Know what you hold and why
Write a one-page list: members (name, contact, date of birth, group, rank, payments, attendance), staff (accounts, roles), and anything else (photos, medical notes, competition entries). For each, note why you need it. Fees and attendance are needed to run the club and to prove what was paid; a date of birth is needed for age groups and insurance; a medical note is needed only if you actually act on it.
Anything you cannot explain, stop collecting. Clubs often keep ID numbers or full addresses out of habit; if no process uses them, they are a liability, not an asset.
The legal basis for a club is usually simple
Running memberships, taking fees and organising training is the performance of your agreement with the member (or the parent). You do not need a signed consent form for that, and consent is the wrong basis for data you must keep anyway. Consent is for the optional extras: photos on social media, a newsletter, sharing results publicly. Ask for those separately and make saying no easy.
Children
Most clubs are mostly children. Collect the parent's or guardian's contact as the primary contact, keep the child's data to what the sport needs, and be strict about photos: a separate yes per child, revocable at any time. Coaches should not keep children's contact details in personal phones once they leave the club.
Who can see what
Not everyone at the club needs everything. A coach needs the group list, attendance and whether a member is paid for the month; they do not need to edit or delete payments or to see the club's bank movements. Roles in your tool should match this. A shared spreadsheet with one password fails here on day one.
How long to keep records
Payment records fall under accounting rules, which in most EU countries means keeping them for several years (in Bulgaria, ten for accounting documents). Member profiles of people who left should be reduced to what those rules require; attendance and notes about them can go. Set a yearly moment, for instance the end of the season, to clear what is no longer needed.
Member rights, in practice
A member can ask what you hold about them, ask you to correct it, and ask you to delete what you are not obliged to keep. For a club this means: be able to show one person's record and export it, and be able to remove a member while keeping the payment history in a form that no longer identifies them. Answer within a month.
Where the data lives
If you use a service, know where it stores data and who its sub-processors are, and have a data processing agreement with it (good services publish one). MyClubBook keeps data in the EU, limits access by role, logs who changed what, exports everything on request, and replaces a deleted member with an anonymous placeholder so the money records stay intact. Our privacy policy lists the details.
An afternoon's checklist
- One-page inventory of data and why you need it.
- A short privacy notice for members and parents (what, why, how long, their rights, who to contact).
- Separate, revocable consent for photos and marketing.
- Roles: coaches see and record, owners and managers manage.
- A retention rule and a yearly clean-up date.
- A data processing agreement with every service you use.
- One person who answers requests, and a way to export a member's record.
This is not legal advice
It is the practical minimum that small clubs settle on. National rules add details, especially about children and accounting retention; when in doubt, a short consultation with a lawyer who knows sports associations is cheap compared with the alternative.