Franchise Senior Sports Document Center

Privacy Policy

Franchise Senior Sports, Inc. (FSS), a 501(c)(3) nonprofit organization, is committed to protecting the privacy and personal information of our senior participants, donors, volunteers, employees, franchise operators, and

Category
Compliance
Version
1.5
Effective date
9/1/2026
Owner
Franchise Senior Sports, National Office
Next review
9/1/2027
Audience
Public,Participant,Volunteer,Staff,Board

Download document

Privacy Policy

Purpose

Franchise Senior Sports, Inc. (FSS), a 501(c)(3) nonprofit organization, is committed to protecting the privacy and personal information of our senior participants, donors, volunteers, employees, franchise operators, and website visitors. This comprehensive privacy policy outlines how we collect, use, store, share, and protect personal information across all FSS operations, franchise territories, and digital platforms. FSS recognizes the particular importance of data protection for our senior population, who may be disproportionately targeted by identity theft and fraud, and implements enhanced safeguards accordingly.

Scope

This policy applies to all personal information collected by FSS, whether through our website (franchiseseniorsports.org), franchise territory operations, league registration systems, mobile applications, events, donation platforms, volunteer management systems, or any other interactions with FSS at the national or franchise territory level. This policy applies to data collected both online and offline.

Definitions

Personally Identifiable Information (PII)

PII refers to any information that can be used to identify, contact, or locate a specific individual, either alone or in combination with other data. This includes but is not limited to name, address, phone number, email address, date of birth, Social Security number (collected only when legally required), and financial account information.

Protected Health Information (PHI)

PHI refers to any health-related information that is linked to an identifiable individual. For FSS, this includes pre-participation health screening forms, physician clearance letters, medical condition disclosures, medication information, injury reports, and any health data collected to ensure safe participation in FSS athletic programs.

Sensitive Information

Sensitive information includes any data requiring heightened protection, such as financial account numbers, health data, background check results, Social Security numbers, government-issued identification numbers, and biometric data.

Data Subject

A data subject is any individual whose personal information is collected, stored, or processed by FSS, including participants, donors, volunteers, employees, franchise operators, website visitors, and event attendees.

Information We Collect

Participant Information

  • Full legal name, preferred name, date of birth, and gender
  • Home address, phone number(s), and email address
  • Emergency contact information (name, relationship, phone number, email)
  • Health screening data, including pre-participation physical assessment forms and physician clearance documentation
  • Medical conditions relevant to safe sports participation (e.g., heart conditions, joint limitations, diabetes, respiratory conditions, medication that may affect physical activity)
  • Physician clearance forms for participation in FSS sports programs
  • Insurance information for injury-related claims
  • League registration history, sport preferences, skill assessments, and competitive division placement
  • Photographs and video taken during FSS events and activities (collected only with written consent via the FSS Media Release Form)
  • Participation attendance records and performance statistics
  • Accessibility needs and accommodation requests
  • Dietary restrictions for events where food is provided

    • Donor and Sponsor Information

  • Name and contact information (address, phone, email)
  • Donation history, amounts, and designated purposes
  • Payment information (credit card numbers, bank account details) processed securely through PCI-compliant payment processors and not stored on FSS systems
  • Communication preferences and opt-in/opt-out selections
  • Corporate sponsorship details, agreements, and contact persons
  • Employer matching gift information
  • Planned giving and estate gift documentation

    • Volunteer and Employee Information

  • Name, contact information, date of birth, and emergency contacts
  • Background check results (stored securely with restricted access and retained per legal requirements)
  • Training certifications, CPR/First Aid credentials, and volunteer service records
  • Employment applications, resumes, and references
  • Payroll records, tax withholding information, and direct deposit details for employees
  • Performance evaluations and disciplinary records

    • Website and Digital Information

  • IP addresses, browser type, operating system, and device information
  • Website usage data, pages visited, time spent, and navigation patterns
  • Email communication preferences, open rates, and click-through data
  • Online registration and donation transaction records
  • Search queries on the FSS website

    • Purpose Limitation

    FSS collects and processes personal information solely for the following stated purposes: administering sports programs and leagues for senior participants, ensuring participant health and safety, processing donations and issuing tax documentation, managing franchise territory operations, communicating with stakeholders about FSS programs and opportunities, complying with legal and regulatory requirements, and improving FSS programs through data analysis. Personal information shall not be used for purposes incompatible with those stated above without obtaining additional consent from the data subject.

