Staffordshire Surge American Football Club
Privacy notice
Last updated 14 October 2026
This notice explains how Staffordshire Surge American Football Club uses personal information in connection with teamsurge.co.uk, website enquiries, recruitment communications, email updates and sponsorship contacts. It also explains your choices and how to contact us about your information.
Who we are and how to contact us
Staffordshire Surge American Football Club, referred to as the club, we or us in this notice, is responsible for deciding how the personal information covered by this notice is used. This makes the club the data controller.
For privacy questions, requests or complaints, contact the club committee at admin@teamsurge.co.uk. Please put “Privacy request” in the subject line so we can direct it to the right person.
You can ask us to explain this notice or provide it in a more accessible format.
What information we collect and where it comes from
- Enquiries and recruitment interest: your name, email address, telephone number and the information you choose to give us about playing, coaching, volunteering or attending a session. We receive this directly from you through forms, email or conversations.
- Email preferences: your contact details, the updates you select, available records of when and how you subscribed, and any withdrawal of consent or objection to marketing.
- Email engagement: Squarespace records individual email opens and link clicks, associated with the recipient and campaign. It also records delivery, bounce and unsubscribe information.
- Sponsorship contacts: professional information such as your name, work email address, organisation and role, together with relevant correspondence. This may come directly from you or from Lusha, a business contact data provider. When we use a third-party source to contact you, we identify that source in our communication.
- Website information: Squarespace receives technical information needed to deliver the site, such as your IP address, browser, device, network and pages requested. Additional usage information depends on the analytics and cookie choices described below.
- Club media: names, team roles, profiles, photographs and video supplied to the club or recorded during club activities, where used on our website or club channels.
Please avoid sending medical details or safeguarding concerns through a general website enquiry form. Contact the club so we can direct you to the appropriate person and explain how those details will be handled.
Why we use information and our lawful bases
UK data protection law requires a lawful basis for each use of personal information. The following explains the activities covered by this notice.
| Activity | Lawful basis and purpose |
|---|---|
| Answering enquiries and arranging a session you requested | Legitimate interests in responding to requests, supporting participation and organising club activities. If processing is necessary to take steps towards a contract with you, or to perform that contract, we rely on contract instead. |
| Optional recruitment updates, OTA invitations and club newsletters | Consent for the email updates you choose to receive. Signing up for one type of update does not automatically subscribe you to every club mailing list. |
| Relevant sponsorship approaches to corporate business contacts | Legitimate interests in identifying and developing partnerships that support the club, where that use is necessary and proportionate and does not override the individual’s rights. We obtain consent where the electronic marketing rules require it. |
| Managing an agreed sponsorship relationship | Contract where the agreement is with you personally; legitimate interests in administering the relationship where you act for an organisation. |
| Delivering and protecting the website | Legitimate interests in operating a reliable website and protecting it against misuse. Optional analytics and tracking are addressed in the cookies section. |
| Handling rights requests and recording marketing objections | Legal obligations under data protection law. We may also retain proportionate records where necessary for establishing, exercising or defending legal claims. |
Where we rely on legitimate interests, we consider the purpose, necessity and effect on the people concerned. You can ask us for more information about that assessment and you can object to this processing.
Providing information for an enquiry is voluntary. If you do not give us enough information to respond or arrange the activity you request, we may be unable to do so. We identify any information required for a particular agreement when it is requested.
Email updates and sponsorship outreach
We use Squarespace Email Campaigns to send the optional club emails people have agreed to receive. Recruitment, supporter and sponsorship audiences are managed according to the purpose for which their details were collected and the permission or other lawful basis that applies.
For sponsorship research, obtaining a business address from Lusha does not mean the person has subscribed to our newsletters or recruitment emails. Relevant business outreach is considered separately from those mailing lists.
If you ask about a session or partnership, we may reply and send information needed to deal with that request. Optional promotional messages remain subject to the marketing choices and rules explained here.
You have an absolute right to object to the use of your personal information for direct marketing, including related profiling. To stop marketing, use the unsubscribe link in a club marketing email, reply to the sender, or email admin@teamsurge.co.uk. You do not need to give a reason.
We stop using your information for direct marketing when you object. We retain only the information needed to honour that choice in a suppression record, such as your email address and the date and scope of the objection. This helps prevent accidental re-import or contact through another list.
You can also ask Lusha to remove your information from its database through the Lusha removal form. This is a separate choice and does not affect our responsibility to deal with your request to the club.
Who receives your information
Authorised club committee members, coaches and volunteers have access where needed for their role and the purpose described in this notice. We do not sell or rent our mailing lists to other organisations for their marketing.
- Squarespace hosts our website and stores our mailing lists. It processes website, contact, subscription and email engagement information to provide these services to the club, using its service providers where needed. Its privacy policy explains its separate use of information for its own platform purposes.
- Google hosts club forms reached through Google Forms links. If you submit such a form, Google processes the submission and associated technical information. The club uses your answers for the purpose explained on that form. Google’s own privacy information explains its separate processing.
