This Privacy Notice explains how Phoenix Sports Academy collects, uses, stores, shares and protects personal information belonging to the children, young people, parents, guardians and adults who take part in, or are connected with, our football, rugby, cricket, athletics and multi-sport programmes.
We know that a large part of the information we hold relates to children, and that parents and guardians need to trust us with it. This notice has been written with that in mind — we've tried to keep it clear and in plain English, while still meeting our obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
Phoenix Sports Academy is the trading name of Phoenix Sports Academy Ltd, a company registered in England and Wales (company registration number 17356826).
For the purposes of the UK GDPR, Phoenix Sports Academy is the "data controller" of the personal information described in this notice. This means we decide why and how your (or your child's) personal information is processed.
Where this notice refers to "we", "us" or "the Academy", it means Phoenix Sports Academy. Where it refers to "you", this includes players, parents, guardians, coaches, volunteers and other adults connected with the Academy, unless the context says otherwise.
2. Who This Notice Covers
This notice applies to information we collect through:
- Player and parent/guardian registration forms (paper or online)
- Attendance at our sessions, camps, trials and events, across any sport we run
- Our website, social media pages and any booking or communication platforms we use
- Correspondence with us by email, text or in person
- Feedback forms completed by parents, players, schools or facility partners
- Partnerships with schools, leisure centres and other host venues
It sits alongside our Safeguarding Policy and Code of Conduct, which explain how we keep children safe, and our Cookie Policy, which explains how our website uses cookies.
3. The Information We Collect
3.1 From Players, Parents and Guardians
When you register a child (or yourself, for adult programmes) with Phoenix Sports Academy, we typically collect:
- Player's full name, date of birth and gender
- Parent/guardian name(s), address and email address
- Emergency contact details
- Medical information relevant to participation in sport, such as allergies, medical conditions, medication or additional needs (see section 4 below on special category data)
- School attended and, where relevant, funding route information (e.g. self-funded or funded places)
- Photographs and video footage taken during sessions, camps and events (see section 6)
- Signed consents and declarations, including your signature on the registration form
3.2 From Coaches, Staff and Volunteers
For anyone joining the Academy in a coaching, staffing or volunteer capacity, we collect personal and contact details, DBS (Disclosure and Barring Service) check status and certificate information, safeguarding training records, qualifications and any further information relevant to their role.
3.3 Collected Automatically or From Other Sources
If you interact with our website or social media channels, we (or the platforms themselves) may automatically collect technical information such as IP address, browser type and cookie data — see our Cookie Policy for details. We may also receive limited contact details from schools, leisure centres or facility partners who refer a child to us, or from feedback and enquiry forms.
4. Medical and Health Information (Special Category Data)
Information about a player's health, medical conditions or disability is treated by law as "special category data" and requires extra protection. We only collect this where it is necessary to keep children safe during sport — for example, to plan for allergies, asthma, epilepsy or other conditions our coaches need to be aware of in an emergency.
We rely on your explicit consent, given on the registration form, to collect and hold this information. This information is shared only with coaches and first-aiders who need it to safely supervise the player, and is reviewed and updated whenever you tell us something has changed.
5. Why We Use Your Information and Our Legal Basis
Data protection law requires us to have a valid reason ("legal basis") for using personal information. Depending on the purpose, we rely on:
- Contract – to register a player, deliver sessions, and manage bookings and payments
- Legal obligation – to meet safeguarding, health and safety, and record-keeping duties, and to comply with DBS and coaching-qualification requirements
- Legitimate interests – to run a safe, well-organised academy, including maintaining attendance and retention records, improving our programmes based on feedback, and reporting (in anonymised or aggregated form) to funders or partner organisations
- Consent – for medical information, photography and video use, and any marketing communications; you can withdraw consent at any time (see section 12)
We will never use your information for a purpose that is incompatible with the reasons it was collected without telling you first and, where required, asking for your consent.
6. Photography and Video
From time to time we take photographs and video of players during sessions, camps and events, which we may use to promote the Academy — for example on our website, social media, in newsletters or in materials for schools and funding partners.
We ask for your explicit consent to this on the registration form. You can withdraw this consent at any time by contacting us (see section 13), and we will stop using new images of your child from that point onward and remove existing images where reasonably practicable. We do not include a child's full name alongside their image in public-facing materials without separate agreement from a parent or guardian.
