Privacy Policy

This Privacy Policy explains how Wild Geese Gaelic Football Club collects, uses, shares and protects personal information when you visit wildgeesegfc.org, contact us, sign up for our newsletter, join the club, order kit or take part in our games and events. We are a small, volunteer-run club, and we have tried to write this in plain language without leaving out anything you are entitled to know.

Effective date: October 8, 2026 · Last updated: October 8, 2026

1. Who we are

Wild Geese Gaelic Football Club ("Wild Geese GFC", "the club", "we", "us" or "our") is an amateur, volunteer-run Gaelic football club based in Orange County, California, USA. We operate the website at https://wildgeesegfc.org (the "website" or "site").

For the purposes of the EU General Data Protection Regulation (GDPR) and the UK General Data Protection Regulation (UK GDPR), Wild Geese GFC is the controller of the personal information described in this policy. That means we decide why and how your information is used and are responsible for looking after it.

Privacy matters are handled by the club committee at [email protected].

2. Scope of this policy

This policy applies to personal information we collect:

through the website, including the contact/join form and the newsletter sign-up form;
when you email, message or speak to us about playing, volunteering, sponsorship, membership or kit;
when you register as a member or player, or a parent or guardian registers a young player;
when you attend or take part in our training sessions, games, tournaments and social events, including through photography and video.

It does not cover websites or services run by others, such as social media platforms, YouTube, payment providers and governing bodies, even if we link to them (see Section 18). Please also read our Cookie Policy and Terms of Use.

3. Information we collect

3.1 Information you give us

Contact and join form. When you use the form on our website, we collect your first name and surname, email address, phone number (if provided), the subject of your inquiry (play, get involved, sponsor, membership, kit order or other), your message and anything you choose to include in it, and a record that you ticked the consent checkbox.

Newsletter sign-up. We collect only your email address, together with a record of when you subscribed.

Membership and registration. If you join the club as a player, member or volunteer, we ask for the information needed to register you for the season. Depending on your role, this may include your full name, date of birth, contact details, address, emergency contact details, membership category and relevant health information (for example, allergies, conditions or injuries that coaches or first-aiders should know about). For youth players, we collect this from a parent or guardian, along with the parent or guardian's own contact details. Registration information is collected by the club directly (for example, by email or a registration form sent to you), not through the public website.

Kit orders. We collect your name, contact details, the items, sizes and quantities ordered, any personalization (such as a name or number) and a record of payment status.

Payments. The website does not take payments. Membership fees and kit orders are confirmed by the club by email and paid offline or through a payment link sent by the club treasurer. If you use a payment link, the payment is processed by the payment provider under its own terms and privacy policy. We receive confirmation of payment, the amount and limited details such as your name and email address; we do not receive or store your full card number.

Correspondence. We keep emails and messages you send us so we can respond and keep a record.

3.2 Information collected automatically

The website is a static site with no user accounts. It sets no advertising or analytics cookies and uses no tracking pixels or fingerprinting.

Server logs. Our hosting provider's servers automatically record technical information when your browser requests a page, typically your IP address, browser type and version (user agent), the page requested, the referring page, and the date and time. The hosting provider processes this to deliver the site, keep it secure and prevent abuse. We do not use server logs to identify or profile individual visitors.

Browser storage. The site uses your browser's localStorage and sessionStorage to remember your cookie-banner choice, whether you have dismissed the newsletter prompt, and, for the life of a single browser tab, your first name so the thank-you page can greet you after you submit a form. This information stays in your browser and is not sent to us. Details are in our Cookie Policy.

Self-hosted resources. All fonts, scripts and stylesheets are hosted on our own site, not third-party content delivery networks.

3.3 Information from third parties

Occasionally we receive information about you from others, for example:

a parent or guardian registering a youth player;
a payment provider confirming that you have paid;
a governing body or another club, for example when a player transfers or registration or insurance details need to be confirmed;
social media platforms, if you message us or tag the club (subject to your settings on that platform).

4. How we use your information

Responding to inquiries about playing, volunteering, sponsorship, membership and kit, and welcoming new players and volunteers.
Membership administration: registering members for the season, recording fees, keeping membership records and communicating about training, fixtures, meetings and club business.
Player registration and insurance with governing bodies, where required (see Section 8).
Health and safety: making sure coaches and first-aiders know relevant medical information, contacting emergency contacts, and recording injuries or incidents.
Kit orders: confirming orders, arranging payment, ordering from our supplier, arranging collection or delivery, and handling returns and refunds.
Newsletter: sending it to people who have opted in (see Section 6).
Club media: publishing photos, video and match reports (see Section 7).
Security: keeping the website running and free from spam and abuse.
Legal and governance: keeping financial and administrative records, complying with legal obligations, and establishing, exercising or defending legal claims.

