On 25th May 2018, EU data regulations are changing and there have been some changes to our platform for LeagueRepublic to comply.
This document details the changes that have been made to our system and shows responsibilities fall between LeagueRepublic and leagues for GDPR.
1/ LeagueRepublic Terms and Conditions https://www.leaguerepublic.com/terms.html
Our terms and conditions have changed requiring all leagues who use LeagueRepublic within the EU to be GDPR compliant.
The terms have be changed to state that leagues be responsible for managing the “individual rights” of the individuals they are keeping data for in their leagues.
Users are not permitted to have an account on LeagueRepublic i.e. a login / sign-in unless they are 16 years old or over.
2/ LeagueRepublic Privacy Policyhttps://www.leaguerepublic.com/privacy.html
Our privacy policy has changed to explain what personal information we hold about a user with a LeagueRepublic login and what we do with that information.
In short LeagueRepublic holds the following data on an individual
- Name
- Email Address
- Encrypted Login Credentials
- Support Questions History
And this information is held for LeagueRepublic as the “Controller” for the purposes of
- Allowing the user to sign into the LeagueRepublic system
- Provide them with a support platform for user chat / support.
This data is passed to the following external systems
- Intercom (chat platform) for customer support
- Stripe to manage any payments
We do not pass this information to anyone else for marketing or any other purpose so there will not be an opt in for any additional options.
As a processor LeagueRepublic holds personal data of league members on behalf of leagues who do not have a LeagueRepublic account. A league admin for example can create a player who won’t have a LeagueRepublic sign in.
LeagueRepublic will not use the following personal data of league members collected by leagues for any purpose
- Date Of Birth
- League Reference Numbers
- Address
The following personal data
- Email address
- Mobile Phone Number
will be used by the system for league members without logins for email notifications (after an opt in) and results SMS message prompts. It will not be used for marketing purposes.
3/ Leagues are controllers for the purposes of GDPR
A league may use many systems to manage their sport league and personal details about their members can cross many systems, some of which may be paper or spreadsheet based. For the purposes of GBPR a league is a “Controller” of this information and if it resides in the LeagueRepublic system then LeagueRepublic is a “Processor” of this information.
Leagues use LeagueRepublic to manage their day to day activities including
- Scheduling
- Results management
- Statistics management
- People management for administrators, referees and players
Personal data will be held about the people in the league within LeagueRepublic will be as a minimum
Name
And optionally
- Email Address
- Date Of Birth
- League Reference Numbers
- Telephone contact details
- Address
4/ What tools will LeagueRepublic provide to leagues?
a/ League’s own privacy policy
You can upload your own privacy policy under “Site Builder Documents”. In here you can state how and what personal data you collect and how you store, what you do with it i.e. your purpose and which 3rd parties you share the data with.
b/ Leagues must comply with the new GDPR “Individual Rights”
Right to be informed
This can be implemented as a league’s privacy policy.
If the league uses the player registration system then consent will be able to granted to a league’s terms / privacy document.
Right of access
Individuals have a right to access their personal data. LeagueRepublic will be provide a screen detailing personal information and related league sports data about an individual which a league can give to that individual.
Right to rectification
All data relating to an individual can be corrected by any League Administrator for a league.
Right to erasure
We will be provide the tools to completely erase a person in your league. There will not be a way to revert this. All personal data will be deleted and the player or person will have a first name and last anonomised.
Right to restrict process
We will provide the tools to restrict processing of an individual. Their personal details will not be viewable within the admin or the sites and first name and last name will be anonomised.