Basketball England Privacy and Data Protection Policy

Updated: August 2025

Introduction

Basketball England respects your privacy and is committed to protecting your personal data. This privacy policy will inform you on how we look after your personal data and tell you about your privacy rights and how the law protects you.

If you are under 13 please get your parent/guardian’s permission before you provide any personal information to us.

Basketball England is committed to protecting and respecting your privacy and complying with the principles of applicable data protection laws: the UK General Data Protection Regulation (GDPR), the Data Protection Act (2018), and other laws that may come into effect to regulate the use of personal data.

The Basketball England, NSC. Gate 13. Etihad Campus. Rowsley St. Manchester. M11 3FF is the data controller of personal data referred to in this policy.

Whilst many elements of this policy pertain and reference digital means and methods of collecting or processing personal data, this policy also applies to information in all forms, including but not limited to:

• Hard copy or documents printed or written on paper;
• Information or data stored electronically, including scanned images;
• Communications sent by post/courier or using electronic means such as email,
• Fax or electronic file transfer;
• Information or data stored on or transferred to removable media such as tape,
• CD, DVD, USB storage device or memory card;
• Information stored on portable computing devices including mobile phones,
• Tablets, cameras and laptops;
• Speech, voice recordings and verbal communications, including voicemail;
• Published web content, for example intranet and internet;
• Photographs and other digital images.

This policy is Basketball England’s main privacy and information governance policy and addresses:

• Data Privacy
• Data Protection (including rights and complaints)
• Information Asset Management
• Subject access requests

Related policies referenced but separate from this policy include:

• Social media policy
• All policies, guidance and templates relating to the use of video (including live streaming) and photography or other content containing individuals, including our ‘Live Streaming consent’ and ‘Live streaming guidance’ templates.

Data protection

Personal data will be processed in accordance with the requirements of the UK GDPR and in compliance with the data protection principles specified in the legislation. Basketball England has notified the Information Commissioner’s Office that it is a Data Controller and has appointed a Data Protection Officer (DPO). Details of the DPO can be found here:

Veritau,
West Office,
Station Rise,
York,
YO1 6GA

[email protected]

Tel: 0300 600 1170

The DPO is a statutory position and will operate in an advisory capacity. Duties will include:

• Acting as the point of contact for the Information Commissioner’s Office (ICO) and data subjects;
• Facilitating a periodic review of the corporate information asset register and
• information governance policies;
• Assisting with the reporting and investigation of information security breaches
• Providing advice on all aspects of data protection as required, including
• information requests, information sharing and Data Protection Impact
• Assessments; and
• Reporting to Board Members on the above matters

Basketball England will ensure that appropriate guidance and training is given to the relevant staff and volunteers on access to information procedures, records management and data breach procedures. Individuals will also be made aware and given training in relation to information security. Basketball England will maintain a ‘training schedule’ which will record when employees have completed Data Protection training and when a refresher is due to be completed. Basketball England will ensure that any third-party contractors have adequately trained their staff in information governance by carrying out the appropriate due diligence.

Information asset register

The DPO will advise Basketball England in developing and maintaining an Information Asset Register (IAR). The register will include the following information for each asset:

• An individual information asset identification number;
• The owner of that asset;
• Description and purpose of the asset;
• Whether there is a privacy notice published for that asset;
• Format and location of the asset;
• Which officers (job titles/teams) have routine access to the information;
• Whether there are any data sharing agreements relating to the information and the name of that agreement,
• Conditions of data processing;
• Details of any third parties contracted to process the information;
• Retention period for the asset

The IAR will be reviewed annually and the Senior Leadership Team will inform the DPO of any significant changes to their information assets as soon as possible.

Information asset owners

An Information Asset Owner (IAO) is the individual responsible for an information asset, understands the value of that information and the potential risks associated with it. Basketball England will ensure that IAO’s are appointed based on sufficient seniority and level of responsibility.

IAO’s are responsible for the security and maintenance of their information assets.

This includes ensuring that other members of staff are using the information safely and responsibly. The role also includes determining the retention period for the asset, and when destroyed, ensuring this is done so securely.