7. Children's Privacy
Many of the individuals we hold information about are children. Because children may not fully understand the risks of sharing personal data, we:
- Collect consent from a parent or guardian, rather than the child, for registration, medical information and photography/video
- Limit what we collect to what is genuinely needed to run the programme safely
- Do not use children's data for marketing communications directed at the child themselves
- Give parents and guardians control over their child's information, including the right to review, correct or ask us to delete it (see section 12)
If you believe we have collected information about a child without appropriate parental consent, please contact us immediately using the details in section 13.
8. Who We Share Your Information With
We do not sell personal information, and we do not share it with third parties for their own marketing purposes. We do share limited information, only where necessary, with:
- Our coaches, staff and volunteers – to safely deliver sessions and respond to medical or welfare needs
- Host venues and partners – such as schools, leisure centres and facility providers, who may need attendance lists or basic contact details for site access and safety purposes
- Payment providers – to process registration fees and other payments securely; we do not store full card details ourselves
- Emergency services and medical professionals – if needed to respond to an injury or emergency
- Local authorities, funding bodies or governing bodies of sport – typically in anonymised or aggregated form, for example to report on programme reach or safeguarding compliance
- Professional advisers and regulators – such as our insurers, auditors or the Information Commissioner's Office, where we are legally required to
Where we use third-party service providers (for example, booking software or cloud storage), we only share what is necessary for them to provide their service, and we require them to keep information secure and use it only for the purposes we specify.
9. Where We Store Your Information
We store personal information in line with UK data protection law (UK GDPR), and we keep it within the UK and European Economic Area (EEA) wherever possible.
Information you provide to us may, in some cases, be transferred to and stored in a country outside the UK and EEA — for example, if any of our servers or those of our third-party service providers are, from time to time, located outside the UK or EEA. These countries may not have data protection laws equivalent to the UK's. Where this happens, we will use reasonable endeavours to ensure appropriate safeguards are in place, so that your information continues to be protected to a standard consistent with UK GDPR.
10. How Long We Keep Your Information
We only keep personal information for as long as necessary for the purposes set out in this notice. As a general guide:
- Registration and medical information is kept for the duration of a player's involvement with the Academy, and for a limited period afterwards in case of a safeguarding concern, insurance claim or dispute
- Attendance and retention records are kept in line with our internal record-keeping schedule
- DBS and safeguarding records for staff/volunteers are retained in line with statutory guidance
- Financial records are kept for as long as required by HMRC and other legal obligations
Specific retention periods for each category of information are set out in our internal Data Retention Schedule, available on request from phoenixsportsacademyuk+
11. Keeping Your Information Secure
We take the security of personal information seriously and apply appropriate technical and organisational measures to protect it, including:
- Password-protected digital systems, with access limited to those who need it to do their role
- Restricted, need-to-know access to medical and safeguarding records
- Secure storage of paper records, with controlled access
- A confidentiality expectation placed on all coaches, staff and volunteers who handle personal information
We review who has access to personal information as roles change, and we have a process in place to respond promptly and appropriately if we ever became aware of a data breach, including notifying affected individuals where necessary. That said, no method of transmission or storage is completely secure, and we cannot guarantee absolute security of information sent to us — for example, by email.
12. Your Rights
As a parent, guardian or adult participant, you have a number of rights over the personal information we hold. You can:
- Access a copy of the information we hold about you or your child
- Ask us to correct inaccurate or incomplete information
- Ask us to delete information, where we don't have a legal reason to keep it
- Ask us to restrict how we use your information while a concern is investigated
- Object to us using your information for certain purposes, including direct marketing
- Withdraw consent at any time, for example for photography/video or medical data — this won't affect anything we did before you withdrew it
- Ask for your information to be provided in a portable format, in limited circumstances
To exercise any of these rights, please contact us using the details in section 13. We will normally respond within one month.
13. Contacting Us
If you have any questions about this notice or how we handle personal information, or you would like to exercise any of your rights, please contact:
Welfare & Data Protection Officer, Phoenix Sports Academy
Email: phoenixsportsacademyuk+
If you're not happy with how we've handled your information, you also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at www.ico.org.uk or by calling 0303 123 1113.
14. Changes to This Notice
We may update this notice from time to time, for example as the Academy grows or as our practices change. Where we make significant changes, we will let parents and guardians know directly (for example by email) rather than relying only on an updated notice being posted on our website. We recommend checking this page occasionally.