    Consent and Opt-In/Opt-Out Mechanisms

    FSS obtains consent for data collection through clear, affirmative actions by the data subject. Consent mechanisms include written consent forms during participant registration and league enrollment, online consent checkboxes during website registration and donation processing (pre-checked boxes are not used), verbal consent documented by FSS staff during phone registrations, and separate opt-in consent for photography, media use, and marketing communications. Individuals may withdraw consent at any time by contacting the FSS Privacy Officer. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal. FSS provides opt-out mechanisms in every marketing email and communication, including a one-click unsubscribe link and the ability to manage communication preferences through the FSS participant portal.

    Data Minimization

    FSS adheres to the principle of data minimization, collecting only the minimum amount of personal information necessary to fulfill the stated purposes. Staff and franchise territory operators are trained to avoid collecting unnecessary data and to regularly review data collection forms and processes to eliminate fields that are not essential.

    How We Use Information

    Participant Data

  • To register participants in sports leagues and programs across franchise territories
  • To ensure participant safety through health screenings, medical awareness, and emergency preparedness
  • To communicate league schedules, game results, facility changes, and program updates
  • To track participation history, recognize achievements, and award milestone recognitions
  • To improve programs based on participant feedback, satisfaction surveys, and data analysis
  • To comply with insurance requirements and manage injury-related claims
  • To conduct program evaluation and measure health and wellness outcomes

    • Health Information

  • Participant health data is used solely for the purpose of ensuring safe participation in FSS athletic programs
  • Health data is shared only with authorized FSS staff, coaches, and on-site medical personnel on a need-to-know basis
  • Health data is never used for marketing purposes or shared with third parties for commercial purposes
  • FSS is not a HIPAA-covered entity; however, FSS voluntarily adopts HIPAA-aligned best practices for handling participant health information, recognizing the sensitivity of health data for our senior population
  • Franchise territories must follow FSS health data handling standards, which incorporate applicable elements of the HIPAA Privacy Rule and Security Rule as organizational best practices

    • Donor and Sponsor Data

  • To process donations and issue IRS-compliant tax receipts and acknowledgment letters
  • To acknowledge and recognize donor contributions at appropriate levels
  • To communicate with donors about FSS programs, impact reports, and giving opportunities
  • To fulfill sponsorship agreement obligations and deliver sponsor benefit reports
  • To maintain accurate records for financial audits and IRS Form 990 reporting

    • Data Retention Periods

    FSS retains personal information only for as long as necessary to fulfill the purposes for which it was collected or as required by law. Specific retention periods by category include: participant registration records retained for seven (7) years after last active participation, health screening and physician clearance forms retained for seven (7) years after last active participation, donation records and tax receipts retained for seven (7) years per IRS requirements, volunteer records retained for five (5) years after last active service, employee records retained for seven (7) years after separation, background check results retained for three (3) years or as required by state law (whichever is longer), website analytics data retained for three (3) years in anonymized form, incident and injury reports retained for ten (10) years, and email communication logs retained for three (3) years.

    Data Subject Rights

    FSS respects the rights of all data subjects regarding their personal information. Individuals have the right to:

    Right of Access

    Request and receive a copy of all personal information held by FSS about them, provided within 30 days of a verified request.

    Right to Correction

    Request correction of inaccurate or incomplete personal information. FSS will process correction requests within 15 business days.

    Right to Deletion

    Request deletion of their personal information, subject to legal retention requirements and legitimate organizational interests. FSS will process deletion requests within 30 days and confirm completion in writing.

    Right to Data Portability

    Request their personal information in a structured, commonly used, machine-readable format (e.g., CSV or JSON) for transfer to another organization.

    Right to Restriction of Processing

    Request that FSS limit the processing of their personal information under certain circumstances, such as when the accuracy of the data is contested or when the processing is no longer necessary but the data subject requests retention for legal claims.

    Right to Object

    Object to the processing of their personal information for direct marketing purposes. FSS will cease processing for marketing within 10 business days of receiving an objection.

    To exercise any of these rights, individuals should contact the FSS Privacy Officer at hello@franchiseseniorsports.com or +1 (314) 374-4105. FSS will verify the identity of the requestor before processing any request.