What rights do you have over your data

Under the UK GDPR, individuals have the following rights in relation to the processing of their personal data:

• To be informed about how we process your personal data. This notice fulfils this obligation.
• To request a copy of the personal data we hold about you.
• To request that your personal data is amended if inaccurate or incomplete.
• To request that your personal data is erased where there is no compelling reason for its continued processing.
• To request that the processing of your personal data is restricted.
• To object to your personal data being processed.

If you have any concerns about the way we have handled your personal data or would like any further information, then please contact our DPO using the details provided above. 

If we cannot resolve your concerns then you may also complain to the Information Commissioner’s Office, which is the UK’s data protection regulator.  Their contact details are below:

The Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire
SK9 5AF

Phone: 0303 123 1113

Opening hours are Monday to Friday between 9am and 5pm (excluding bank holidays).  

You can also report, enquire, register, and raise complaints with the ICO using their web form on Contact us | Information Commissioner’s Office (ICO) Data protection and personal information complaints tool | ICO.

Lawful basis for processing personal data

The legal basis on which we collect and process your personal data described above depends on the personal information concerned, and the specific context in which we collect it. However, we will only use your personal information where we:

• Need the personal data to perform a contract with you
• Need to process your personal information for our legitimate interests, and only where our legitimate interests are not overridden by your data protection interests or fundamental rights and freedoms
• Have a legal obligation to collect personal information from you, or
• Need the personal information to protect your, or someone else’s, vital interests.
• Have your consent to do so

If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not, and the possible consequences if you do not provide your personal information.

Basketball England will not use any of the personal information we collect from you to make automated business decisions.

We reserve the right to perform statistical analysis of user’s behaviour and characteristics to measure interest in, and use of, the various areas of the website and, in addition, to inform advertisers of such information. We will provide only aggregated data from these analyses to third parties.

Under the UK GDPR, it is essential to have a lawful basis when processing personal information.  We normally rely on the following lawful bases:

• Article 6(1)(a) - consent
• Article 6(1)(c) – legal obligation
• Article 6(1)(f) – legitimate interest

We only rely on legitimate interests when we are using your data in ways you would reasonably expect.  We shall be entitled to make available user information to send you information about Basketball England for the following purposes including:

• Market research.
• Transfers to third parties as required.
• Any requirements imposed by statutory legislation and regulation.

Conditions for processing special category data

We collect and process special categories of personal data for the purposes of equality monitoring, safeguarding, anti-doping and to protect the integrity and standards of behaviour in sport under the Data Protection Act substantial public interest conditions:

• Condition 6 - statutory and government purposes
• Condition 8 - Equality of opportunity or treatment
• Condition 10 - preventing or detecting unlawful acts
• Condition 18 - Safeguarding of children and individuals at risk
• Condition 27 - Anti-doping in sport
• Condition 28 - Standards of behaviour in sport

Where we collect data about criminal convictions or offences disclosed through DBS, we do so under Data Protection Act part 1 Conditions relating to employment, social security and social protection.

Our various Safeguarding, Anti-doping and sporsts governance policies provide further details of how we handle special category data in these areas.

Data Sharing

The following are the ‘Seven Golden Rules’ of information sharing and help form the basis of our process and due diligence in this area:

1. Remember that the Data Protection Act 2018 and human rights law are not barriers to justified information sharing but provide a framework to ensure that personal information about living individuals is shared appropriately.
2. Be open and honest with the individual (and/or their family where appropriate) from the outset about why, what, how and with whom information will, or could be shared, and seek their agreement, unless it is unsafe or inappropriate to do so.
3. Seek advice from other practitioners if you are in any doubt about sharing the information concerned, without disclosing the identity of the individual where possible.
4. Share with informed consent where appropriate and, where possible, respect the wishes of those who do not consent to share confidential information. You may still share information without consent if, in your judgement, there is good reason to do so, such as where safety may be at risk, or another lawful basis for processing the personal data, for example as part of a contract .
5. Consider safety and well-being: Base your information sharing decisions on considerations of the safety and well-being of the individual and others who may be affected by their actions.
6. Necessary, proportionate, relevant, adequate, accurate, timely and secure: Ensure that the information you share is necessary for the purpose for which you are sharing it, is shared only with those individuals who need to have it, is accurate and up to date, is shared in a timely fashion, and is shared securely.
7. Keep a record of your decision and the reasons for it – whether it is to share information or not. If you decide to share, then record what you have shared, with whom and for what purpose.

