Most small clubs know they should have a privacy policy, and most put it off because the examples online are written for big companies and run to two thousand words of legalese. You do not need that. Below is a short, plain-English template you can copy, fill in the bracketed bits, and publish. It covers what GDPR actually expects of a small UK club, society or charity — no more, no less. (For the why behind each part, see our plain-English GDPR guide.)
This is a template, not legal advice. It fits a typical small volunteer-run group that holds a membership list and takes enquiries through a website. If your group does anything less usual — handling health data, working with children, running paid services — check the ICO's own guidance or take advice.
The template
Copy everything between the lines, replace the [bracketed] parts, and put it on a page called "Privacy" in your site's footer.
Privacy policy for [Club / society / charity name]
Last updated: [date]
Who we are. [Club name] ("we") is a [sports club / society / registered charity, charity number 0000000] based in [town/area]. For any questions about your data, contact [role, e.g. the Secretary] at [contact email].
What we collect. We collect the personal details you give us when you join, enquire or sign up to an event — typically your name, email address, phone number and [any other field you actually use, e.g. emergency contact]. If you use our contact form, we receive what you type into it.
Why we hold it, and our lawful basis. We use your details to run the club: to manage membership, let you know about meetings, fixtures and events, and reply to your enquiries. Our lawful basis is [legitimate interest in running the club / your consent, for the mailing list]. We do not use your details for anything you would not reasonably expect.
Who we share it with. We do not sell or share your personal data. [If true: We use (name any processor — e.g. a website provider, a mailing tool) to operate our website and email, who process data on our behalf under their own policies.]
How long we keep it. We keep member details while you are a member and for [e.g. one year] afterwards, then delete them. Enquiries are kept for [e.g. 12 months].
Your rights. You can ask us what data we hold on you, ask us to correct it, or ask us to delete it. Email [contact email] and we will action it promptly. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).
Cookies. [If your site uses analytics or tracking: Our website uses cookies for (e.g. anonymous visitor statistics). We ask your consent before any non-essential cookies are set. / If not: Our website uses only the essential cookies needed to make it work.]
How to fill it in
- Lawful basis is the only slightly technical bit. For running the club, "legitimate interest" usually fits; for a marketing mailing list, you need "consent" (a real opt-in, not a pre-ticked box).
- Be honest about processors. If your site or mailing list runs on a third-party tool, name it. On Natterio, your site and any email run on our platform — you can simply say so.
- Keep it current. Re-read it once a year, or when you change how you collect data.
Where Natterio fits
A policy only works if the website behind it does what it says. Every Natterio site is UK-hosted, with cookie consent that genuinely blocks non-essential cookies until accepted, and a real way for members to export or delete their data — so the promises in the template above are actually kept by the site. You can paste this policy straight onto a Privacy page. Build your club's site free, and see what pages your site needs.