We do not use automated decision-making or profiling. We do not sell your personal information, and we do not use it for targeted or cross-context behavioral advertising.

5. Legal bases for processing (EU and UK visitors)

If you are in the European Economic Area (EEA) or the United Kingdom, we must have a legal basis under Article 6 of the GDPR or UK GDPR for each use of your personal information. We rely on:

Consent (Article 6(1)(a)) to send our newsletter and, in some cases, to publish photographs in which you are the main subject. You can withdraw consent at any time; this does not affect earlier processing.
Contract (Article 6(1)(b)) to take steps at your request before, and then to perform, a membership or kit order.
Legal obligation (Article 6(1)(c)) to keep records the law requires, such as financial records, and to make legally required disclosures.
Vital interests (Article 6(1)(d)) to share medical or emergency-contact information with emergency services in an emergency.
Legitimate interests (Article 6(1)(f)) in running an amateur sports club: responding to inquiries, administering the club, keeping the website secure, maintaining club records and history, promoting the club and Gaelic games through general event photography, and defending legal claims. We rely on this only where your interests and rights do not override ours.

Health information is a "special category" of data. We process it on the basis of your explicit consent given at registration (Article 9(2)(a)), to protect vital interests where someone cannot consent (Article 9(2)(c)), or where necessary for legal claims (Article 9(2)(f)).

Our newsletter shares club news, fixtures, results, social events, fundraising and recruitment updates. It is entirely opt-in: you receive it only if you subscribe through the newsletter form or ask us to add you.

Every newsletter includes an unsubscribe link, or you can email [email protected]. Unsubscribing does not stop essential messages to members about their membership, training or fixtures.

We may use an email service provider, acting as our processor, to store the list and send the newsletter. We never sell or share our mailing list for anyone else's marketing.

7. Photography, video and media

The club may take photographs and video at games and events and publish them in the website gallery, newsletters and on our social media channels.

General event photography. We rely on our legitimate interest in recording and promoting the club and the sport.
Youth players. We ask parents and guardians for their photography preferences at registration and respect them. We do not publish the full names, addresses or contact details of youth players alongside their images.
Removal requests. If you appear in a photo or video published by the club and want it removed, or would prefer not to be photographed, email [email protected] with a link to or description of the image. We will remove it from our website and social media accounts, normally within 14 days, though we cannot control copies others have already shared.

Club photographs and videos are covered by our Terms of Use.

8. Membership, registration and governing bodies

Gaelic football in the United States is organized through governing bodies, including the United States Gaelic Athletic Association (USGAA), which require players to be registered and insured.

Where required for player registration and insurance, we share relevant registration details with the applicable governing bodies and their insurers or insurance administrators. This typically includes a player's name, date of birth, contact details, club and registration category, and may include information needed for a transfer or to confirm eligibility. If an injury occurs and a claim is made, we may share relevant details of the incident and injury with the insurer or claims administrator. These organizations handle the information under their own privacy policies.

Membership records are accessible only to the committee members and volunteers who need them for their club roles, such as the registrar, treasurer, secretary, coaches and team managers. Coaches and team managers receive the contact and medical information relevant to the players they look after.

We do not sell personal information or share it for cross-context behavioral advertising. We share it only as follows.

9.1 Service providers (processors)

We use a small number of service providers who process personal information only on our instructions and are required to protect it:

our website hosting provider, which serves the site and processes server logs for security;
form-handling and email services, which deliver form submissions to us and which we use for club email and the newsletter;
file storage and productivity tools used by committee members to keep club records;
payment providers, when you pay through a link sent by the treasurer;
our kit supplier, which receives the item, size and personalization details needed to fulfill orders and, for direct delivery, a name and address.

9.2 Governing bodies, insurers and event organizers

We share registration information with governing bodies and insurers as described in Section 8, and we may share team lists with the organizers of tournaments and games our teams enter.

9.3 Legal reasons and emergencies

We may disclose information if we believe in good faith that it is necessary to comply with the law or legal process, to protect anyone's safety (including in a medical emergency), to report safeguarding concerns to the appropriate authorities, to prevent fraud or abuse, or to establish, exercise or defend the club's legal rights.