Data sharing in relation to sport governance

In order to efficiently fulfil our duty of international licenses and compliance with FIBA Standards it is sometimes necessary for the Basketball England to share information with other Basketball organisations (British Basketball Federation, British Basketball League, Basketball Scotland, Basketball Wales, FIBA and other national Basketball Governing Bodies) on a limited basis and for the purpose of governing the sport effectively. Routine and regular information sharing arrangements will be documented in our main privacy notice (as above). Any ad hoc sharing of information will be done in compliance with our legislative requirements.

This Information sharing will at times be restricted to countries outside the EEA and who have not received an adequacy decision. In these cases, Basketball England will ensure any further safeguards will be applied.

When personal data is shared with a country lacking adequacy agreement, Standard Contract Clauses (SCC’s) are used to provide appropriate safeguards for data transfers to countries outside of the EEA.

We may also share your personal data with other sporting governing bodies and competition organisers for the purpose of governance of other sports, in the same way other sports share personal data with Basketball England if requested to govern our sport.

Data sharing in relation to safeguarding

Information sharing between practitioners, local organisations, and agencies is essential for early identification of need, assessment, and service provision to keep children safe. The Data Protection Act 2028 and UK General Data Protection Regulation (UK GDPR) supports the sharing of relevant information for the purposes of keeping children safe. Fears about sharing information must not be allowed to stand in the way of safeguarding and promoting the welfare of children.

The Safeguarding Team at Basketball England assess what information needs to be shared in accordance with legislation, government guidance, and information sharing advice for safeguarding practitioners.

Part of the decision-making process regarding the sharing of information will include consideration about who to share information with, this could include statutory organisations, such as the police and/or children’s services, and organisations such as the Disclosure & Barring Service. The DBS must be informed of any concerns about someone who is working with children who is suspended or expelled from the organisation.

For the processing of personal data relating to criminal convictions and offences, processing meets Schedule 1, Part 2 of the Data Protection Act 2018 as below:

(10) Preventing or detecting unlawful acts

Third Party Services

In general, the third-party providers used by us will only collect, use, and disclose your information to the extent necessary to allow them to perform the services they provide to us.

However, certain third-party service providers, such as payment gateways and other payment transaction processors, have their own privacy policies in respect of the information we are required to provide to them for your purchase-related transactions.

For these providers, we recommend that you read their privacy policies so you can understand the way your personal information will be handled by these providers.

When you click on links on our website, they may direct you away from our site. We are not responsible for the privacy practices of other sites and encourage you to read their privacy statements.

Transferring personal data outside the UK

Although we are based in the UK, some of the digital information we hold may be stored on computer servers located outside the UK.  Some of the IT applications we use may also transfer data outside the UK.

Normally your information will not be transferred outside the European Economic Area, which is deemed to have adequate data protection standards by the UK government. If your information is transferred outside the EEA, we will take reasonable steps to ensure your data is protected and appropriate safeguards are in place. Basketball England will ensure where reasonably possible that personal data stored in a third country takes reasonable precautions to store personal data securely and operates under SCC’s.

Security

To protect your personal information, we take reasonable precautions and follow industry best practices to make sure it is not inappropriately lost, misused, accessed, disclosed, altered, or destroyed.

If you provide us with your credit/debit card information, the information is encrypted by our payment partner SagePay. Although no method of transmission over the internet or electronic storage is 100% secure, we follow all PCI-DSS requirements and implement additional accepted security standards through our payment partner.

