This policy explains how CLG Naomh Ultan handles personal data when people join, play, volunteer, attend activities, contact the club, use the club website or app, or take part in club fundraising. It is tailored to the activities visible on the club website and to the GAA and ClubZap privacy statements. The committee should complete the review checklist at the end before adopting or publishing it.

1. Who we are and who this policy covers -

CLG Naomh Ultan is a Gaelic games club in County Donegal. For the club activities described here, the club decides why and how it uses personal data and acts as a data controller, unless another organisation determines the purposes and means of a particular processing activity or the club and another organisation jointly determine them.

Club contact for privacy matters: communications.naomhultandunkineely.donegal@gaa.ie

This policy covers information the club receives directly, from a parent or guardian, through GAA registration or club systems, from a service provider, or from publicly available sources where appropriate. Separate notices may apply to particular services, including GAA systems, ClubZap, online payments, ticketing, or other linked services.

2. Personal data we may use -

The information depends on your relationship with the club and the activity involved. It may include:

Identity and contact details, such as name, date of birth, address, email address, phone number, membership number and emergency contact details.
Membership and participation information, including registration status, team, age grade, playing history, match and training attendance, team sheets, results, permits, transfers, disciplinary records and relevant conduct information.
Information about parents or guardians and the relationship to an underage member, where needed for registration, communication, consent, welfare or safety.
Health and injury information, including information supplied for safe participation, injury reporting, insurance or an injury benefit claim. This can be special category data under data protection law.
Safeguarding and vetting information, where required for roles involving children or vulnerable persons. Access is restricted to people who need it for safeguarding or legal duties.
Volunteer, coach, official and committee information, including role, training, qualifications, vetting status, expenses and relevant contact details.
Photographs, video, match or event content, and information about a person’s involvement in club activities. Public posts may identify players, volunteers or award recipients.
Payment and otransaction information connected with membership, Royal Flush lotto, merchandise, fundraising, sponsorship, events, donations or expense claims. The club should not hold full payment-card details unless it has a specific, secure and lawful reason to do so.
Information in messages, complaints or enquiries, and technical information such as device, log or cookie data when you use the club website or digital services.

3. Why we use personal data and our lawful bases -

We use personal data only for specified club purposes and identify a lawful basis for each activity. Depending on the activity, the basis may be performance of a contract or membership arrangement, compliance with a legal obligation, the club’s legitimate interests, consent, or protection of someone’s vital interests. Where health or other special category data is needed, an additional condition under data protection law must also apply. The club will document the basis for each processing activity; the examples below are a framework for that review, not a substitute for it.

Membership, registration, eligibility, transfers and administration of teams: to provide club membership and organise participation; typically necessary for the membership arrangement and, where relevant, compliance with GAA rules or legal obligations.
Training, fixtures, team sheets, results, discipline and permits: to run Gaelic games and administer participation, subject to applicable GAA rules and legal obligations.
Player safety, injury reporting, insurance and welfare: to protect participants, manage incidents and submit claims. Health data will be limited to what is necessary and handled under an applicable special-category condition.
Safeguarding, vetting and required training: to meet safeguarding and legal requirements and protect children and vulnerable persons. Records are kept with restricted access.
Club communications and responding to enquiries: to send necessary membership, fixture, safety and administration messages and to respond to requests. Optional promotional communications will be sent only where permitted, and consent will be requested where required.
Fundraising, Royal Flush lotto, merchandise, sponsorship and events: to administer entries, payments, orders, prize draws, fulfilment, accounting and reporting. The club may publish draw outcomes or winners where this has been clearly explained and is appropriate to the activity.
Photographs, video, news and social media: to report on club activities and promote the club. Where consent is the appropriate basis, it will be requested separately and can be withdrawn for future use. The club will take particular care with children’s images.
Website and digital services: to operate and secure the site, app and online services, process enquiries and understand service performance. Non-essential cookies or tracking technologies will only be used where the required consent has been obtained.
Safety and security, including CCTV if used: to protect people and property, where necessary and proportionate, with a separate notice describing the system, access controls and retention period.

4. Children and sensitive information -

Children have their own data protection rights. The club will explain relevant processing in clear, age-appropriate language, involve a parent or guardian where appropriate, and limit information to what is needed for participation, communication, safeguarding and safety. A parent or guardian may provide or authorise consent where the law requires it, but parental consent is not a blanket basis for every use of a child’s data. The Irish age of digital consent applies to online services that rely on consent; it does not mean that all club processing for people under 16 automatically requires parental consent.

Health, safeguarding and vetting information receives additional protection. The club will collect it only where necessary, restrict access, use a valid legal condition, and share it only with authorised people or organisations for the stated purpose. Please do not send sensitive information through public social media channels.

5. Photographs, video and public communications -

The club may take or receive photographs and video at matches, training, ceremonies and community events, and may use selected material on its website, app, social media or club communications. The club will provide information at relevant activities about how images are used and how to raise a concern. It will not use an image in a way that is misleading, intrusive or inconsistent with safeguarding guidance. Requests concerning a child’s image will be handled sensitively and in line with the club’s safeguarding and communications policies.

Where an image is used on a public channel, removing it from the club’s channels may not remove copies already shared or downloaded by others. Contact the club if you want to discuss a specific image or publication.

6. Website, ClubZap and other online services -

The club website provides news, fixtures and results, membership access, lotto information and online play, merchandise and fundraising links, and links to the ClubZap app and social channels. These services may involve the club, GAA systems, ClubZap, payment providers and other service providers. Their responsibilities differ by service and contract.

