Who is responsible for your information?
Wanstead Rugby Football Club Limited (company number 07883999) is responsible for club, membership, ticket, donation and Gift Aid information. Centenary Field Limited (company number 16735127) is responsible for Centenary Field venue-hire information. Both have their registered office at Wanstead Rugby Football Club, Centenary Field, Roding Lane North, Woodford Green, IG8 8JY.
For club privacy matters email secretary@wansteadrfc.com. For venue-hire matters email hallhire@wansteadrfc.com.
What this notice covers
This notice covers www.wansteadrfc.com, donations.wansteadrfc.com, shop.wansteadrfc.com and centenaryfield.com. Services operated by other organisations, including RFU GMS, Square, Microsoft, Google, Meta/WhatsApp and the external club kit shop, also have their own privacy information.
Information we collect
- Club and membership enquiries: your name, contact details and the information you choose to include in an email, telephone call or message. Membership registration is handled through RFU GMS.
- Donations and Gift Aid: your name, email address, donation amount and payment references. If you claim Gift Aid, we also collect your title where supplied, home address, postcode, declaration, confirmation and submission date.
- Tickets and activities: purchaser name, email address, optional phone number, selected products and payment/order references. Where an activity needs participant information, we may collect a child’s name, age or school year, and medical or collection notes supplied by their parent or guardian.
- Hall-hire enquiries and bookings: your name, contact details, event information, Square invoice and booking references, and information you send by email, phone or WhatsApp. The public availability calendar shows booking status, not customer identities.
- Hall-hire security checks: for confirmed bookings we may collect an image of the responsible hirer’s UK photocard driving licence or passport identity page; the document type and readable holder name; the result and confidence of an automated first-pass check; the staff review decision; the card-hold authorisation reference and status; and security audit timestamps. We do not receive or store the full card number.
- Technical information: server security logs may record IP address, browser details, requested pages and timestamps. The secure hall-hire link is a high-entropy bearer link and must not be shared with anyone other than the responsible hirer.
Wanstead RFC does not receive or store full card numbers. Card entry and payment processing are provided by Square.
Why we use it and our lawful bases
- To take payments, provide tickets or activities, manage bookings and respond to service enquiries where this is necessary for a contract or steps requested before a contract.
- To maintain accounting, tax and Gift Aid records and respond to regulators where required by law.
- To run the club, safeguard participants, prevent fraud, secure the websites and answer general enquiries where this is in the club’s legitimate interests and does not override your rights.
- For hall hire, to verify that the responsible hirer matches the booking, deter impersonation, fraud and deliberate misuse of the venue, protect the venue, staff, members and other customers, and enforce the hire conditions. We rely on Centenary Field Limited’s legitimate interests and, where relevant, performance of the hire contract. The automated document check is advisory: it does not establish authenticity or make the final decision, and a restricted staff review remains required.
- To use optional analytics or advertising cookies where you have given consent. You can withdraw that consent at any time using “Cookie settings” on the Centenary Field website.
- To protect someone’s vital interests in an emergency, for example where medical notes supplied for a child’s activity are needed by authorised organisers.
Who we share information with
Access within the club is limited to people who need the information for their role. Depending on the service, information may also be processed by:
- Square for orders, card payments and receipts;
- Microsoft 365 for club email and transactional messages;
- the Rugby Football Union and RFU GMS for membership administration;
- Google for the restricted hall-hire document first-pass model check and, where enabled, public reviews or maps, and Vimeo for venue video;
- Meta/WhatsApp when you choose to contact the venue through WhatsApp;
- hosting, security, backup and IT support providers acting for the club; and
- HM Revenue & Customs, governing bodies, insurers, professional advisers, police or other authorities where the law or a safeguarding need requires it.
Some providers may process information outside the UK. Where UK data protection law requires safeguards, we rely on the provider’s applicable UK adequacy arrangements, recognised transfer mechanism or contractual safeguards.
Hall-hire security decisions
The image model checks only whether the image appears to show a supported identity document, whether a readable name matches the booking, and whether the image is clear enough for review. It does not establish that a document is genuine or legally valid. A warning does not automatically reject the booking, and the model does not decide whether money is taken. Restricted staff carry out the required human review. A temporary card hold is not a payment; money may be taken only where the hire conditions have been breached and the documented costs are due under the hire agreement.
How long we keep information
- Gift Aid declarations: normally six years after the most recent donation covered by the declaration. Enduring declarations may be kept while they remain active and for the required period afterwards.
- Orders, payments and accounting records: normally six years after the end of the relevant accounting period.
- Participant and medical notes: normally deleted within three months after the activity, unless an incident, safeguarding issue, insurance claim or legal requirement means they must be kept longer.
- General enquiries: normally up to two years after the last meaningful contact, unless the enquiry becomes part of a booking, membership or legal record.
- Hall-hire identity images and detailed model-check data: normally deleted seven days after the event. If an incident, complaint, charge, insurance matter or legal claim is open, the relevant information may be retained until the matter and any applicable claim period are resolved.
- Hall-hire security audit and booking/payment records: limited status, timestamps, reviewer and authorisation records may be retained with the booking record for up to six years where reasonably needed for accounting, disputes, fraud prevention or legal claims.
- Failed payment and security records: kept only for the period reasonably needed to investigate errors, fraud or attacks.
Copies may remain in restricted backups until those backups are securely overwritten.
Your rights
Depending on the circumstances, you may have rights to access, correct or erase your information; restrict or object to its use; receive certain information in a portable form; and withdraw consent. These rights are not absolute—for example, the club may need to retain Gift Aid or accounting records required by law.
Your right to object: you may object to processing based on legitimate interests. Tell us why you object and we will review the circumstances.
To exercise a right, withdraw a Gift Aid declaration, or ask a privacy question, email secretary@wansteadrfc.com. For a Centenary Field venue-hire request, you can also email hallhire@wansteadrfc.com. We may need to confirm your identity before disclosing personal information.
Cookies and similar technologies
The main club website does not currently use analytics cookies. The donations and ticket sites use essential technologies needed for secure Square card entry and checkout.
The Hall Security page uses browser session storage to keep its secure link available in the current tab after removing it from the address bar. It is cleared after successful completion or an invalid request. Square may use technologies that are strictly necessary to provide secure card entry and authorisation. Your browser can delete stored site data.
Complaints and changes
Please contact the club first so we can try to resolve your concern. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or telephone 0303 123 1113.
We will review this notice when services or legal requirements change. The current version and update date will be published on this page.