Privacy policy

Who we are

Cheam Sports FC is a grassroots youth football club based at Peaches Close, Cheam, Surrey, SM2 7BJ. We are affiliated with Surrey FA (Org ID: 75435) and compete in the Surrey Youth League and the Epsom & Ewell League. For the purposes of UK data protection law (the UK GDPR and Data Protection Act 2018), the club is the data controller.

What data we collect

Trial enquiry form (one form per team page). When you book a trial, we collect:

• Player first and last name
• School year
• Playing position and experience (free-text)
• Parent or guardian name
• Email address
• Phone number

Full player registration form. When a place is confirmed and your child joins the club, we collect:

• Player full name and date of birth
• Playing position and experience
• Parent or guardian full name and date of birth
• Home address and postcode
• Email address and mobile phone number
• A head-and-shoulders photo of the player (for FA registration)
• Your agreement to the club code of conduct and this privacy policy

When you visit our website. Our hosting provider (Vercel) collects standard server logs including your IP address, browser type, and pages visited, for security and debugging purposes. We also use Vercel Web Analytics to measure aggregate page views and visitor counts. Vercel Web Analytics is cookieless and does not track individuals across sites - it uses a short-lived anonymous hash of the request to estimate unique visits. We do not use Google Analytics or any advertising trackers.

How we use your data

We use the personal data you provide to:

• Respond to trial and registration enquiries
• Communicate with parents and guardians about training, matches, and club activities
• Register players with the FA, Surrey FA, and the relevant league
• Manage team rosters and match-day logistics
• Fulfil our safeguarding obligations
• Collect and reconcile subscription fees

Our legal basis for processing this data is:

• Consent - when you submit the trial enquiry or full registration form (you tick the privacy/parental-consent box)
• Contract - to provide the club membership you are signing your child up for
• Legitimate interest - to run the club, keep parents informed, and operate the website
• Vital interests - where necessary to protect the welfare of a child (safeguarding)
• Legal obligation - where required by the FA, league rules, or UK law

How we process form submissions

When you submit the trial or registration form, your data is emailed directly to the relevant team coach from our own mail server. Mail delivery is provided by SiteGround (our SMTP host) and form submissions are processed by serverless functions running on Vercel. We do not use Formspree, Typeform, or any other third-party form service. We do not store form submissions in a database - they exist only as emails in the relevant coach's inbox.

Who we share data with

We do not sell or share your personal data with third parties for marketing purposes. We share data with the following processors and authorities:

• The FA, Surrey FA and the relevant league - for player registration, league compliance, and safeguarding as required
• Vercel Inc. - our website hosting and analytics provider. Vercel processes server logs, runs our serverless functions, and provides cookieless web analytics. Vercel is US-based and operates EU edge infrastructure; transfers outside the UK are covered by the UK International Data Transfer Addendum.
• SiteGround - our email (SMTP) provider, which transmits and stores emails sent from and to the cheamsportsfc.com domain. SiteGround operates within the EU.
• Law enforcement or safeguarding authorities - if required by law or to protect the welfare of a child

Children's data

As a youth football club, we collect personal data about children (name, date of birth, school year, photograph, playing position). This data is only collected via a parent or guardian, who provides verifiable parental consent by ticking the consent box on the registration form. We take extra care to protect children's data in line with ICO guidance, the Age-Appropriate Design Code, and FA safeguarding policies. Player photographs are used only for FA registration and team identification, never for public marketing without separate written consent.

How long we keep your data

• Trial enquiries that don't lead to registration: deleted within 12 months of the enquiry.
• Active player registration data: retained for the duration of the player's involvement with the club.
• After a player leaves: deleted within 12 months, unless we are required to keep it for safeguarding, tax, or legal reasons.
• Server logs and analytics: retained by Vercel for a limited period (typically 30 days) per their standard retention policy.

Your rights

Under UK data protection law (UK GDPR), you have the right to:

• Request a copy of the personal data we hold about you or your child (subject access request)
• Ask us to correct inaccurate data
• Ask us to delete your data (where we have no legal obligation to keep it)
• Restrict or object to how we process your data
• Withdraw consent at any time (without affecting the lawfulness of prior processing)
• Lodge a complaint with the Information Commissioner's Office (ico.org.uk) if you are unhappy with how we handle your data

Cookies

This website does not set any tracking or advertising cookies, and does not use Google Analytics. Our analytics provider (Vercel Web Analytics) is cookieless. Our hosting provider may set a small number of strictly-necessary cookies for security, load balancing, and performance. If the admin area of the site is used, a single session cookie (admin_session) is set - this is strictly necessary for authentication and is only set after a successful login by a club administrator.

Security

We take the security of your data seriously. The website is served over HTTPS with HSTS; form submissions are rate-limited to prevent abuse; the admin area uses signed, httpOnly, SameSite-strict session cookies; and our Content Security Policy restricts the sources of scripts and other resources the site can load. Only a small number of club administrators and coaches have access to submitted data, and only in the course of running the club.

Contact

If you have any questions about this privacy policy or want to exercise your data rights, please contact:

Lorraine Jenkins
Cheam Sports FC
Peaches Close, Cheam, Surrey, SM2 7BJ
Email: info@cheamsportsfc.com
Phone: 07791 663913