Privacy Policy

We collect personal data only when you actively provide it to us — for example by completing a general contact form, submitting a schools enquiry, expressing interest in volunteering, registering an expression of interest in the Newark Rugby Academy, or making a donation through our website.

The categories of personal data we may collect include: your name; contact details (email address, telephone number); your organisation or school name where relevant; the content of messages you send us; and any additional information you choose to share with us.

Where you make a donation, payment information is processed securely by Stripe, Inc. on our behalf. We do not store, see or have access to your full card details at any point. Stripe acts as a data processor under a written data processing agreement with us.

We also collect limited technical data automatically when you visit our website, including your IP address, browser type and version, pages visited, time and date of your visit, and time spent on each page. This is collected through standard server logs and, where you have consented, through analytics tools. Technical data is used only in aggregated or anonymised form to improve the website.

We use personal data for the following purposes: to respond to your enquiries and messages; to process donations and, where applicable, to administer Gift Aid declarations in accordance with HMRC requirements; to manage volunteer applications and programme referrals; to communicate with schools and partner organisations about our education and community programmes; to send you information about our work where you have asked us to do so; and to fulfil our legal and regulatory obligations as a registered charity.

We will never sell, rent or trade your personal data to third parties for their own marketing purposes. We will not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

Under UK GDPR, we must have a lawful basis for each processing activity. We rely on the following bases:

Legitimate interests (Article 6(1)(f)) — to respond to enquiries, manage volunteer and partner relationships, and communicate with organisations about our programmes. We have carried out a legitimate interests assessment and are satisfied that our interests are not overridden by your rights and freedoms. You have the right to object to processing on this basis at any time.

Contract performance (Article 6(1)(b)) — to process donations and fulfil any agreement we have entered into with you, including the provision of a donation receipt or acknowledgement.

Legal obligation (Article 6(1)(c)) — to comply with charity law, HMRC Gift Aid requirements, safeguarding obligations and other regulatory duties.

Consent (Article 6(1)(a)) — where we send you marketing or newsletter communications, we will ask for your explicit, freely given consent first. You may withdraw consent at any time by contacting us or using the unsubscribe link in any communication. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Our website uses cookies and similar technologies to help the site function and to understand how visitors use it. When you first visit our website, you will be presented with a cookie consent banner that allows you to accept or decline non-essential cookies. You can change your preferences at any time — see our Cookie Policy for details.

Strictly necessary cookies are required for the website to operate and are set without your consent. These include session management and security cookies that protect the integrity of the site.

We use a platform analytics service to understand how visitors interact with our site. This service loads on all pages; however, click-level data collection is gated on your consent. If you decline cookies, click events are not recorded. Your consent choice is stored locally on your device for 365 days. You may withdraw consent at any time by visiting our Cookie Policy page and clicking 'Manage preferences'.

We do not use advertising or tracking cookies, and we do not share cookie data with third parties for marketing purposes.

We share personal data only where necessary to deliver our services or meet legal requirements. Our third-party processors include: Stripe, Inc. (payment processing); our website hosting provider; and our inbox and messaging platform. All processors are engaged under written data processing agreements and are contractually required to handle data securely and in accordance with UK GDPR.

We may disclose personal data to statutory authorities — including the police, local authority safeguarding teams, or the Charity Commission — where we are legally required to do so, or where disclosure is necessary to protect the safety of a child or vulnerable adult. In such cases, disclosure may be made without your consent.

We do not transfer your personal data outside the United Kingdom or the European Economic Area, except where a processor (such as Stripe) operates internationally. Where such transfers occur, we ensure that appropriate safeguards are in place, such as the UK International Data Transfer Agreement or adequacy decisions, in accordance with Chapter V of UK GDPR.

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law. Our standard retention periods are as follows:

General enquiries and contact form submissions: up to 2 years from the date of last contact.

Donation records and Gift Aid declarations: 7 years from the end of the relevant tax year, in line with HMRC requirements.

Volunteer records: for the duration of the volunteer relationship and for up to 6 years thereafter, in line with the Limitation Act 1980.

School and programme enquiries: up to 3 years from the date of last contact, or as required by our safeguarding obligations.

When data is no longer required, it is securely deleted or irreversibly anonymised. We review our data holdings annually.

Under UK GDPR, you have the following rights in relation to your personal data:

Right of access — you may request a copy of the personal data we hold about you (a Subject Access Request). We will respond within one calendar month.

Right to rectification — you may ask us to correct inaccurate or incomplete personal data.

Right to erasure — you may ask us to delete your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where you object to processing and we have no overriding legitimate grounds.

Right to restriction — you may ask us to restrict processing of your data in certain circumstances, for example while we investigate a complaint.

Right to data portability — where processing is based on consent or contract and is carried out by automated means, you may ask us to provide your data in a structured, commonly used and machine-readable format.

Right to object — you may object at any time to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Rights related to automated decision-making — you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not carry out such processing.

To exercise any of these rights, please contact us using the details below. We will respond within one calendar month. There is no charge for exercising your rights, unless a request is manifestly unfounded or excessive.

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or disclosure. Our website is served exclusively over HTTPS with TLS encryption. Payment data is handled exclusively by Stripe, which is certified to PCI DSS Level 1 — the highest level of payment security certification.

Access to personal data within our organisation is restricted on a need-to-know basis. We review our security measures regularly and update them in line with current best practice.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay where required.

Our programmes work with children and young people. Where we process personal data relating to children under the age of 18, we do so in accordance with our Safeguarding Policy and only where we have a lawful basis to do so — typically legal obligation or legitimate interests in the context of programme delivery.

We do not knowingly collect personal data directly from children through this website. Enquiries relating to children's participation in our programmes should be made by a parent, guardian or authorised school representative.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or other factors. The date at the top of this page shows when it was last revised. Where changes are material, we will take reasonable steps to bring them to your attention. We encourage you to review this page periodically.