Data storage and retention

We will hold information about you in our systems only for as long as we need it for the purpose for which we collected it. Basketball England sets out its data retention requirements in its data retention schedule. But in particular:

• Any data relating to the obligations of Basketball England to maintain a comprehensive, published index of results as a National Governing Body for sport will be retained. This would include name, age category, competition eligibility and details of the event in which an individual took part.
• Personal data linked to the processing of insurance claims, subject access requests, disputes, safeguarding investigations, disciplinary or police matters, and Basketball England governance will only be kept for as long as it necessary for those purposes.
• Be entering your personal information, you accept that we may retain your information and it may be held by us or our third party partners who process it on our behalf

Subject Access Requests and Requests for Information Under GDPR

Requests under this legislation should be made to the Data Protection Officer. Any member of staff may receive a request for an individual’s personal information. Whilst the UK GDPR does not require such requests to be made in writing, applicants are encouraged where possible to do so; applicants who require assistance should seek help from Basketball England. Requests will be logged with the Safeguarding and Compliance Team and acknowledged within 5 working days. We must be satisfied as to your identity and may have to ask for additional information such as:

• Valid Photo ID (driver’s licence, passport etc);
• Proof of Address (Utility bill, council tax letter etc);
• Further information for Basketball England to be satisfied of the applicant’s identity;

Only once Basketball England is satisfied of the requestor’s identity and has sufficient information on which to respond to the request will it be considered valid. We will then respond to your request within the statutory timescale of One Calendar Month. Basketball England can apply a discretionary extension of up a further Two Calendar Months to comply with the request if the requested information would take a considerable amount of time to collate, redact, and prepare for disclosure due to either the complexity or voluminous nature of the records. If we wish to apply an extension we will firstly seek guidance from our DPO, then inform the applicant of the extension within the first calendar month of receiving the request. This extension period will be kept to a minimum and will not be used as a way of managing workloads. In very limited cases we may also refuse a request outright as ‘manifestly unreasonable’ if we would have to spend an unjustified amount of time and resources to comply. Should we think any exemptions are necessary to apply we will seek guidance from our DPO to discuss their application.

Cookie Policy

A cookie is a small file of text that may be saved on the memory or storage of your electronic device (computer, phone, or tablet etc) when you visit a website.  Cookies are used to improve the way the website works and can be used to remember the information you’ve provided so that you don’t have to re-enter it whenever you visit a new page.

We use first party cookies, including the following: 

• Session cookies – these are temporary and are removed when you close your browser or leave a website. These are used to remember visitors as they move from page to page on a website and are typically used to store your basket when using online shopping.
• Persistent cookies – these remain on your device for much longer, even after you close the browser or restart the device. They remain until you remove them, or they expire, which can be up to 12 months.  They are typically used to store information such as your name, language preferences or login information.
• Functional cookies – Functionality cookies are used to enhance the performance of websites as without them certain functions of the website may not be available. The are necessary for smooth functioning of the website and navigation
• Targeting cookies – Targeting and advertising cookies are specifically designed to gather information from you on your device to display advertisements to you based on relevant topics that interest you.
• Flash cookies - Independent of the web browser. They are designed to be permanently stored on a user's computer. These types of cookies remain on a user's device even after all cookies have been deleted from their web browser.
• Zombie cookies – A type of flash cookie that is automatically re-created after a user has deleted them. This means they are difficult to detect or manage. They are often used in online games to prevent users from cheating but have also been used to install malicious software onto a user's device.

We use third-party widgets (standalone application that is inserted into the website i.e. a newsfeed or banner) on the site, such as, Twitter, Facebook, YouTube and Genius Sports.  These widgets may set their own cookies, and they also may use cookies that we have no control over.

You should be aware that information and data may be automatically collected using Cookies. “Cookies” are small text files that store basic information that a website can use to recognise repeat site visits, and as an example, re-call your name if this has been previously supplied. We may use this to observe behaviour and compile aggregate data to improve our website, target the advertising and assess effectiveness of such advertising. 

Cookies do not attach to your system and damage your files. Should you not want information collected using Cookies, ‘reject Cookies’ in the Cookie Setting on the website. Please note that ‘personalised’ services may be affected if the Cookie option is disabled. If you click ‘accept Cookies’ you consent to our use of Cookies.

For certain processing involving the use of cookies and insight data collected using ‘like’ buttons and widgets inserted on our website, a third party i.e., Facebook and Twitter, will be a Data Controller in its own right.  You can visit their individual websites for their privacy information.

