Privacy Notice
At England Rugby Colleges, we are committed to protecting your personal information and respecting your privacy. This privacy notice explains how we collect and use personal information when you visit our website, complete a form, take part in a survey, receive communications from us, or attend one of our events. It also explains your rights under UK data protection law.Who are we?
England Rugby Colleges (ERC) is the corporate brand used by England Colleges Rugby Football Union, a company limited by guarantee and registered in England and Wales under company number 07368044.
For the purposes of UK data protection law, England Colleges Rugby Football Union is the controller of the personal information described in this notice.
Registered office:
Dewpond Cottage, Gutch Common, Shaftesbury, England, SP7 9BG
Privacy contact:
ECRFUHonsec@rfu.com
How we use your information
We only collect and use personal information where we have a clear purpose and a lawful basis for doing so. The main ways we use personal information are set out below.
Visitors to our website
When you visit our website, limited technical information may be processed by our website hosting and security services so that the site can operate securely and reliably.
With your permission, we also use Google Analytics to understand how the website is used, for example which pages are visited and how visitors move around the site. We use this information to improve our content and website experience.
Google Analytics is optional and is only enabled when you consent to analytics cookies through our cookie banner. Our lawful basis for this analytics processing is consent.
For more information about cookies, please see our Cookie Policy.
Forms and applications
We use third-party online form providers for some registrations, applications and information requests. These may include Microsoft Forms and Smartsheet.
The information we collect will depend on the form. At the point of collection, we will explain what information is required, why we need it, the lawful basis we rely on and how long it will be kept.
These providers may process personal information on our behalf and may use service providers or locations outside the UK. Where a restricted international transfer takes place, appropriate safeguards are used in accordance with UK data protection law.
Where a form relates to a person under 18, or asks for more sensitive information, we will provide any additional privacy information or permissions that are appropriate to that activity.
Surveys we undertake
We use surveys to understand issues affecting our members and the wider college rugby community, evaluate our services and communications, and help shape future activity.
We will tell you what information is being collected and how it will be used when you take part. Depending on the survey, we will normally rely on our legitimate interests in improving our services and understanding engagement, or on consent where that is more appropriate.
Retention periods will be explained where personal information is collected.
Member communications and marketing
We use member and contact details to administer ERC activities and keep colleges and relevant contacts informed about rugby opportunities, events, competitions, services and developments.
For routine membership and service communications, we may rely on our legitimate interests in administering ERC and supporting college rugby.
Where a communication is direct marketing by email, text or another electronic method, we will also comply with the Privacy and Electronic Communications Regulations (PECR). Where PECR requires consent, we will obtain consent before sending marketing. Where an applicable exception permits us to send a message without consent, we will provide a clear way to opt out.
We do not sell your personal information or share it with other organisations for their own marketing.
People who attend our events
ERC runs and supports a number of events throughout the year. Where you pre-register for an event, we may collect information such as:
- Name
- Email address
- Further Education institution or organisation
- Role or position
We use this information to administer the event, communicate with attendees, understand attendance and engagement, and request feedback so that we can improve future events. We normally rely on our legitimate interests in organising and improving ERC events, unless another lawful basis is more appropriate for a particular activity.
We will normally retain identifiable event-registration information for the season in which it is collected. If information is required for comparative analysis after that period, it will be pseudonymised and will not normally be retained for more than one further academic year.
Photography and video
We may take photographs and video footage at ERC events to document and promote our activities. We will make it clear where photography or filming is taking place and explain how images may be used.
If you do not wish to be photographed or filmed, please tell the event team or photographer. Where additional consent or permissions are appropriate, including in relation to children and young people, we will obtain them separately.
We do not use facial-recognition technology to identify people in photographs or video.
Who we share information with
We may share personal information with trusted organisations that provide services to us or support the activity for which the information was collected. These may include:- Website hosting, security and IT service providers;
- Microsoft, where Microsoft Forms or other Microsoft services are used;
- Smartsheet, where a Smartsheet form is used;
- Google, where you have consented to Google Analytics; and
- event, competition or delivery partners where sharing is necessary and has been explained to you.
International transfers
Some of our service providers operate internationally and may process personal information outside the UK. Where UK personal information is transferred to a country that is not covered by UK adequacy regulations, we rely on an appropriate transfer mechanism or safeguard required by UK data protection law.
How long we keep information
We keep personal information only for as long as it is needed for the purpose for which it was collected, including any legal, accounting or reporting requirements.
Specific retention periods are given at the point of collection where appropriate. Event-registration information is normally kept for the season in which it is collected, with any longer comparative analysis using pseudonymised information as described above.
Security and links to other websites
How we protect your information
We use appropriate technical and organisational measures to protect personal information against accidental or unlawful loss, misuse, alteration, disclosure or access. Access to personal information is limited to people and service providers who need it for the relevant purpose.
Links to other websites
Our website contains links to websites and services operated by other organisations. This privacy notice does not cover how those organisations use personal information. We encourage you to read the privacy notice of any external website or service you use.
Your rights
Under UK data protection law, you may have the following rights in relation to your personal information:
- Right to be informed – to be told how your personal information is collected and used.
- Right of access – to request a copy of personal information we hold about you.
- Right to rectification – to ask us to correct information that is inaccurate or incomplete.
- Right to erasure – to ask us to delete personal information in certain circumstances.
- Right to restriction – to ask us to restrict how we use personal information in certain circumstances.
- Right to data portability – in certain circumstances, to receive personal information you provided to us in a reusable format or ask us to transfer it to another organisation.
- Right to object – to object to certain uses of personal information, including direct marketing.
- Right to withdraw consent – where we rely on your consent, you can withdraw it at any time. This will not affect processing that took place before consent was withdrawn.
Automated decision-making and profiling
We do not currently make decisions about individuals using solely automated processing that produces legal or similarly significant effects.
To exercise any of your rights, contact us at ECRFUHonsec@rfu.com. Some rights only apply in particular circumstances, and we may need to verify your identity before responding to a request.
Questions and complaints
If you have a question about this privacy notice, how we use your personal information, or you wish to make a data protection complaint, please contact us at ECRFUHonsec@rfu.com.
We will acknowledge a data protection complaint within 30 days, investigate it appropriately, keep you informed where necessary and tell you the outcome without undue delay.
You also have the right to complain to the UK data protection regulator, the Information Commission’s Office (ICO).