Privacy Policy
This version reflects the live web platform and describes, where relevant, features that will apply once the mobile app launches. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
MBassett & Co LTD, trading as ClubHQ, is a company registered in England and Wales.
| Company Number | 17295778 |
| Registered Office | Unit 1-2 Technology Business Park, Moy Avenue, Eastbourne, England, BN22 8LD |
| [email protected] | |
| Data Protection Contact | Megan Clare Bassett |
| ICO Registration No. | ZC222861 |
| ICO Website | www.ico.org.uk |
For most of the personal data described in this policy, ClubHQ acts as data controller. Where a club or organisation uses ClubHQ to manage its members, the position is more nuanced. This is explained in full in Section 13.
2. What Personal Data We Collect
2.1 The ClubHQ Website
The website collects:
- Information you submit via our enquiry form (see Section 2.2);
- Technical data collected automatically by Cloudflare (our infrastructure provider), including IP address, browser type, device type, and approximate location, used for security, performance, and DDoS protection; and
- If you contact us by email, your email address and any personal information you include in your message.
We do not use analytics tools, tracking pixels, or advertising cookies on the current website.
Legacy waitlist data: Prior to this version of the policy, https://clubhq.uk operated a waitlist sign-up form. We have retired the waitlist and no longer collect new sign-ups through it. If you signed up to the waitlist before it closed, we continue to hold your data on the retention terms that applied at the time (see Section 8) until it is deleted or you ask us to remove it sooner. You can request deletion at any time by emailing [email protected].
2.2 Enquiry Form
When you submit an enquiry, for example to request a demo, ask about onboarding your club, or find out more about pricing, we collect:
- Name and email address;
- Club name;
- Club size;
- The pricing tier you are interested in; and
- Any additional message or information you choose to include.
At the point of submission, you will be asked to confirm a consent checkbox agreeing to be contacted by ClubHQ about your enquiry. We record the consent wording, and the date and time you agreed to it, in line with ICO guidance.
How this data is handled technically: your enquiry is transmitted by our email delivery provider (Resend, operating on Railway's infrastructure) directly to our team inbox, and is also recorded in our internal sales pipeline, which we maintain using Google Sheets (via Google Workspace). No other software is used to manage enquiries.
Lawful basis: your consent (UK GDPR Art. 6(1)(a)). You can withdraw consent at any time by emailing [email protected], and we will stop using your data for further contact, save for what we need to retain for record-keeping (see Section 8).
2.3 Full Platform: Account and Identity Data
The web platform is live and collects the following account and identity data:
- Email address, password, and full name (all required to create an account, these are the only mandatory fields);
- Username or display name (as configured by the club);
- Profile photograph (optional, if provided);
- Date of birth (optional, it is entirely up to the club and the individual member whether this is provided; it is never a mandatory field);
- Telephone number (optional, on the same basis as date of birth);
- Account credentials (passwords are stored using secure one-way hashing, never in plaintext).
We do not currently collect gender data. If this changes in a future version of the platform, we will update this policy before doing so.
2.4 Sport and Club Activity Data
The following is live on the web platform today and will also be available through the mobile app once it launches:
- Sport type, club or team membership, player roles;
- Match fixtures, training schedules, results, and attendance records;
- Performance statistics, scores, rankings, and conditioning logs;
- Injury and health records, where entered by a member or an administrator. See Section 2.7 for how we handle this;
- Committee documents, budgets, minutes, and task records (for committee users);
- Communications sent within the platform (messages, posts, announcements).
2.5 Payment Data
We do not currently process payments through the Service. We may integrate a third-party payment provider (such as Stripe) in the future to support subscription or membership fee collection. If we do, we will update this Privacy Policy before that feature goes live, and we will never store full card numbers or CVV codes ourselves.
2.6 Technical and Device Data
Web platform:
- IP address, device type, operating system, and browser type;
- App version and usage logs;
- Crash reports and diagnostic data;
- Cookie identifiers and similar technologies (see Section 11).
Mobile app (from September 2026): the mobile app will request the following device permissions:
- Camera and photo library: to allow you to upload or take a profile photo. This is optional and only accessed if you choose to add or change a photo.
- Location: our hosting infrastructure provider (Microsoft Azure) processes approximate location data as part of standard request handling and security monitoring. You can disable location permissions for the app at any time through your device settings; this does not affect your ability to use core platform features.
- Push notifications: with your permission, the app will send you notifications about fixtures, training, and club communications (see Section 5). You will be asked to allow notifications when you first install the app, and you can turn them on or off at any time through your device settings without affecting your ability to use core platform features.
The mobile app does not request access to your contacts.
2.7 Special Category Data (Including Injury and Health Information)
Injury and health data is live on the web platform and will also be available via the mobile app. It is classified as special category data under UK GDPR Article 9 because it carries a higher risk to your rights and freedoms, and requires a stricter legal basis than standard personal data.
The special category data we may process includes:
- Health and medical information: such as injury records, medical conditions relevant to participation, or fitness restrictions. This may be entered by you, or by an administrator (e.g. a coach logging a training injury).
This field is never mandatory. No member is required to enter injury or health data to use ClubHQ, and this cannot be changed by a club administrator, the choice always sits with the individual member.