9.4 Organizational changes

If the club merges, is reorganized or transfers its activities to a successor organization, personal information may be transferred as part of that process, and we will make sure the recipient continues to protect it in line with this policy.

10. International transfers

The club is based in the United States, and the information we collect is stored and processed in the United States. Some service providers may process information in other countries.

The United States may not offer the same level of data protection as the EEA or UK. Where we transfer personal information from the EEA or UK, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant) or a recipient's certification under the EU-U.S. Data Privacy Framework and its UK extension. Some transfers, such as when you contact us from abroad about joining, are necessary to respond to your request or perform a contract with you.

11. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, including legal, accounting, insurance and governance requirements. After that, we delete or anonymize it securely.

Retention periods for personal information
Type of information	How long we keep it	Why
Contact form submissions and general correspondence	Up to 24 months after our last communication with you	To follow up on your inquiry and keep a record of what was discussed
Newsletter subscription	Until you unsubscribe; afterwards your address is kept on a suppression list only	To send the newsletter and make sure we do not email you after you unsubscribe
Membership and player registration records	For the duration of your membership and up to 7 years after it ends	Club administration, insurance, governing-body requirements and potential claims
Health information	For the current season, refreshed at each registration, unless linked to an injury or incident record	Player safety and first aid
Injury and incident records	Up to 7 years after the incident; for a minor, until at least 3 years after they turn 18; longer while a claim is open	Insurance claims and legal obligations
Kit orders, payments and sponsorship records	Up to 7 years after the end of the financial year concerned	Financial record-keeping, returns and refunds
Photographs and video	Kept in the club archive as a record of club history, unless you ask us to remove an image	Club history and promotion
Server logs	Kept by our hosting provider for a limited period, typically no longer than 90 days	Website security and abuse prevention
Browser storage (localStorage)	On your device until you clear it	Remembering your cookie-banner choice and dismissed notices
Browser storage (sessionStorage)	On your device until you close the browser tab	Personalizing the thank-you page after you submit a form

We may keep information longer where the law requires it or to resolve a dispute or claim.

12. How we protect information

We take reasonable administrative, technical and physical measures to protect personal information against loss, misuse and unauthorized access, disclosure, alteration and destruction. These include:

serving the whole website over encrypted HTTPS;
keeping the site static, with no user accounts, visitor databases or on-site payments;
limiting access to membership and medical records to the volunteers who need them;
using club-controlled accounts with strong passwords and, where available, multi-factor authentication, and removing access when volunteers step down.

No internet transmission or electronic storage is completely secure, so we cannot guarantee absolute security. Please do not send highly sensitive information, such as full medical records, Social Security numbers or card details, through the contact form or by ordinary email. If a security incident affects your personal information, we will notify you and the relevant authorities where the law requires.

13. Your privacy rights

Depending on where you live, you may have some or all of the rights below. We will honor reasonable requests from anyone, wherever they live, as far as we are able.

13.1 Rights under the GDPR and UK GDPR

If you are in the EEA or UK, you have the right to:

access a copy of the personal information we hold about you;
rectify inaccurate or incomplete information;
erase your information where there is no good reason for us to keep it;
restrict how we use your information in certain circumstances;
data portability for information you gave us on the basis of consent or contract;
object to processing based on legitimate interests, and to direct marketing at any time;
withdraw consent at any time where we rely on it;
complain to your local data protection authority (see Section 20).

13.2 How to make a request

Email [email protected] or use our contact page, telling us which right you wish to exercise. We will:

acknowledge your request promptly;
verify your identity, normally by confirming details we already hold (such as replying from the email address you used with us), so that we do not disclose or delete someone else's information;
respond within one month for GDPR and UK GDPR requests, or within 45 days for US state law requests, telling you if we need more time;
not charge a fee, unless a request is manifestly unfounded or excessive.

You may use an authorized agent; we may ask for your signed permission and to verify your identity directly. A parent or guardian may make requests on behalf of a child. Some rights have exceptions, for example where we must keep records for legal, insurance or governing-body reasons, and we will explain if we cannot fully meet a request. We will never discriminate or retaliate against you for exercising your rights.

14. California residents

As a small, volunteer-run amateur club, Wild Geese GFC may not be a "business" subject to the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the "CCPA"). Because we are based in California and believe these rights are worthwhile, we nonetheless choose to honor them.