ClubZap publishes its own privacy and cookie statements. Those statements explain ClubZap’s own processing as a platform provider. Depending on the particular service and the arrangements in place, ClubZap may also process club information on the club’s instructions. Before publication of this policy, the club will confirm the role of ClubZap and any other provider from the relevant service terms and data-processing agreements. When a service collects data directly from you, read the service’s notice as well as this policy.

Cookies and similar technologies may be used by the club site or embedded third-party services. The club will check the live cookie configuration and publish accurate cookie information. Cookies that require consent will not be set before valid consent is given. Links to other websites are governed by those websites’ own privacy information.

7. Who may receive personal data -

We limit access to committee members, team officials, coaches, administrators and volunteers who need the information to carry out their roles. Where necessary and appropriate, we may share information with:

The GAA, Donegal GAA, provincial or other relevant sporting bodies, including through registration, fixture, transfer, safeguarding, disciplinary, injury-benefit or competition systems. The GAA’s own privacy statement explains its processing and notes that controller arrangements can vary, including joint-controller arrangements with clubs.
Club systems and service providers, such as ClubZap, membership or lotto platforms, website hosting, communications, cloud storage, payment processing and IT support, under appropriate written arrangements where required.
Insurers, medical or welfare professionals, legal or accounting advisers, banks, auditors, event or fundraising partners, and public authorities where needed for the stated purpose or required by law.
The public, where the club publishes a match report, team sheet, result, event photograph, lotto draw result or winner information. We will consider necessity, fairness and safeguarding before publication, and provide information about the relevant publication practice.

We do not sell personal data. Service providers must use personal data only for agreed purposes and protect it appropriately. The club will check whether any provider or recipient is located outside the European Economic Area and, if so, identify and document an appropriate transfer safeguard.

8. How long we keep information -

We keep personal data only for as long as it is needed for the purpose for which it was collected, including applicable membership, GAA, safeguarding, accounting, insurance and legal requirements. Retention can vary by record type. The club will adopt and follow a retention schedule covering membership and sporting records, health and injury information, safeguarding and vetting records, financial and lotto records, communications, photographs and CCTV footage. When information is no longer required, it will be securely deleted or anonymised, unless it must be retained for a legal claim or other legal requirement.

The club will publish or make available the applicable retention periods or the criteria used to set them. For CCTV, if used, the period and access arrangements will be stated in a separate CCTV notice.

9. Security and data incidents -

The club uses reasonable organisational and technical measures to protect personal data from loss, misuse, unauthorised access, alteration or disclosure. Access should be limited to authorised people, and sensitive records should not be kept in personal accounts or shared through unsecured channels. If you believe information has been lost, disclosed or accessed in error, contact the club privacy contact promptly so it can be assessed and any required action taken.

10. Your data protection rights -

Subject to the conditions and limits set by law, you may ask the club to:

confirm whether we process your personal data and provide access to it;
correct inaccurate or incomplete information;
erase information or restrict its use in certain circumstances;
provide certain information in a portable format, where the right applies;
object to processing based on legitimate interests, including direct marketing; or
withdraw consent for future processing where consent is the basis.

Contact communications.naomhultandunkineely.donegal@gaa.ie to make a request. We may need to verify your identity and may need to refer a request to the GAA or a service provider where it controls the relevant processing. We will respond within the time required by law and explain any applicable limits. Withdrawing consent does not affect processing already carried out lawfully before withdrawal.

You may also complain to the Irish Data Protection Commission: www.dataprotection.ie, info@dataprotection.ie, or 6 Pembroke Row, Dublin 2, D02 X963. You may contact the Commission without first contacting the club, although raising the issue with us may help resolve it.

11. Changes to this policy -

We will review this policy when the club’s activities, systems or legal requirements change. The latest version will be published on the club website with its effective date. If we plan to use personal data for a materially different purpose, we will provide the information required by law before doing so.

12. Related privacy information -

This policy should be read alongside the GAA Privacy Statement, the ClubZap Privacy Statement and Cookie Policy, and any service-specific notice shown when you register, enter a draw, make a payment, submit an injury notification or use another external platform. The club’s other policies include child safeguarding, injury notification, communications and social media, and club policies and procedures.

Sources consulted -

GAA Privacy Statement supplied with the request (the GAA statement describes purposes, lawful bases, data subject rights, sharing, transfers, retention, complaints and cookies).
ClubZap Privacy Statement, accessed 25 September 2026: https://clubzap.com/privacy-statement/
CLG Naomh Ultan website, accessed 25 September 2026: https://www.naomhultan.com/ ; Club Policies & Procedures: https://www.naomhultan.com/pages/club-policies-procedures ; membership: https://www.naomhultan.com/membership_signup ; lotto: https://www.naomhultan.com/draws
Data Protection Commission, transparency under Articles 13 and 14 GDPR: https://www.dataprotection.ie/en/individuals/know-your-rights/right-be-informed-transparency-article-13-14-gdpr
Data Protection Commission, rights under the GDPR: https://www.dataprotection.ie/en/individuals/rights-individuals-under-general-data-protection-regulation
Data Protection Commission, guidance on CCTV: https://www.dataprotection.ie/en/dpc-guidance/guidance-on-the-use-of-cctv ; guidance on cookies: https://www.dataprotection.ie/en/dpc-guidance/guidance-cookies-and-other-tracking-technologies

ClubZap

This website is powered by the ClubZap platform. Please refer to the ClubZap Cookie Policy to see how cookies are used on this website.

Naomh Ultan

Founded 1974

Naomh Ultan

Donegal

Privacy Policy

ClubZap