Privacy & Data Protection Notice

Prestbury Girls Academy ("the Academy", "we", "us" or "our") is committed to protecting the privacy, dignity and personal information of players, parents and carers, staff, volunteers, supporters, visitors and users of our digital services.

This Notice explains how we collect, use, share, store and protect personal information under UK data-protection law, including the UK GDPR, Data Protection Act 2018 and relevant amendments introduced by the Data (Use and Access) Act 2025.

1. Who We Are and the Services Covered

Data Controller: Prestbury Girls Academy

Email: ian@prestburyacademy.co.uk

This Notice applies across our connected websites, portals and digital services, including:

• prestburyacademy.co.uk – our principal organisational and Academy communications domain
• prestburygirls.co.uk – our Academy website and player, parent, staff and member services
• prestburytour.co.uk – tour information, bookings, participants, payments and tour administration
• prestbury.app – fundraising, events, campaigns, tickets and related Academy digital services
• associated secure links, portals, booking systems, medical systems, finance tools and administrative applications operated by the Academy

2. Information We Collect

3. How We Use Personal Information

• Deliver coaching, football development, fixtures, competitions and Academy services
• Manage registrations, memberships, trials, selection processes and player onboarding
• Provide player development, reviews, S&C, performance analysis and video feedback
• Support health, injury management, physiotherapy, rehabilitation and safe return to play
• Protect welfare, respond to safeguarding concerns and meet safeguarding responsibilities
• Communicate with players, parents, carers, staff, volunteers and supporters
• Manage tours, travel, accommodation, consent, emergency planning and participant safety
• Operate fundraising, event, sponsorship and campaign services
• Process, reconcile and account for payments, refunds, fundraising credits and financial records
• Operate secure digital services, prevent misuse, investigate incidents and maintain audit trails
• Comply with legal, regulatory, football-governance and insurance requirements

4. Lawful Bases for Processing

The lawful basis depends on the purpose. We do not rely on one blanket basis for every activity. We may rely on:

• Contract – where processing is necessary to provide a service, booking or membership arrangement
• Legal obligation – where the law requires us to use or retain information
• Legitimate interests – where necessary for proportionate Academy administration, safety, communications, development or service improvement and those interests are not overridden by the individual’s rights
• Recognised legitimate interests – where the statutory criteria apply, including certain safeguarding and emergency purposes
• Consent – where a genuine choice is appropriate, including particular publicity, media or optional uses
• Vital interests – where necessary to protect someone’s life in an emergency

Where we process health or other special category information, we also identify an appropriate UK GDPR Article 9 condition. Depending on the circumstances this may include explicit consent, vital interests, safeguarding/substantial public interest conditions, or health-care related processing where the legal conditions are met.

5. Health, Medical Notes and Confidentiality

Medical information is subject to additional access controls. Access is limited according to role and need.

• Authorised Medical/Physio personnel may create Internal Only Medical Notes
• Internal Only notes are not automatically visible to parents or players
• A note may be deliberately marked for sharing with a parent, a player, or both
• Saving a Medical Note does not itself make the note public or visible outside the authorised medical workflow
• Medical and welfare information is not used for unrelated promotional or commercial purposes

6. Photography, Video, Veo and Social Media

We may record selected matches, training sessions, Academy events and tours. Recording for coaching and performance analysis is separate from public media publication.

• Veo and similar systems may be used for tactical, technical and team-development analysis
• Recording for analysis does not automatically authorise publication on social media
• Where appropriate permission exists, selected content may be published through YouTube, Facebook, Instagram, TikTok and Academy websites
• Public youth lineup and match graphics use first name plus surname initial by default
• We do not normally publish unnecessary identifying information such as a child’s home address, school or date of birth
• We avoid publishing content that humiliates, shames, exploits or unnecessarily exposes a child

Please also see our Photography, Filming & Video Recording Policy.

7. Artificial Intelligence Assisted Tools

Some Academy systems use AI-assisted tools to help authorised staff draft, summarise, organise or review information.

