Privacy notice
Harrogate RUFC U15 Portugal Tour 2027
1. Who this is about
This notice explains how Harrogate RUFC (“the Club”, “we”, “us”) handles personal data collected through TripCaptain for the Harrogate RUFC U15 Portugal Tour 2027.
2. Who we are
Harrogate RUFC is the data controller for the information described here. If you have a question or want to exercise any of the rights below, contact:
Andy Jones, Trip Organiser — amjgbr@gmail.com
3. What we collect, and why
| Category | What, specifically | Why we need it |
|---|---|---|
| Contact details | Lead contact name, email, phone; each traveller's name, phone, email | Organising the trip, contacting you about it |
| Traveller category | Whether someone is a player, parent/guardian, sibling, etc., and whether they're actually travelling | Headcounts, itinerary planning, knowing who needs travel-document information |
| Passport and travel-document details | Name as it appears on the passport, passport number, expiry date, nationality, place of birth | Required by airlines/accommodation providers and for travel/border compliance — we cannot book travel without this |
| Health and dietary information | Dietary requirements, medical information | Safety and welfare while travelling — caterers and staff need to know about allergies, conditions and medication needs |
| Emergency contact | Emergency contact name and phone number | So we can reach someone quickly if there's an incident during the trip |
| Payment records | Amounts paid, payment method, payment reference, amounts owed | Tracking who has paid, what's still owed, and reconciling sponsorship/fundraising income |
| Itinerary and communications | Messages sent to you, the published schedule you can see | Keeping you informed about the trip |
We do not collect bank account or card details through TripCaptain — payments are made by bank transfer directly to the Club’s own account, matched using the reference we give you.
4. Our legal basis for processing this
- Contact, booking, and payment information: processed because it’s necessary to run the trip you’ve signed up for (legitimate interest / performance of the arrangement between you and the Club).
- Health, medical and dietary information: this is sensitive information, so we only collect and use it with your explicit consent — given when you submit it through the traveller portal. You can withdraw this consent at any time by contacting us, though we may need to restrict your child’s participation in certain activities if we no longer hold safety-relevant information about them.
- Passport and nationality details: collected because travel providers (airlines, accommodation, insurers) require it, and we hold it only for that purpose.
5. Children's data
Some travellers on this trip are under 18. Parents/guardians submit information on their child’s behalf through TripCaptain’s traveller portal. We collect no more than is needed to organise the trip safely, and the same rights below (access, correction, deletion) can be exercised by a parent/guardian on a child’s behalf.
6. Who we share it with
- Airlines — easyJet and Jet2, to book flights. This is where your passport name, number, expiry, nationality and place of birth go: airlines require these details to issue a booking.
- Accommodation providers — these vary by trip and destination; we only share the specific details a provider needs to complete a booking (typically just names and dates, not passport details).
- Insurance — cover for this trip is arranged through the RFU (Rugby Football Union)’s own insurance scheme, so relevant traveller details are shared with them to put cover in place.
- Service providers who run TripCaptain on our behalf: Supabase (database and login), Vercel (hosting), and Resend (sending you emails from TripCaptain). These providers process data only to provide their service to us — they don’t use it for their own purposes.
- We do not sell personal data, and we do not share it for marketing purposes.
7. Where data is processed
Because this trip travels to Portugal, some information (e.g. your passport details, for booking purposes) may need to be shared with providers based in the EU. We only share what’s strictly needed for that booking.
8. How long we keep it
We keep personal data for as long as you or your child remain a member of the Club. If membership ends, we delete this information 2 years afterwards.
9. Your rights
Under UK GDPR, you (or a parent/guardian acting for a child) can ask us to:
- Access the personal data we hold about you or your child
- Correct it if it’s inaccurate
- Delete it, where we don’t have a legal reason to keep it
- Restrict or object to certain processing
- Receive a copy of data you provided to us, in a portable format
To exercise any of these, contact us using the details in section 2. If you’re unhappy with how we’ve handled your data, you can also complain to the Information Commissioner’s Office (ico.org.uk).
10. Keeping this notice up to date
We’ll update this notice if what we collect or why changes, and let you know if the change is significant.