How we use your information

This portal is run by Harpenden RFC to organise the Minis Tour 2027 (Norfolk May Day Rugby Festival, North Walsham RFC, Friday 30 April – Monday 3 May 2027). Harpenden RFC is the data controller for the personal information collected here — responsible for deciding what's collected and why, and for keeping it safe.

• Name, email address and phone number for the Party Lead and any other adult in the party.
• Name and age group for each player, and whether a non-player attendee is under 16 (a checkbox you tick — we don't ask for or store a date of birth).
• Anything you choose to add in the notes field — for example allergies or access needs.
• A secondary emergency contact's name, relationship, phone number and email address.
• Kit orders (items and sizes) for each person.
• Which accommodation option your family has chosen (or that you've told us you're sorting your own).
• Payment records — the amount, date and status of each payment and any refund. We never see or store your card details; these are handled entirely by our payment provider, Stripe.

• To register you for the tour — to organise players into age groups and teams, work out fees, and let you order kit.
• To keep in touch — confirmation and update emails, payment receipts, and reminders about your balance.
• For safety — an emergency contact and any notes you provide (e.g. allergies, access needs) so the tour team can respond appropriately if something happens on the day.
• To take payment — registration fees and kit are paid by card through Stripe.
• To keep financial records — as required by law.

Most of the people registered through this portal are children. Their information is provided by a parent or guardian (the Party Lead or another adult in the party), not collected directly from the child. By registering a child, you're confirming you have the authority to do so and to share their information with us for the purposes described here.

• Stripe — to process card payments. Stripe never shares your full card details with us.
• Resend — to send confirmation, update and reminder emails on our behalf.
• Supabase — to securely host the registration database.
• Sports Tours Limited — the tour operator that organises the festival and accommodation itself. We share your registration and accommodation booking details with them for booking purposes: names, age groups, team assignments, non-player attendee counts, and which accommodation option you've chosen. We don't share contact details, emergency contacts, notes, kit orders, or any payment information with them. They process what we share under their own privacy notice, at sports-tours.co.uk.

We keep your registration, payment and related data for 12 months after it was created, or until 4 May 2028, whichever is later — the later date gives a full accounting cycle after the tour itself (Friday 30 April – Monday 3 May 2027) to handle any outstanding refund, dispute or financial year-end before anything is touched. Once that time has passed, the personal parts of your data are automatically anonymised by a scheduled process — this isn't something anyone has to remember to do by hand.

"Anonymised" means names, email addresses, phone numbers and any notes are permanently overwritten with placeholders and can never be recovered. Your emergency contact details are deleted outright rather than anonymised, since nothing else needs to refer to them afterwards. What we can't delete is the bare record that a payment was made — the amount, date and status — since Harpenden RFC is legally required to keep financial records; by that point it no longer identifies you.

You don't have to wait for the automatic process above — you can ask for your data to be deleted or anonymised at any time. If you're signed in, the quickest way is your account page, which explains exactly what's deleted outright versus anonymised before you confirm. You can also email us (see "Contact us" below) and we'll process it for you.

Either way, this permanently ends your ability to log in — your account isn't paused or hidden, it's gone. Doing this doesn't remove Stripe's own, independent copy of your payment details, which is held and retained under Stripe's own terms as our payment processor.

Under UK data protection law, you have the right to:

• ask what information we hold about you or your family and get a copy of it;
• ask us to correct anything that's inaccurate;
• ask us to delete or anonymise your information — see "Deletion and anonymisation on request" above — except where we're required to keep a minimal, non-identifying financial record for longer;
• object to or ask us to restrict certain uses of your information;
• complain to the Information Commissioner's Office (ico.org.uk) if you're unhappy with how we've handled your information.

For any question about this notice, or to exercise any of the rights above, contact privacy@hrfcministour2027.co.uk.

We may update this notice from time to time — for example if we start collecting new information or working with a new supplier. The current version always applies.