01Who we are
Ruckr is the rugby club software service operated as Ruckr Rugby (“Ruckr”, “we”, “us”). Contact [email protected] about the service, these documents or Ruckr’s handling of personal information. Your club is a separate organisation; its name and contact details should appear in its own policies.
02Scope and status
Ruckr’s features can involve children, health information, safeguarding concerns, linked family access, public media and information shared between clubs. Those activities can create elevated risk and may require a data protection impact assessment before use. This public summary describes the design considerations; its draft status does not evidence a completed or approved assessment for every deployment.
Ruckr must assess its own processing and support club controllers with relevant information. Each club must assess its specific purposes, people, scale, recipients and local safeguards. A generic product summary cannot decide those matters for the club.
03Information and people affected
Members, children, guardians, volunteers, coaches, officers, guests, payers and people named in reports can be affected. Relevant information includes membership and contact records, family links, medical and welfare records, messages, images, payment records and optional workout information. The provider register describes external processing.
04Principal risks
An incorrectly granted role or guardian link can expose private records. Public content or free text can identify a child. A shared phone, downloaded report, calendar link or offline copy can disclose information beyond its intended audience. An old consent can be mistaken for permission to a changed use.
Further risks include retaining information too long, deleting evidence that must lawfully remain, missing an urgent concern, inaccurate safety information, an unassessed provider transfer and personal information placed in an optional AI prompt. Access logs and permissions reduce risk but do not eliminate human error.
05Controls in the product
The design uses scoped roles, server/database access checks, separate handling for sensitive records, audit events, guardian controls, versioned notices and consent records, and configured retention and export tools. Public/media controls restrict what can be shown; authorised users must still check unstructured content and external copies.
The app separates notice acknowledgement from consent, preserves earlier answers and records each answer with the notice version it was given to. Media publication must respect the applicable permission and current notice. Optional health and device connections have separate controls. Controls need testing and monitoring as the product and club policies change.
06Controls outside the product
Clubs need trained and available people, clear policies, secure devices, accurate roles, lawful-basis assessments, recipient checks and procedures for requests and incidents. Hosts and visiting clubs need agreed safeguarding and data-sharing responsibilities. Ruckr needs operational security, provider due diligence, incident handling and a documented transfer and retention approach.
07Residual risk, review and consultation
No technical measure removes every risk. Review the assessment when purposes, recipients, scale, sensitive data, public features or provider arrangements change. Record decisions and seek views from affected people where appropriate. Where a required DPIA identifies high risk that cannot be reduced sufficiently, the controller must consider the applicable prior-consultation duty before processing.
Ask Ruckr for relevant technical and organisational information for your assessment. Security-sensitive details may be shared under suitable confidentiality arrangements. Do not describe this summary or an app status as regulator approval.