Last updated 19 August 2026. If anything here is unclear, email secretary@summertownstars.org.
1. Who we are
Summertown Stars AFC is a community grassroots football club in North Oxford. We provide football to more than 850 children and young people across 63 teams, supported by around 160 coaches, managers and administrators. We are a Community Amateur Sports Club, holding three star FA accreditation and Thriving Club status.
We are the data controller for the information described here. Our registered details are:
- •Data Protection Lead secretary@summertownstars.org
- •Postal address Summertown Stars AFC, 8 Salisbury Crescent, Oxford, OX2 7TL
- •ICO registration ZC148021
2. What we collect
If you or your child play for us
- •Name, date of birth, gender and photograph, for FA registration
- •Home address, email and phone number for at least one parent or carer
- •Emergency contact details
- •Medical information relevant to match day welfare, such as allergies, conditions and emergency medication, only if you choose to share it
- •School attended, used only for age group allocation and never shared
- •Proof of age where the FA or a league requires it
- •A record of each payment. Card and bank details are entered by you directly with Stripe and we never see or hold them
- •Your renewal choices and photo consents each season
If you volunteer, coach, manage or sit on the committee
- •Name, contact details and role
- •DBS check reference and date. The certificate itself stays with you
- •FA coaching qualifications and safeguarding certificate dates
- •Expense claims where applicable
- •If you use the Members Area, your email address and a securely hashed password. We never store a password in readable form
If you receive club emails
- •Name and email address
- •Whether a message was delivered. We do not use open or click tracking, so we do not know whether you read an email or which links you followed
If you visit this website
- •Server log information: IP address, browser type, page requested and time, used to serve the site and protect it against abuse
- •Aggregated visitor statistics, collected without cookies and without any identifier that could single you out. See the Cookie Policy
- •No cookies at all on the public pages. Cookies are used only to keep you signed in to the Members Area
3. Children's data and special category data
Medical information, safeguarding records and information about a child under thirteen are treated with extra care under UK GDPR. We have designed our systems with the Age Appropriate Design Code in mind.
- •Medical information is visible only to the Welfare Officer, the Chair, and the child's own coach on match day. It is never published or shared externally without explicit consent.
- •Safeguarding records are held securely by the Welfare Officer, with access restricted to the Welfare Officer and the Chair. We follow FA safeguarding protocols, and may be required to share records with statutory authorities where a child is at risk.
- •For children under thirteen we rely on parental consent for anything not strictly necessary for membership, and that consent can be withdrawn at any time.
- •Children do not hold accounts. The Members Area is for parents, coaches, officials and committee members only.
4. Why we hold it, and our lawful basis
Under UK GDPR we need a lawful reason for every use of your data. These are ours.
| What we use it for | Lawful basis | Notes |
|---|---|---|
| Registering your child with the FA and placing them in a team | Contract | Without this we cannot register them to play affiliated football. |
| Match day operations, welfare and emergencies | Contract, and vital interests in an emergency | Medical information is used only where relevant. |
| Safeguarding and child protection | Legal obligation and public interest | Required by the FA and by UK safeguarding law. |
| Collecting membership subscriptions | Contract | Taken through Stripe. |
| Running the annual renewal | Contract | Includes sending each family a personal, single use renewal link. |
| Fixture updates, club news and committee announcements | Legitimate interests | You can opt out of non-essential messages at any time. |
| Marketing emails, such as fundraising or shop offers | Consent | Only if you opted in. Every one carries an unsubscribe link. |
| Members Area accounts | Contract and legitimate interests | Access limited to what your role requires. |
| Publishing photos or video | Consent | Set per channel by a parent, and changeable at any time. |
| Accounting and statutory reporting | Legal obligation | Retention per our Retention Schedule. |
| Defending the club against legal claims | Legitimate interests | Typically seven years. |
5. Who we share it with
We share the minimum necessary. We do not sell your data to anyone, ever.
Inside the club
Access in the Members Area is enforced by role at the system level. A coach sees their own squad and not another team's. A parent sees their own children. Welfare and safeguarding data is restricted to the Welfare Officer and the Chair. Payment data is restricted to the Treasurer.
