Use of personal data
For senior playing and social members, details on how we use your data are provide on the membership pages here in the relevant membership form. For junior members, the privacy notice below explains how we use your data.
Privacy Notice
________________________________________________________________
Under new laws which came into effect in May 2018, we need to provide you with certain details concerning how your personal data will be used and protected.
80
| Hemel Hempstead Town Cricket Club take the protection of the data we hold about you as a member seriously and are committed to respecting your privacy. This notice is to explain how we may use personal information we collect and how we comply with the law on data protection, what your rights are. |
| Names of data controller | Hemel Hempstead Town Cricket Club |
| Categories of personal data we collect |
|
| Our sources of the personal data | We obtain personal data from:
|
| Automated decisions we may take | None |
| Purposes for which we process personal data | The club will process the personal data for:
· Administering bookings and attendance at sessions · Dealing with medical needs/specific requirements · Supporting the delivery of cricket sessions · For training and competition entry Reporting of participation and any incidents and of figures and trends (including equality and inclusion information) · For quality and improvement monitoring |
| Who we will disclose your personal data to |
|
| Legal basis for processing your personal data | The legal basis for the collection and processing of your personal data is:
· for administration and programme delivery: that it is necessary to fulfil the contract that you are going to enter into or have entered into with us · for dealing with medical needs: that you have given your explicit consent or in the child’s vital interests. · in all other cases: that it is necessary for our legitimate interests which are to build a programme to encourage participation in cricket and does not prejudice or harm rights and freedoms of parents / guardians or the children that join the programme. |
| Your right to withdraw consent | Where you have given your consent to any processing of personal data, you have the right to withdraw that consent at any time. If you do, it will not affect the lawfulness of any processing for which we had consent prior to your withdrawing it. |
| Location of your personal data | The Club will keep your personal data within the European Economic Area. |
| How long we will keep your personal data for
|
We will not retain your personal data for longer than is reasonable and necessary for the purposes for which it was collected. We shall retain your personal data for such time as you are registered with Hemel Hempstead Town Cricket Club as a member. One year after you cease to be a member of Hemel Hempstead Town Cricket Club or play an active part in Hemel Hempstead Town Cricket Club, we shall delete your data. |
| Your rights in respect of your personal data
|
You have the right of access to your personal data and, in some cases, to require us to restrict, erase or rectify it or to object to our processing it, and the right of data portability. |
| Our contact details
|
mail. Hemel Hempstead Town Cricket Club
Station Road Hemel Hempstead HP1 1JZ email. rsgrayson5@gmail.com website. www.hhtcc.co.uk |
| Complaints
|
If you have any concerns or complaints about how we are handling your data please do not hesitate to get in touch with the club. You can also contact the Information Commissioner’s Office. |
HEMEL HEMPSTEAD TOWN CRICKET CLUB
CCTV Policy
Policy owner: Data Protection Officer | Last reviewed: 21 July 2026 | Next review: July 2027
1. Purpose and scope
This policy explains why HHTCC uses CCTV, how footage is stored and protected, who can access it, and members’ and visitors’ rights over their own data. It applies to all fixed CCTV cameras operated by the club across the clubhouse, grounds, car park, and nets, and to everyone whose image may be captured — members, players, visitors, contractors, and staff.
It should be read alongside the club’s separate CCTV Subject Access Request (SAR) Policy, which sets out how requests for footage are handled.
2. Why we use CCTV
- Preventing and detecting crime, including theft, vandalism, and unauthorised access to the clubhouse and grounds.
- Protecting the safety of members, players, staff, and visitors.
- Protecting club property and equipment.
- Supporting the investigation of incidents (e.g. accidents, disputes, damage) where relevant.
CCTV is not used to monitor staff or volunteer performance, and is not directed at areas where people have a heightened expectation of privacy (e.g. changing rooms, toilets).
3. Lawful basis
The club relies on legitimate interests as its lawful basis under UK GDPR Article 6(1)(f) — specifically, the legitimate interest in protecting property, members, and visitors from crime and harm. This has been balanced against individuals’ privacy rights; the outcome of that assessment is recorded in the club’s Data Protection Impact Assessment (DPIA), available from the DPO on request.
Audio recording is not used. Should this ever be introduced, it would require a fresh DPIA, updated signage, and a specific justification, as audio is treated as significantly more privacy-intrusive than video alone.
4. Camera locations and coverage
- Cameras are positioned to cover entrances, the car park, the pavilion perimeter, and equipment storage areas.
- Camera angles are set to avoid, as far as reasonably possible, capturing neighbouring properties, public footpaths beyond club boundaries, and areas of heightened privacy expectation.
- A camera location register is maintained by the system administrator and reviewed annually, recording each camera’s location, purpose, and field of view.
5. Signage
- Clearly visible signs are displayed at all entrances to the grounds and clubhouse, and at the car park.
- Signs state that CCTV is in operation, the purpose (crime prevention and public safety), the identity of the data controller (the club), and a contact point for queries.
- Signage is positioned so people can read it before entering a monitored area, not only once already captured on camera.
6. Retention period
Footage is retained for 30 days from recording, then automatically overwritten, unless it has been specifically retained for one of the following reasons:
- It is needed as evidence for an ongoing investigation, insurance claim, or legal proceedings.
- It is the subject of a live Subject Access Request.
- It has been formally requested by the police.
Retained footage is clearly logged with the reason and an expected deletion date, and is deleted as soon as that reason no longer applies. Retention periods are not extended simply due to available storage capacity — the UK GDPR and DPA 2018 set no fixed minimum or maximum period, but storage limitation requires deletion once footage is no longer needed for the purpose it was collected.