• AI may support player-development reviews, coaching documentation and authorised medical workflows
• AI output is treated as assistance and must be reviewed by an authorised person before it is relied upon as an official record
• We do not use AI to make a solely automated significant decision about team selection, release, medical clearance, safeguarding outcomes or disciplinary action
• Access to underlying personal information remains subject to the same role and confidentiality controls as the rest of the system

8. Who We Share Information With

We share information only where it is reasonably necessary, lawful and proportionate. Recipients may include:

• Parents, carers and players according to the relevant access and sharing rules
• Authorised coaches, Academy staff, welfare personnel, medical/physio personnel and administrators
• The Football Association, County FA, leagues and competition organisers where required
• Healthcare professionals, emergency services and insurers where necessary
• Transport, accommodation, tournament and activity providers for tours
• Payment providers such as PayPal
• Fundraising providers such as RallyUp where used
• Technology and hosting providers supporting our systems
• Veo for approved performance-analysis use
• YouTube, Meta services (Facebook and Instagram), TikTok and other publication platforms when content is deliberately published
• Professional advisers, regulators or authorities where required by law or necessary to protect rights and safety

Some external providers act as processors for us; others may act as independent controllers for parts of their service. Their own privacy information may also apply.

9. International Transfers

Some technology, payment, video, fundraising or social-media providers may process information outside the UK. Where UK data-protection law requires safeguards for an international transfer, we take reasonable steps to ensure an appropriate transfer mechanism or other lawful safeguard is in place.

10. Retention

We keep information only for as long as necessary for the purpose for which it was collected, taking account of legal, safeguarding, insurance, accounting and evidential requirements.

• Financial and transaction records may be retained for statutory accounting/tax periods
• Safeguarding records are retained in accordance with safeguarding and legal requirements
• Medical and welfare retention is governed by the Academy’s approved retention arrangements and any legal hold
• Ordinary coaching/video-analysis footage is normally deleted when no longer useful and, as a Prestbury standard, ordinarily within 12 months unless a documented safeguarding, disciplinary, complaint, legal or evidential reason requires longer retention
• Operational audit and security records are retained for a proportionate period based on their purpose and risk
• Where deletion is not appropriate, information may be archived, restricted or anonymised

11. Children's Information

A substantial proportion of the information we process relates to children and young people. Children merit particular protection when their information is used.

• We consider the child’s age, understanding, dignity, safety and best interests
• We provide information and choices in a way that is appropriate to the audience
• Where appropriate, information or permission may be obtained from a parent or carer
• A child’s data-protection rights do not automatically belong to the parent; how a request is handled depends on age, understanding, circumstances and applicable law
• We do not promise deletion where we have a lawful reason to retain an official, safeguarding, medical, financial or evidential record

A shorter Child-Friendly Privacy Notice is also available.

12. Your Information Rights

Depending on the circumstances, you may have rights to:

• Access personal information
• Correct inaccurate or incomplete information
• Request erasure where the legal conditions are met
• Restrict processing
• Object to certain processing
• Receive certain information in a portable format
• Withdraw consent where processing relies on consent
• Raise concerns about solely automated significant decisions

These rights are not absolute and may be limited where another lawful requirement applies.

13. Data Protection Complaints

You can complain to us about how personal information has been collected, used, shared, secured, retained or otherwise handled.

• Data protection/privacy is available as a complaint category in our Complaints Procedure
• We aim to acknowledge formal complaints within 5 working days
• We will investigate appropriately and communicate the outcome
• You may also complain to the Information Commissioner’s Office (ICO)

Use our Complaints Procedure or contact us directly.

14. Cookies and Storage Technologies

Our websites and applications use cookies and other storage/access technologies, including localStorage and sessionStorage, for authentication, security, preferences, drafts and service functionality. See our Cookie & Storage Technology Policy.

15. Security

• Role-based access and permissions
• Restricted access to medical, welfare and confidential information
• Audit logging of sensitive actions
• Secure authentication and protected workflows
• Encrypted transmission where supported by the service
• Access reviews, incident investigation and security monitoring where appropriate

16. Changes to This Notice

We may update this Notice when our services, technology or legal obligations change. Material changes will be communicated where appropriate. The current version and last-updated date will be published on our website.