Outside the club
| Who | What they get | Why, and the safeguards |
|---|---|---|
| The Football Association | Player registration details | Governing body. Necessary for a child to play affiliated football. |
| The leagues we play in, including OYFL and OGFL | Squad lists, results, referee reports | Required to take part in league competition. |
| Stripe Payments UK Ltd | Payment details, entered by you directly with them. We receive only a record of the payment | PCI DSS Level 1 certified. Our sole payment provider. |
| Airtable, Inc. | Member records. Airtable is our database | SOC 2 Type II certified, acting as our processor. Data may be processed outside the UK, see section 7. |
| Vercel Inc. | Website server logs including IP addresses, and aggregated visitor counts | SOC 2 Type II certified. This site runs on their platform. |
| Zoho Corporation, trading as ZeptoMail | Name and email address for club email | Transactional email provider, EU endpoint. |
| Google Ireland Ltd | Club email and shared drive. Does not hold bulk member data | Google Workspace, ISO 27001 certified. |
| Fillout | Responses to the coach training preference form only | Used for that one internal form. It is not part of the parent registration journey. |
| GoCardless Ltd | Historic Direct Debit records only | No longer in use. Mandates are stopped and no further collections are taken. Listed here only because it still holds past payment records we must retain for seven years. |
| Our club insurer | Anonymised claim data | Only in the event of a claim. |
| Team sponsors | Photographs of children, only where a parent has consented to sponsor use specifically | Per channel consent. No consent means no sharing. |
When we may be required to share
- •With police, courts or social services where we are legally obliged to, or where a child is at risk
- •With HMRC for accounting and statutory compliance
- •With our auditor or solicitor, under a duty of confidence
6. How long we keep it
| What | How long | Why |
|---|---|---|
| Membership records | While you are a member, plus seven years | Legal claims and accounts |
| Safeguarding and welfare records | Until the person reaches 25, or 35 years after the event, whichever is longer | FA and statutory guidance |
| DBS check references | Six months after a recruitment decision, or the duration of the role | DBS code of practice |
| Financial records | Seven years | HMRC and statutory reporting |
| Photographs and video on active channels | While consent is live, removed on withdrawal | Consent based |
| Members Area accounts | While your role or membership continues | Access control |
| Email subscribers | Until you unsubscribe, plus two years | Proof of consent |
| Website server logs and visitor counts | As retained by our hosting provider | Security and abuse prevention |
7. Where it is stored
Most of our data is held in the United Kingdom or the European Economic Area. Some providers, notably Vercel, Stripe, Airtable and Google, operate global infrastructure and may process data outside the UK. Where that happens the transfer is protected by the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU to US Data Privacy Framework, as applicable. You can ask us for detail on any of these at any time.
8. How we keep it safe
- •We use established providers holding recognised certifications such as SOC 2, ISO 27001 and PCI DSS
- •Members Area passwords are stored only as salted hashes, never in readable form
- •Access to welfare, safeguarding and financial data is locked to specific roles at the system level
- •Sign-in and forms are protected against cross-site request forgery
- •All traffic to this site is encrypted, with HTTPS enforced
- •Volunteers receive data protection awareness guidance
- •We maintain a breach response procedure with a 72 hour ICO notification target
We keep this list to what we actually do. Where we improve something we will say so here rather than in advance.
9. Your rights
You have the following rights over your data, and we will respond to any request within one calendar month.
- •Access a copy of what we hold about you or your child
- •Rectification of anything that is wrong
- •Erasure, subject to records we are legally required to keep
- •Restriction of how we use it
- •Objection to processing based on legitimate interests, including marketing
- •Portability of data you gave us under contract or consent
- •Withdrawal of consent at any time, without affecting what was lawful beforehand
To exercise any of these, email secretary@summertownstars.org. We may need to verify who you are before releasing anything. Parents can also see and correct much of their own family's information directly through their registration link.
10. Complaints
If you are unhappy with how we have handled your data, please raise it with us first and we will do what we can to put it right. If you are still dissatisfied you can complain to the Information Commissioner's Office at ico.org.uk, on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
11. Changes
We review this policy at least annually and whenever we change how we handle data. Material changes are communicated to members by email.