7. Who can access footage
| Role | Access permitted | Access NOT permitted |
| Club Chair / General Committee | Full access to live and recorded footage, system settings, and the access log, for compliance and SAR purposes. | — |
| Nominated system administrator(s) | Technical access to maintain the system, configure retention settings, and export footage when authorised. | Viewing footage for reasons unrelated to system maintenance or an authorised request. |
| Bar / duty staff and volunteers | None, unless specifically named as a system administrator. | No routine access to live or recorded footage. |
| Members / general public | No direct access. May request their own footage via a Subject Access Request. | No routine or informal viewing on request. |
| Police / law enforcement | Footage may be disclosed for the prevention/detection of crime, on written request, logged and approved by the DPO. | Informal or verbal handover without a record being kept. |
All access to recorded (non-live) footage — whether by committee members, police, or in response to a SAR — must be logged, recording who accessed it, when, and why.
8. Security of the system
- The system is protected by a strong, unique password, not shared informally, and multi-factor authentication is used where the system supports it.
- No generic or shared logins are used — each administrator has their own account.
- Footage exports (e.g. for police or a SAR) are stored securely and deleted once no longer needed.
- The DVR/NVR unit is kept in a locked, access-controlled location.
- Software and firmware are kept up to date by the system administrator.
9. Sharing footage with third parties
- Footage may be shared with the police for the prevention or detection of crime, on a written request, recorded in the SAR log
- Footage may be shared with insurers where relevant to a claim.
- Any third-party contractor or provider with system access (e.g. an installer providing remote support) must be covered by a written data processing agreement.
- Footage is never shared on social media or with the press.
10. Individual rights
- Anyone whose image is captured has the right to request a copy of footage showing themselves — see the club’s CCTV SAR Policy for the full process.
- Individuals also have rights to be informed (via this policy and signage), and to complain to the club or to the Information Commissioner’s Office (ICO) if concerned about how footage is handled.
11. Review
This policy is reviewed annually, and whenever ICO guidance or UK data protection law changes materially. Note: ICO guidance on video surveillance is currently under review following the Data (Use and Access) Act 2025, and this policy will be updated once revised guidance is published.
Questions about this policy, or to request footage of yourself, contact the HHTCC Committee members.
HEMEL HEMPSTEAD TOWN CRICKET CLUB
CCTV Subject Access Request (SAR) Policy
Policy owner: Data Protection Officer | Last reviewed: 21 July 2026 | Next review: July 2027
1. Purpose
This policy sets out how HTCC handles requests from individuals to access CCTV footage of themselves, in line with UK GDPR and the Data Protection Act 2018, as updated by the Data (Use and Access) Act 2025.
2. Who can request footage, and why
- Any individual has the right to request CCTV footage that contains their own personal data — no reason needs to be given.
- A request is valid in any format: verbal, written, email, or social media.
- We cannot ask why the footage is wanted as a condition of processing the request. We can only ask for details that help us locate the correct footage (date, time, location).
- What the requester does with footage once lawfully provided is outside our control and outside the scope of data protection law.
3. Timescales
- Respond within one calendar month of receipt, without undue delay.
- This may be extended by up to two further months for complex or numerous requests — the requester must be told within the first month, with reasons.
- The clock may be paused (“stopped”) while reasonably waiting for clarifying details from the requester needed to locate the footage.
4. Process
| Step | Action | Notes |
| 1 | Log the request | Record the date received — this starts the one-month clock. Any format counts (verbal, email, letter, social media). |
| 2 | Verify identity (if needed) | Only if you don’t already know the requester. Photo ID is sufficient. |
| 3 | Ask for details to locate footage | Date, approx. time, location/camera, what they were wearing/doing. You may “stop the clock” while waiting for this. |
| 4 | Retrieve and review footage | Check retention hasn’t already overwritten it. Watch footage before disclosing anything. |
| 5 | Redact third parties | Blur/mask any other identifiable individuals unless they’ve consented or disclosure is otherwise reasonable. |
| 6 | Check for exemptions | E.g. an active police investigation may justify withholding under the crime/taxation exemption. |
| 7 | Respond | Provide footage/stills, or a written explanation if refusing, including the right to complain to the ICO. |
| 8 | Log the outcome | Update the SAR log with actions taken and date closed. Retain the log entry for 3 years. |
5. Third-party footage
- Footage showing only the requester can normally be disclosed as-is.
- Footage showing other identifiable people must be redacted (blurred/masked) unless those people have consented, or disclosure without consent is reasonable in the circumstances.
- If redaction tools aren’t available, provide still images or a written description instead, and note this limitation to the requester.
6. Grounds for refusal
- Footage no longer exists due to normal retention cycles that pre-date the request.
- An exemption applies — e.g. disclosure would prejudice an active police investigation (crime/taxation exemption).
- The request is manifestly unfounded or excessive (rare in practice).
Cost or inconvenience to the club is never a valid reason to refuse. Any refusal must be explained in writing, including the requester’s right to complain to the ICO.
7. Record-keeping
- Every request is logged in the CCTV SAR Tracking Log (see accompanying spreadsheet).
- Log entries (not the footage itself) are retained for 3 years, to cover the realistic window for an ICO complaint or dispute, and to evidence compliance.
- Footage retention continues to follow the club’s normal CCTV retention schedule once a request is closed, unless there’s an ongoing legal reason to preserve it.
8. What must never happen
- Never delete or edit footage once a request is received, even if it falls within the normal retention window.
- Never disclose unredacted footage of identifiable third parties without a valid basis.
- Never refuse a request solely on the basis of cost or inconvenience.
This policy should be reviewed annually and whenever ICO guidance or UK data protection law changes materially.
END
