Revised Date: July 31, 2025
Data Protection Policy for NCR Member Clubs
National Collegiate Rugby Organization, Inc. (“NCR”) has the responsibility to protect and safeguard the confidentiality of the personal data of all of its members. Specifically, NCR must (i) comply with Federal and State data privacy laws and (ii) protect against the risk of a data breach. A data breach may irreparably harm your Club and NCR and everyone who works for NCR or is affiliated with a NCR-sanctioned event bears some responsibility for maintaining the security and confidentiality of all personal data collected, held or processed by NCR.
However, certain specific individuals have key areas of responsibility. Therefore, NCR has developed the following Data Protection Policy for NCR Member Clubs:
Access to the NCR Database Systems & Personal Data
Generally, the only people who should have access to the NCR Database Systems and Personal Data are those people who need such access for their NCR-related work.
Sport:80 Membership System: Only the designated Conference Commissioner and up to two (2) additional people, as directed by the Commissioner, in each Conference shall have access to the NCR Membership System. The additional people shall be granted access for the sole purpose of assisting the Conference Commissioner in fulfilling their duties. Each person with access to the Membership System is required to have a signed copy of this policy on file with the National Office. Others in the Conference may be provided with access to the Membership Verification for Event Directors webpage for the purpose of verifying NCR memberships and obtaining other non-personal information. For clarification, Event Directors who are granted access to the Membership Verification for Event Directors webpage must also sign this Data Protection Policy and provide a copy to the National Office prior to gaining access to such webpage.
- Club System: Only the designated Association Club Chair and up to one (1) additional person, as directed by the President of the Association, in each Association shall have access to the NCR Club System. The additional person shall be granted access for the sole purpose of assisting the Club Chair in fulfilling their duties. Each person with access to the Club System is required to have a signed copy of this policy on file with the National Office.
- Calendar/Sanction System: Only the designated Association Sanction Coordinator and up to one (1) additional person, as directed by the President of the Association, in each Association shall have access to the NCR Calendar System. The additional person shall be granted access for the sole purpose of assisting the Sanction Coordinator in fulfilling their duties. Each person with access to the Calendar System is required to have a signed copy of this policy on file with the National Office.
- NCR Association Management Area: Only the designated Association Treasurer will have accounting-only access to the NCR Association Management Area and the designated Association Secretary will have read-only access to the NCR Association Management Area. Each person with access to the Association Management Area is required to have a signed copy of this policy on file with the National Office.
- Officials Database: Only the designated Certifications Chair and up to one (1) additional person, as directed by the President of the Association, in each Association shall have access to the Officials Database. The additional person shall be granted access for the sole purpose of assisting the Certifications Chair in fulfilling their duties. Each person with access to the Officials Database is required to have a signed copy of this policy on file with the National Office.
Association/Event Director Access Policies
As an individual who has access to any NCR database system I understand I:
- am not permitted to allow others to access the NCR database systems with my User ID or password.
- am not permitted to use the data contained in NCR database systems for any purpose other than for NCR business.
- must use the NCR Email Marketing to deliver email blasts to groups (10 or more) of NCR members. In limited situations where email communications may have to be sent from a personal email account (e.g., gmail, hotmail, AOL, yahoo and/or through Microsoft Outlook), I am required to blind copy all email addresses by placing them in the BCC address line (blind carbon copy).
- will keep all data secure by taking sensible precautions such as:
- ensure computer screens are locked when unattended;
- not saving copies of personal data directly to laptop or home computer hard drives, mobile devices or smart phones;
- not leave printouts containing personal data or confidential information where unauthorized persons can see or have access to them; and
- shredding and securely discarding printouts containing personal data or confidential information when no longer required.
- will alert the National Office and/or my Association when I am no longer in a position to require access to the NCR database system and need to be removed.
NOTWITHSTANDING ANYTHING CONTAINED IN THIS DATA PROTECTION POLICY TO THE CONTRARY, THE PRESIDENT OF THE ASSOCIATION’S DECISION SHALL CONTROL IF THERE IS A DISPUTE AS TO WHETHER TO PERMIT ANY PERSON ACCESS TO THE NCR DATABASE AND PERSONAL DATA.
I have read the above Data Protection Policy and agree to uphold the policy while in my position with my NCR Association (or as an Event Director) and indefinitely after I no longer hold this position. Should I have any questions about appropriate use of any information contained in the NCR databases to which I have access, I will contact the NCR National Office membership department for guidance.