- We may disclose relevant information to regulators or public authorities where required by law.
Links to BAFA registration services, merchandise suppliers and other external websites lead to services operated by those organisations. Their privacy notices explain their processing. Where we separately receive or share information with them, we explain that use at the relevant point.
International processing
Squarespace and its service providers may process information outside the UK, including in the United States. This can happen through the website and mailing services even though the club operates in the UK. Squarespace’s Data Processing Addendum describes the UK Extension to the EU–US Data Privacy Framework for covered US transfers and approved contractual safeguards, including the UK international data transfer addendum, where applicable.
You can contact us for details of the safeguards relevant to your information and how to obtain a copy, subject to appropriate protection of confidential information.
Cookies analytics and email measurement
Our website uses Squarespace cookies and similar technologies. These store or access information on your device. Essential cookies help the site function and support security. Optional Squarespace analytics cookies measure visits and how the website is used.
Use the website’s cookie controls to accept, reject or manage optional cookies. We seek consent for optional analytics and tracking where required. You can also manage cookies through your browser, although blocking essential cookies may affect website functions.
Squarespace’s cookie information explains its cookie names, purposes and durations. Its standard analytics cookies include ss_cid, ss_cpvisit and ss_cvr, which last two years, and ss_cvisit and ss_cvt, which last 30 minutes. They recognise visitors and their sessions. Cookie lifetimes are separate from how long the club keeps information in its records.
Our email provider processes delivery, bounce and unsubscribe information to operate the mailing service and respect your preferences.
Our Squarespace emails also use tracking technologies to record individual opens and link clicks. This information is associated with the recipient and campaign and helps us understand which messages are read and which links attract interest. We keep identifiable email engagement records for up to two years from the event, or less where no longer needed.
You can stop receiving marketing emails using the unsubscribe link or by contacting admin@teamsurge.co.uk. You can also contact us about the use of your email engagement information. Consent to receive marketing messages does not automatically amount to consent to tracking, and website cookie choices do not control tracking within emails.
How long we keep information
We normally keep personal information covered by this notice for no longer than two years from when it is collected or the record is created. We delete or anonymise it sooner if it is no longer needed, or where required following a valid request. Sending another marketing email or recording an automatic open does not restart this period.
| Record | Retention period |
|---|---|
| Enquiries and initial recruitment contacts | Up to two years from collection. |
| Sponsorship prospects and correspondence | Up to two years from collection of the contact details or creation of the correspondence. |
| Subscribed email contacts | Up to two years from collection. Unsubscribing ends marketing use earlier; a minimal suppression record may remain. |
| Agreements and related records | Normally up to two years from creation, subject to the legal retention exceptions below. |
| Website logs, campaign data and media | Up to two years from collection or creation, or a shorter period where no longer needed. Individual email engagement records are measured from the event. |
| Suppression records | The minimum record needed for as long as we carry out marketing that could otherwise result in renewed contact. It is used to respect the objection, not to send marketing. |
| Privacy requests and complaints | Normally up to two years from creation of the record, subject to the legal retention exceptions below. |
We may retain necessary records for longer where a legal obligation requires it or where needed to establish, exercise or defend a legal claim. In those cases, we limit the information retained and its use, and review the need for retention. We retain the minimum suppression record for as long as necessary to prevent unwanted marketing.
Where information must remain in a backup until scheduled replacement, we restrict its use and ensure that deletion and suppression instructions continue to be respected if data is restored.
Club media young people and additional records
Our website includes club profiles and coverage of sporting activities. If you have a concern about your name, photograph or video appearing on a club channel, contact us using the details above.
Young people have their own data protection rights. We aim to explain our use of information in language they can understand. A parent or representative may help with a request where appropriately authorised; this does not automatically remove the young person’s own rights.
Your rights and complaints
Depending on the information and the legal basis for using it, you can ask us to:
- Provide access to your personal information and a copy of it.
- Correct inaccurate information or complete information that is missing.
- Erase information or restrict its use where the relevant conditions apply.
- Provide information you supplied in a portable format where processing is automated and based on consent or a contract.
- Stop processing based on legitimate interests where your circumstances justify an objection.
Your right to object to direct marketing is absolute. If we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that was lawful before you withdrew consent.
Send requests to admin@teamsurge.co.uk. Requests are normally free and we normally respond within one month. If the law allows more time, we explain why within the initial period. We only ask for additional identification where necessary and proportionate.
You can raise a privacy complaint with us at the same address. You also have the right to complain to the UK Information Commissioner’s Office through ico.org.uk/make-a-complaint.
Keeping information secure and updating this notice
We use proportionate access controls and organisational safeguards to protect information, and limit access to those who need it for their responsibilities. We review the information we hold and the providers and processes used to handle it.
We update this notice when our activities change. The date at the top shows the latest update. Where a change affects how we use your information, we bring it to your attention as appropriate and obtain any new permission required before that use begins.