    Data Protection and Security

    Technical Security Measures

  • Encryption of personal data at rest using AES-256 encryption for all databases and file storage systems containing PII or PHI
  • Encryption of data in transit using TLS 1.2 or higher for all data transmitted between systems, including between the National Office and franchise territories
  • Firewalls, intrusion detection systems, and anti-malware software on all systems processing personal data
  • Regular vulnerability scanning and annual penetration testing of FSS systems
  • Automated system monitoring and alerting for suspicious access patterns

    • Access Controls

  • Role-based access controls (RBAC) limiting data access to authorized personnel based on job function and need-to-know
  • Unique user accounts for all staff and franchise operators with no shared credentials
  • Multi-factor authentication (MFA) required for all systems containing participant data, health information, donor records, and financial data
  • Automatic session timeout after 15 minutes of inactivity
  • Quarterly access reviews to ensure appropriate access levels and prompt removal of access upon separation

    • Password Policies

  • Minimum 12-character passwords with complexity requirements (uppercase, lowercase, numbers, special characters)
  • Password changes required every 90 days
  • Password history enforcement preventing reuse of the last 12 passwords
  • Account lockout after five consecutive failed login attempts

    • Physical Security

  • Physical records containing personal information stored in locked file cabinets in access-controlled areas
  • Visitor access logs maintained for areas where personal data is stored or processed
  • Clean desk policy requiring staff to secure all documents containing personal information when not in active use
  • Secure shredding of physical documents containing personal information prior to disposal

    • Data Breach Notification Procedures

    In the event of a confirmed data breach involving personal information, FSS shall take the following actions:

    Immediate Response (Within 24 Hours)

  • Contain the breach by isolating affected systems and preventing further unauthorized access
  • Initiate an investigation to determine the scope, cause, and type of data compromised
  • Notify the Executive Director and Privacy Officer immediately
  • Engage forensic experts if the breach involves sophisticated cyberattack or extensive data exposure

    • Notification to Affected Individuals (Within 72 Hours)

  • Notify affected individuals in writing (email and postal mail) within 72 hours of confirming the breach
  • Notification shall include a description of the incident, the types of information compromised, steps FSS is taking to address the breach, recommendations for individuals to protect themselves (e.g., credit monitoring, password changes), and contact information for the FSS Privacy Officer
  • For breaches involving Social Security numbers or financial account information, FSS shall offer complimentary credit monitoring services for a minimum of 12 months

    • Regulatory Notifications

  • Notify the applicable state Attorney General as required by state data breach notification laws (notification timelines vary by state; FSS shall comply with the most restrictive applicable timeline)
  • For breaches affecting 500 or more individuals, notify the Federal Trade Commission
  • Maintain a breach log documenting all incidents, responses, and corrective actions

    • Vendor and Third-Party Data Sharing

    FSS does not sell, rent, or trade personal information to third parties. When FSS engages third-party service providers who may access personal information (e.g., payment processors, email platforms, league management software), FSS shall conduct due diligence on the vendor's data security practices before engagement, execute a Data Processing Agreement (DPA) requiring the vendor to protect personal information to standards at least as protective as this policy, limit the vendor's access to the minimum data necessary for the contracted service, require the vendor to notify FSS of any data breach within 24 hours, and conduct annual reviews of vendor compliance with data protection requirements.

    Children's Data (COPPA Compliance)

    FSS programs are designed exclusively for adults aged 55 and older. FSS does not knowingly collect personal information from children under the age of 13 in compliance with the Children's Online Privacy Protection Act (COPPA). If FSS becomes aware that it has inadvertently collected data from a child under 13, that data will be deleted immediately. Website visitors under 13 are not permitted to register, donate, or submit personal information through FSS digital platforms.

    Cross-Border Data Transfers

    FSS primarily operates within the United States. In the event that personal data is transferred outside the United States (for example, if a franchise territory is established in another country), FSS shall ensure that appropriate safeguards are in place, including standard contractual clauses or other legally recognized transfer mechanisms, to protect the data in accordance with this policy and applicable international data protection laws.

    Cookies and Website Tracking

    The FSS website uses cookies and similar tracking technologies to improve user experience and analyze website traffic. Categories of cookies used include: strictly necessary cookies required for website functionality (e.g., session management, security), analytics cookies (e.g., Google Analytics) to understand how visitors use the website, and preference cookies to remember user settings and choices. FSS does not use advertising or retargeting cookies. Visitors may manage cookie preferences through their browser settings. The FSS website displays a cookie consent banner on first visit, allowing users to accept or decline non-essential cookies. Analytics data is collected in anonymized or aggregated form whenever possible.

