Privacy policy

Last updated: 19 August 2026

This privacy policy explains how Yarm Rugby Club handles personal information through the Yarm Rugby mobile app and this website. Yarm Rugby Club is the data controller.

Information we collect

Depending on how you use the app, we may process:

• your name, verified email address, date of birth, mobile number and optional playing position;
• your invited team, membership, registration and administrator-approval status;
• fixtures, attendance availability and related team-administration records;
• optional team-message and match-reminder preferences;
• minimum clearance status and restrictions for a 17-year-old where the external rugby approval process applies; and
• account, session, app-instance, device-integrity, request, security and audit information needed to protect the service.

If emergency-contact features are enabled in future and you choose to provide those details, we will explain their use when they are collected. The app does not collect copies of medical, assessment, parent or carer, DBS, or RFU/GMS forms.

How we obtain information

Most information comes directly from you. Membership, role and approval information may also be supplied or confirmed by an authorised Yarm Rugby Club administrator. For a 17-year-old, a Club Administrator may record only the minimum result of an external RFU/GMS or Constituent Body approval process.

Why we use information and our lawful bases

We use personal information to:

• create, verify and secure invited accounts;
• confirm membership and apply team and role access controls;
• manage fixtures, availability and necessary club administration;
• send required account, security and service messages;
• send optional team messages or match reminders where you have chosen to receive them;
• meet safeguarding, legal, regulatory and data-protection responsibilities; and
• prevent abuse, investigate security events and respond to privacy requests.

Our lawful bases are legitimate interests in secure and effective club administration, steps connected with providing the membership service, consent for optional communications, and legal obligations where they apply. Vital interests may apply if information is needed in a genuine emergency. We consider the additional interests and safeguards of 17-year-old users.

You can withdraw optional email choices in the app without losing access to the core service. Privacy acknowledgement, account verification, membership approval and optional-message consent are separate decisions.

Who can access information

Players do not receive other players' contact details. An authorised team administrator can access only information needed for their assigned team. A Club Administrator has club-wide authority for approved club purposes. Administrative access is restricted, authenticated and audited.

We may use carefully selected service providers for:

• secure application and database hosting;
• delivery of verification, security and opted-in club emails;
• mobile app distribution and app-integrity checks through Google or Apple; and
• limited technical support, backup and security operations.

These providers may process only the information needed for their service and are subject to appropriate terms and safeguards. If processing involves an international transfer, we use an applicable UK adequacy regulation or approved contractual safeguards. We may also disclose information where required by law or to protect someone in an emergency.

How we protect information

We use HTTPS in transit, encrypt direct personal information in the application database, hash passwords and security credentials, restrict access by club role and team, use session and device controls, and maintain limited security audit records. The mobile app keeps account data in memory for the active screen and stores only the minimum protected credentials needed to maintain an authorised session and app instance.

How long we keep information

We keep information only while it is needed for membership, club administration, safeguarding, security, legal claims and data-protection accountability. We review records when an account or membership closes and erase or anonymise information that is no longer required. The precise period depends on the record's purpose, any applicable legal or safeguarding requirement, and whether an issue or request remains open.

Active application audit events are normally kept for 30 days. Short-lived login, verification, session and request-security records expire or are purged on limited operational schedules. Encrypted backups are held on a bounded rolling schedule; if a backup is restored, completed deletion and suppression decisions must be reapplied before normal access resumes.

Account deletion

You can request account deletion in the app from Profile. You will be asked to confirm your identity and the Club will review the request. Approved requests promptly close account access, memberships, sessions and optional messages. We then erase or anonymise associated personal information unless a specific legal, safeguarding, security or legal-claims reason requires limited information to be retained. You can also contact us using the details below if you cannot access the app.

Your rights

Depending on the circumstances, you may have rights to access, correct, erase, restrict or receive your personal information, and to object to its use. Where we rely on consent, you may withdraw it at any time. These rights are not always absolute, but we will explain any lawful limitation that applies.

You have the right to object to processing based on legitimate interests and an absolute right to object to direct marketing.

If you are unhappy with our response, you may complain to the Information Commissioner's Office.

Automated decisions

We do not make solely automated decisions that produce legal or similarly significant effects. Technical rules may restrict access when an account, team membership, age-related clearance, session or app-integrity requirement is not valid; authorised administrators remain responsible for membership and clearance decisions.

This website

The current website does not use advertising, analytics, tracking cookies or contact forms. Ordinary hosting security logs may temporarily record technical request information such as an IP address, browser identifier, requested page and time.

Contact us

Send privacy questions or rights requests to:

Changes to this policy

We will update this page when the app's processing, service providers or legal requirements materially change. The latest version and update date will remain available at this address.