’)
it is all accurate and, where necessary, kept up to date and that reasonable steps will be

taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’)

it is kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; (‘storage limitation’)
it is processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

Pro-Soccer is committed to facilitating and complying with any request from a data subject who wishes to exercise their rights under Data Protection Law in a transparent manner and without undue delay.

We will not transfer any personal data to a country outside the EU or an international organisation without ensuring the level of protection provided by Data Protection Law is not undermined.

3. PROCESS AND PROCEDURES

We will:

only collect and process personal data that it is necessary for the purpose or purposes that we have identified in advance;
ensure that the legal basis for processing personal data is identified in advance;
ensure that as far as possible the personal data we hold is accurate;
only process your data for as long as is it required for our purposes and then we will securely dispose of, or delete your personal data (Pro-Soccer’s Data Retention Policy sets out the specific retention periods);
provide information about what it does with personal data in its privacy notice which provides more detail on why we are asking for personal data and what we intend to do with it (Pro-Soccer has a separate privacy notice for its employees);
not do anything with your data that you would not expect given the content of this policy and our privacy notice; and
ensure that appropriate security arrangements are in place in relation to the personal data it holds.

We will ensure that all staff who handle personal data are aware of their responsibilities under this policy and other relevant data protection and information security policies and that they are adequately trained, supervised and monitored.

Any employee who breaches this policy may be subject to disciplinary proceedings.

4. DATA SUBJECT RIGHTS

Pro-Soccer will ensure that it has procedures in place to allow data subjects to exercise the following data subject rights under the GDPR. For further information please see our Data Subject Rights Policy:

Subject access: the right to request information about how personal data is being processed including whether personal data is being processed and the right to be allowed access to that data and to be provided with a copy of that data along with the right to obtain the following information:

the purpose of the processing;
the categories of personal data;
the recipients to whom data has been disclosed or which will be disclosed;
the retention period;
the right to lodge a complaint with the ICO;
the source of the information if not collected direct from the subject; and
the existence of any automated decision making.

Rectification:the right to have us rectify inaccurate personal data concerning you without undue delay.

Erasure:the right to have data erased in certain circumstances, and to have confirmation of erasure, but only where:

the data is no longer necessary in relation to the purpose for which it was collected;
where consent is withdrawn;
where there is no legal basis for the processing; or
there is a legal obligation to delete data.

Restriction of processing: the right toask for certain processing to be restricted in the following circumstances:

if you contest the accuracy of your personal data;
if our processing is unlawful but you do not want it to be erased;
if we no longer need the data for the purpose of the processing but it is required by you for the establishment, exercise or defence of legal claims; or
if you have objected to the processing, pending verification of that objection.

Data portability: you have the right to receive a copy of the personal data you have provided to us and certain information generated by us, if our processing is carried by automated means, which will allow you to transfer it to another data controller. This only applies if our legal basis for processing is consent or under a contract.

Object to processing:you have the right to object, on grounds relating to your particular situation, to the following:

processing carried out in the public interest or in the exercise of official authority; or
processing relying on the legitimate interests processing condition unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

You have an absolute right to object to any direct marketing that we are sending to you and there are no exemptions to this which would allow you to refuse to comply.

Object to automated decision making: if we are making decisions about you based on automated processing which have a legal or similar effect on you, then in some circumstances you have the right to object to this decision being made solely on the basis of automated processing. This includes any profiling of you that we carry out.

You cannot exercise this right in the following circumstances when the processing is:

necessary for entering into or the performance of a contract;
authorised by law; or
based on explicit consent.

5. SPECIAL CATEGORY PERSONAL DATA

This includes the following personal data:

revealing racial or ethnic origin,
revealing political opinions,
revealing religious or philosophical beliefs,
revealing trade union membership,
genetic data and biometric data being processed for the purpose of uniquely identifying a natural person,
data concerning health, including physical and mental health;
data concerning a natural person's sex life or sexual orientation, and
data relating to criminal convictions or offences.

Pro-Soccer processes special category data of employees as is necessary to comply with employment and social security law. We also process some special category data of those who play at our venues (medical information relevant to your fitness to play) where you have consented and provided us with this information. This policy sets out the safeguards we believe are appropriate to ensure that we comply with the Data Protection Principles set out above.

6. PERSONAL DATA BREACHES

Pro-Soccer maintains a register of data breaches and all personal data breaches are recorded in this register which will be monitored. Action will be taken in relation to any issues identified in this register, particularly if any pattern of breaches is identified.

We will report personal data breaches which are likely to result in a risk to the rights and freedoms of the data subject to the Information Commissioner’s Office in compliance with our breach notification policy.

Pro-Soccer will also communicate any personal data breach which is highly likely to result in a risk to the rights and freedoms of the data subject to the data subject or subjects involved in compliance with our Breach Notification Policy.

7. DATA PROTECTION IMPACT ASSESSMENTS (DPIA)

If we embark on a new project which involves the processing of personal data, particularly one using new technologies, we will carry out a DPIA in line with our policy. The decision to carry out a DPIA will take into account the nature, scope, context and purposes of the processing and determine if there is likely to be high risk to the rights and freedoms of natural persons.