    Social Media Data Practices

    FSS maintains official accounts on social media platforms including Facebook, Instagram, and YouTube. When individuals interact with FSS on social media, FSS may collect publicly available information from their social media profiles. FSS does not integrate social media data with participant, donor, or volunteer records without explicit consent. Franchise territories managing local social media accounts must follow FSS social media data guidelines and may not collect or store personal information obtained through social media interactions without National Office approval.

    Franchise Territory Data Responsibilities

    Each franchise territory is responsible for implementing this Privacy Policy within its operations. Franchise territory obligations include designating a local data protection point of contact, ensuring all territory staff and volunteers complete FSS data protection training, implementing FSS-approved data security measures for all systems containing personal information, reporting any data breach or suspected breach to the National Office Privacy Officer within 24 hours, cooperating with annual privacy audits conducted by the National Office, and maintaining data handling practices consistent with this policy and all applicable state and local privacy laws in the territory's jurisdiction.

    Data Protection Officer

    FSS designates a Privacy Officer responsible for overseeing compliance with this Privacy Policy, responding to data subject requests, conducting privacy impact assessments, managing breach response procedures, coordinating annual privacy audits, providing guidance to franchise territories on data protection matters, and serving as the primary point of contact for privacy-related inquiries. The Privacy Officer reports to the Executive Director and provides quarterly privacy compliance reports to the Board of Directors.

    Privacy Impact Assessments

    FSS shall conduct a Privacy Impact Assessment (PIA) before implementing any new program, technology, or process that involves the collection or processing of personal information. PIAs shall identify the types of data to be collected, assess the privacy risks associated with the processing, evaluate the necessity and proportionality of the data collection, and recommend safeguards and mitigation measures. PIAs are required for new league management software, registration platforms, franchise territory data systems, and any program involving the collection of health information from participants.

    Annual Privacy Audit

    The Privacy Officer shall coordinate an annual privacy audit evaluating FSS compliance with this policy across all operations and franchise territories. The audit shall include a review of data collection practices, access controls, vendor agreements, breach response procedures, staff training records, and data retention compliance. Audit findings shall be reported to the Executive Director and Board of Directors, with corrective action plans for any identified deficiencies.

    Training Requirements

    All FSS employees, volunteers, franchise operators, and contractors who handle personal information shall complete privacy and data protection training within 30 days of beginning their role and annually thereafter. Training shall cover the requirements of this Privacy Policy, identification and handling of PII and PHI, data breach recognition and reporting procedures, secure data handling and disposal practices, and phishing and social engineering awareness. Training completion records shall be maintained by the Human Resources department and verified during annual privacy audits.

    State Privacy Law Compliance

    FSS shall comply with all applicable state privacy laws in jurisdictions where FSS and its franchise territories operate, including but not limited to the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act, the Connecticut Data Privacy Act, and other state privacy laws as enacted. For participants, donors, and other data subjects residing in states with comprehensive privacy legislation, FSS shall honor all rights and obligations mandated by those laws, including expanded rights of access, deletion, and opt-out of data sales (noting that FSS does not sell personal data).

    Data Disposal Procedures

    When personal information reaches the end of its retention period or is no longer needed for the purposes for which it was collected, FSS shall dispose of the data securely. Electronic data shall be permanently deleted using methods that render the data unrecoverable (e.g., cryptographic erasure or secure disk wiping). Physical documents shall be destroyed by cross-cut shredding or incineration. Data disposal shall be documented, including the date, method, and categories of data destroyed. Franchise territories must follow FSS data disposal procedures and report disposal activities to the National Office annually.

    Policy Administration

    Policy Owner: National Office and Board of Directors

    Approval Authority: Board of Directors

    Effective Date: Upon approval by the Board of Directors

    Review Cycle: At least annually and whenever applicable law, regulations, or FSS operations change

    Questions about this policy should be directed to the National Office at hello@franchiseseniorsports.com or +1 (314) 374-4105. FSS shall maintain the approval record, review date, and revision history with the official policy records. Any exception must be documented in writing and approved by the responsible executive and the Board of Directors when required. Violations may result in corrective action consistent with applicable law and FSS procedures.

    Contact Information

    For privacy-related questions, data subject requests, or to report a privacy concern, contact:

    Privacy Officer, Franchise Senior Sports, Inc.

    Email: hello@franchiseseniorsports.com

    Phone: +1 (314) 374-4105