Army Rugby Union Privacy Policy
Privacy Notice Version: 1.0
Effective Date: 19th June 2026
Last Reviewed: 19th June 2026
The contact details for the Army Sport Data Protection Manager (DPM) are:
Data Protection Manager
Army Sport
Mackenzie Building
Fox Lines
Queens Avenue
Aldershot
GU11 2LB
Data Controller
For the purposes of UK data protection legislation, Army Sport is the Data Controller for personal data processed in connection with Army Rugby Union activities.
Army Rugby Union (ARU) operates as part of Army Sport and is responsible for administering rugby union activity and handling personal data for those purposes.
This Privacy Notice explains how ARU, as part of Army Sport, collects, uses, stores and protects personal data when you:
- use the ARU website
- register for events
- participate in matches and competitions
- officiate, coach or volunteer
- support ARU activities
ARU is committed to protecting your privacy and processing personal data fairly, lawfully and transparently in accordance with:
- the UK General Data Protection Regulation (UK GDPR)
- the Data Protection Act 2018
- and, where applicable, the Privacy and Electronic Communications Regulations (PECR)
Please note that where you do not provide information that is necessary for event administration, eligibility checks, or essential communication, we may be unable to administer or support your participation in ARU activities and events.
What Personal Data We Collect
Players
- Name, rank, service number
- Age
- Contact details (email, phone number)
- Unit and service information
- Selection, performance and match data
Staff, Officials and Volunteers
- Name, rank and contact details
- Role and qualifications
- Appointment history
- Safeguarding and compliance information
Members and Supporters
- Name and contact details
- Ticketing and event attendance records
- Payment records (invoices and bank transfers only — no card data is collected or stored)
How We Use Your Information
We use your personal data for the following purposes:
| Purpose | Examples |
| Administration of rugby activities | Team selection, fixtures, competitions |
| Communication | Match details, updates, announcements |
| Welfare and safety | Injury management, safeguarding |
| Governance and discipline | Conduct, eligibility, compliance |
| Event management | Ticketing, attendance tracking |
| Financial administration | Issuing invoices and recording payments |
Photography, Videography and Media
The ARU may take photographs and video recordings during matches, training sessions and events for sporting, promotional, historical and administrative purposes.
These may be published through ARU, Army Sport, Ministry of Defence (MOD) and governing body communication channels.
We take reasonable steps to ensure that imagery is used appropriately and respectfully.
Individuals may raise concerns regarding specific uses of imagery by contacting ARU.
Automated Decision Making
The ARU does not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.
All decisions relating to participation, selection, discipline and administration are made with appropriate human involvement.
Lawful Basis for Processing
We rely on the following lawful bases when processing your personal data:
| Purpose | Lawful Basis |
| Participation in rugby activities | Contract |
| Administration and organisation | Legitimate interests |
| Welfare and safeguarding | Legal obligation / substantial public interest |
| Medical data (injury etc.) | Explicit consent |
| Discipline and governance | Legal obligation |
| Communications | Legitimate interests |
| Financial processing (invoices & payments) | Contract |
Sharing Your Information
We may share your personal data with relevant organisations where necessary for the administration and operation of ARU activities. These include:
- Rugby Football Union (RFU), including use of the Game Management System (GMS)
- Army Sport / Ministry of Defence
- Competition organisers and governing bodies
- Match officials and disciplinary bodies
- Medical professionals (where required for welfare and safety)
We also use approved third-party platforms to support communication, team management and file sharing.
These include:
- Spond (team and membership management)
- WhatsApp (communication)
- Dropbox and Google Drive (document storage and sharing)
Use of WhatsApp is limited to operational communication, and individuals should be aware of their own privacy settings when using the platform.
Some information processed by ARU may constitute special category personal data under UK GDPR. This includes health, injury and safeguarding information, where necessary to protect participants, meet safeguarding responsibilities and ensure the safe administration of rugby activities.
All data sharing is limited to what is necessary and proportionate, and we take steps to ensure that personal data is handled securely and in accordance with data protection legislation.
Disclosure and Control of Your Information
We will only use your personal data for the purposes for which it was collected and in line with this Privacy Notice.
Where processing is based on your consent, you have the right to withdraw that consent at any time, where applicable.
The ARU does not sell or use personal data for third-party marketing purposes.
Security
We take appropriate technical and organisational measures to protect your data against:
- Unauthorised access
- Loss or misuse
- Disclosure or alteration
How We Use Cookies
The ARU website may use cookies to improve user experience and monitor website performance.
Cookies are small text files stored on your device that help us:
- Understand how the website is used
- Improve functionality and performance
You can control or disable cookies through your browser settings.
Links to Other Websites
Our website may contain links to external websites.
This Privacy Notice applies only to ARU. We are not responsible for the privacy practices of other organisations, and we encourage you to read their privacy policies when visiting external sites.
Where We Store Your Personal Data
Personal data is stored securely within Army Sport and ARU systems, including approved digital platforms and secure storage environments.
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or disclosure.
Where third-party platforms such as Spond, WhatsApp, Dropbox or Google Drive are used, these providers may store data outside MOD systems.
Where this occurs, we use reputable providers and take reasonable steps to ensure that personal data is handled securely and in line with UK data protection requirements.
The transmission of information via the internet is not completely secure. While we take all reasonable steps to protect personal data, any data transmitted electronically is done so at the individual’s own risk. Once received, we apply appropriate security measures to safeguard it.
How Long We Keep Your Information
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected and in line with applicable organisational records management practices.
Retention periods vary depending on the type of information and may include:
- Membership and participation records
- Competition and disciplinary records
- Financial records
- Safeguarding records
- Medical and injury information
Further detail on specific retention periods is set out in the Army Rugby Union Retention Schedule.
Where information is no longer required, it will be securely deleted or anonymised.
Access to Information
You have the right to request a copy of the information we hold about you.
This is commonly known as a Subject Access Request (SAR).
Subject Access Requests may be submitted verbally or in writing using the contact details provided in this notice. We will respond in accordance with applicable data protection laws.
Your Rights Under Data Protection Law
Under UK GDPR, you have the right to:
- Access your personal data
- Request correction of inaccurate or incomplete data
- Request deletion of your data (where applicable)
- Restrict processing of your data
- Object to processing based on legitimate interests
- Request transfer of your data (data portability, where applicable)
These rights are subject to certain exemptions depending on the nature of the data and processing.
Your Right to Complain
If you are dissatisfied with how your personal information has been handled, you should raise your concern with Army Sport in the first instance via the ARU COO. Army Sport will acknowledge receipt of a data protection complaint within 30 days, make appropriate enquiries, keep you informed of progress as required and provide an outcome without undue delay.
If you remain dissatisfied after Army Sport has responded, or if you consider that your concern has not been resolved within a reasonable period, you may then complain to the Information Commissioner’s Office (ICO).
You can contact the ICO at:
Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Website: https://www.ico.org.uk
We would, however, encourage you to contact us first so we can attempt to resolve your concern.
Changes to this Notice
We may update this Privacy Notice from time to time to reflect changes in legal requirements or how we operate.
The most current version will always be available, and we recommend reviewing it periodically.
Contact
If you have any questions about this Privacy Notice or how your data is handled, please contact:
Chief Operations Officer
Army Rugby Union
Mackenzie Building
Fox Lines
Queens Avenue
Aldershot
GU11 2LB