We use cookies so that:

• We can distinguish you from other users of our website and provide a good experience.
• We can remember the information you’ve provided us with while on our website, so you don’t have to keep re-entering the information whenever you visit a new page.
• We can look at how you use our website so that we can improve it for other users.

We do not use cookies to:

• Monitor your usage of other websites (privacy intrusive cookies).
• Collect any personal information about you (without your express permission).
• Collect any sensitive information.
• Pass data to any advertising networks.
• Pass personal data to third parties.

When you first visit our website using a new browser we will provide you with a cookies permission banner, seeking your consent to the use of certain cookies. 

Not all cookies require consent. Those which are required for the operation of the website, known as ‘strictly necessary’ cookies do not require consent. Without these cookies the website cannot work as designed.

Other types of cookies do require consent. These include:

• Functionality cookies, which are used to improve the usability of the website.
• Analytical or performance cookies, which are used to help us improve the website. And,
• Advertising or marketing cookies, which are used to target advertising on a website.

You can change your cookie preferences at any time through our cookie banner, but please be aware that opting out of cookies may affect your user experience on our website.

Retention periods

Retention periods will be determined by any legal requirement, best practice or national guidance, and lastly the organisational necessity to retain the information. In addition, Information Asset Owners will take into account the Limitation Act 1980, which provides timescales within which action may be taken for breaches of the law, when determining retention periods.

Destruction of records

Retention periods for records are recorded in the Basketball England’s Information Access Register. When a record reaches the end of its retention period the IAO will arrange for the records, both electronic and paper to be destroyed securely.

Advice in regard to the secure destruction of electronic media will be sought from relevant IT support.

A record should be retained of all files destroyed including, where relevant:

• File reference number,
• Description of file,
• Date of disposal,
• Method of disposal,
• Officer who destroyed record

Data protection impact assessments (DPIAs)

Basketball England will conduct a data protection impact assessment for all new projects and systems, or significant changes in processes involving high risk data processing as defined by the UK GDPR. This assessment will consider the privacy risks and implications of new projects as well as providing solutions to the identified risks.

The DPO will be consulted at the start of a project and will advise whether a DPIA is required. If it is agreed that a DPIA will be necessary, then the DPO will assist with the completion of the assessment, providing relevant advice.

Changes to our Privacy and Data Protection Policy

We reserve the right, at any time, to modify, amend, or update this Privacy Policy. Where there is any significant change, we will let you know via our communication channels and newsletters.

Complaints

Complaints in relation to Subject Access will be handled through our existing procedures internally at Basketball England. If not happy with decision of an internal investigation, you have the right to complain to the ICO and provide the ICO’s contact details. The ICO must only be contacted after an internal investigation has been conducted.

Information Commissioner's Office

Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF

Any individual who wishes to make a complaint about the way we have handled their personal data should contact the Integrity Team on the address provided.

Integrity team,
NSC, Gate 13,
Etihad Campus,
Rowsley Street,
Manchester,
M11 3FF

Specific information Basketball England collects and uses

This latter part of this policy covers specific information Basketball England collects and uses across our organisation as a National Governing body, as well as our different websites, business areas and reasons members and non-members would interact with us. The below use cases give more in-depth information on the types of data we collect, how we collect, it, how we process it and who it is shared with.

1. You visit or register to use our websites
2. You become a member of Basketball England
3. You sign up to Basketball England Learning
4. You sign up to receive communications and marketing from us or our partners
5. You post basketball related material on social media
6. Imagery, video and content captured at Basketball England events and programmes, including live streaming of events
7. You take part in an activity through one of our programmes
8. You enter or volunteer at an event
9. You join a Basketball England affiliated club
10. You complete a Basketball England Survey or take part in our research
11. It is required for Basketball England to deliver its role as the National Governing Body for cycle sport
12. Processing of orders through the Basketball England shop
13. When you are selected to take part in a talent pathway programme or selected to represent England.

We also provide privacy information at the point of data collection for surveys, research work, and some basketball participation initiatives where we think it is helpful for you.