14.1 Categories of personal information

In the past 12 months we have collected the following categories, as described in Section 3: identifiers (name, email, phone, address, IP address); personal records under California Civil Code section 1798.80(e) (including limited medical information); characteristics of protected classifications (age or date of birth, for registration and eligibility); commercial information (membership fees and kit orders); internet activity (limited server logs processed by our host); audio and visual information (photos and video); and sensitive personal information (limited health information, used only for player safety, first aid and insurance, and not to infer characteristics about you).

14.2 Your California rights

Right to know and access the categories and specific pieces of personal information we have collected, its sources, our purposes and the categories of recipients.
Right to delete personal information we collected from you, subject to legal exceptions.
Right to correct inaccurate personal information.
Right to opt out of sale or sharing. We do not sell personal information and we do not share personal information for cross-context behavioral advertising, and have not done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16.
Right to limit use of sensitive personal information. We use it only for purposes permitted by law, such as providing the services you request and ensuring safety.
Right to non-discrimination for exercising any of these rights.

To make a request, follow Section 13.2.

14.3 California "Shine the Light"

California Civil Code section 1798.83 lets California residents request information about personal information disclosed to third parties for their own direct marketing purposes in the preceding calendar year. We do not disclose personal information to third parties for their own direct marketing.

15. Residents of other US states

Many US states, including Colorado, Connecticut, Virginia, Texas and Oregon, have consumer privacy laws generally giving rights to access, correct, delete and port personal information and to opt out of its sale, targeted advertising and certain profiling. These laws may not apply to a small amateur club, but we will honor access, correction, deletion and portability requests from residents of any state using the process in Section 13.2. We do not sell personal information or use it for targeted advertising or profiling.

If we decline your request, you may appeal by replying with "Appeal" in the subject line. A different committee member will review it and respond within 45 days. If you are not satisfied, you may contact your state attorney general.

16. Do Not Track and Global Privacy Control

Do Not Track (DNT). There is no common standard for responding to DNT browser signals, so we do not respond to them in a particular way. Our site does not track visitors across websites or over time, whether or not DNT is enabled.

Global Privacy Control (GPC). GPC is a browser signal asking websites not to sell or share your personal information. We treat it as a valid opt-out request for that browser. Because we do not sell or share personal information and the site sets no advertising or analytics cookies, there is nothing further to switch off, but we honor GPC in principle and will continue to if our practices change. See our Cookie Policy.

17. Children's privacy

Our website is not directed to children under 13, and we do not knowingly collect personal information online from children under 13. Children should not use the contact or newsletter forms; a parent or guardian should contact us on their behalf.

Youth participation in the club always requires a parent or guardian. Youth players' information is collected from the parent or guardian at registration, and parents and guardians may review, correct or ask us to delete their child's information, or withdraw consent to further use, by emailing [email protected].

If we learn that we have collected personal information online from a child under 13 without verifiable parental consent, as required by the Children's Online Privacy Protection Act (COPPA), we will delete it promptly. If you believe a child has sent us personal information, please contact us.

18. Third-party links and embedded content

Social media links. The website links to the club's pages on Facebook, X (formerly Twitter) and Instagram. These are ordinary links; no social media scripts, buttons or pixels load on our pages. When you follow a link, the platform's own privacy policy and cookies apply.

Embedded YouTube videos. Videos are shown as a preview image hosted on our own site, and nothing is requested from YouTube until you click play. Once you do, YouTube (owned by Google) may set cookies, collect information about your device and viewing, and link it to your Google account if you are signed in, under Google's privacy policy rather than ours.

Other links. We are not responsible for the content or privacy practices of other websites we link to.

19. Changes to this policy

We may update this Privacy Policy, for example if we change how the website works, start using a new service provider, or the law changes. We will update the "Last updated" date above and, for significant changes, take reasonable steps to let you know, such as a notice on the website or an email where we have your address and the change affects you. Where the law requires your consent to a change, we will ask for it.

20. Contact us and complaints

If you have questions about this policy, want to exercise your rights, or have a concern about how we have handled your information, please contact us:

Privacy matters: [email protected]
General inquiries: [email protected]
Online: our contact page

We aim to acknowledge privacy messages within 5 business days.

If you are not satisfied with our response, you may complain to a data protection or consumer protection authority: in the EEA, the supervisory authority where you live or work; in the UK, the Information Commissioner's Office (ICO); in California, the California Privacy Protection Agency or the California Attorney General; in other US states, your state attorney general. We would, however, appreciate the chance to address your concerns first.