We only process this data where a valid Article 6 lawful basis and an Article 9 condition are both met:
| Processing Activity | Article 6 Basis | Article 9 Condition |
|---|---|---|
| Injury records entered voluntarily by the member | Consent (Art. 6(1)(a)) | Explicit consent (Art. 9(2)(a)) |
| Injury records entered by an administrator on behalf of a member | Legitimate interests (Art. 6(1)(f)) for safeguarding and safe sport management | Preventive/occupational medicine and sport safety (Art. 9(2)(h)), or explicit consent where obtained |
| Sharing injury information in an emergency | Vital interests (Art. 6(1)(d)) | Vital interests (Art. 9(2)(c)) |
Where a club administrator relies on Article 9(2)(h), the club, as the controller responsible for that decision, is responsible for ensuring this condition is genuinely available to it (this condition requires that processing is carried out by, or under the responsibility of, a person subject to a duty of confidentiality, such as a suitably qualified welfare officer or medical professional). Where a club cannot meet this requirement, it should rely on explicit member consent instead. This responsibility is set out directly in the Data Processing Agreement each club accepts before using ClubHQ.
Where we rely on your consent, you may withdraw it at any time. This will not affect any processing that took place before withdrawal.
How injury data is structured and accessed: ClubHQ determines the fields and categories used to record injury data, and applies access controls so that this data is only visible to the roles a club's nominated administrator ("master user") chooses to grant access to. The club determines who within its organisation should have that access, and for which members. This is a joint arrangement between ClubHQ and the club. See Section 13.3 for what this means for you.
2.8 Data About Under-18s
Where ClubHQ is used to manage youth teams or clubs with members under the age of 18, we apply the following protections, informed by the ICO's Children's Code (Age Appropriate Design Code):
- Users aged 13 to 17: A parent or legal guardian must provide consent before an account is created. Where a club administrator adds a young person to the platform, the club is responsible for confirming that appropriate parental consent has been obtained before doing so.
- Children under 13: May not create accounts independently under any circumstances. All accounts for children under 13 must be created and managed by a parent, legal guardian, or responsible club administrator, with written parental consent on file.
- Data minimisation: We collect only the minimum data necessary for under-18 accounts. Optional fields such as telephone number and profile photograph are not required and should not be requested by administrators as a condition of participation.
- Default privacy settings: Under-18 profiles are set to the most restrictive visibility settings by default and are not visible to users outside the member's own club or team.
- No profiling or behavioural targeting: We do not profile under-18 users for commercial purposes or use their data for targeted advertising.
- Injury and health data for under-18s: Where injury or health data is processed in relation to a child, explicit written consent must be obtained from the parent or legal guardian, not the child. See Section 2.7.
- Club administrator responsibilities: If your club uses ClubHQ to manage under-18 members, you (as the club, acting as data controller for that data) are responsible for obtaining parental consent, providing an appropriate privacy notice to parents, and ensuring that any data entered about young people is accurate, necessary, and handled securely. The Data Processing Agreement each club accepts sets this obligation out directly.
We keep this approach under review as the platform and its user base develop, and will update this policy if our practices change.
3. How We Collect Your Personal Data
- Directly from you: when you sign up, register, complete your profile, submit an enquiry, send messages, log activity, or contact us.
- Automatically: through your use of the website or platform (IP address, device data, usage logs, cookies where applicable).
- Via Cloudflare: our infrastructure provider processes certain technical data as part of delivering and protecting the website.
- From other users: club administrators or coaches may add you to a team, entering your name, email, or other details on your behalf.
- From third-party sign-in providers: if you log in using Google or Apple, we receive your name, email address, and profile photo from those services.
4. Our Lawful Basis for Processing
4.1 Article 6 Lawful Bases (All Personal Data)
| Lawful Basis | Examples of Processing Activity |
|---|---|
| Contract Performance (Art. 6(1)(b)) | Creating and managing your account; delivering core platform features (fixtures, messaging, attendance). |
| Legitimate Interests (Art. 6(1)(f)) | Improving platform performance; preventing fraud; service notifications; Cloudflare and Azure security processing. We have carried out a legitimate interests assessment and are satisfied our interests are not overridden by your rights. |
| Consent (Art. 6(1)(a)) | Enquiry form follow-up and marketing emails; non-essential cookies; processing of health/injury data where relied upon. |
| Legal Obligation (Art. 6(1)(c)) | Responding to lawful requests from regulators or law enforcement; financial record-keeping where applicable. |
| Vital Interests (Art. 6(1)(d)) | In exceptional circumstances, to protect the life or safety of a participant. |
4.2 Article 9 Conditions (Special Category Data)
| Article 9 Condition | When We Use It |
|---|---|
| Explicit consent (Art. 9(2)(a)) | Where a member voluntarily enters their own injury or health data, or where a parent/guardian provides consent for an under-18 member. |
| Vital interests (Art. 9(2)(c)) | Where processing is necessary to protect the life of the data subject or another person and consent cannot be obtained in time. |
| Preventive/occupational medicine (Art. 9(2)(h)) | Where injury data is entered by a responsible administrator to support safe sport participation, and the club has confirmed this condition is genuinely available to it (see Section 2.7). |
5. How We Use Your Personal Data
We use the personal data we collect to:
- Respond to enquiries, arrange demos, and support onboarding.
- Create and manage your platform account and authenticate your identity.
- Deliver core ClubHQ features: member management, fixture scheduling, training, attendance, results, conditioning programmes, committee tools, and in-app messaging.
- Send push notifications and alerts about fixtures, training, and club communications (once available on mobile).
- Enable club administrators and coaches to manage their teams and access relevant member data.
- Allow committee members to manage documents, budgets, agendas, and tasks.
- Monitor and improve platform performance and fix technical issues.
- Comply with our legal obligations, resolve disputes, and enforce our Terms of Service.
- Detect, investigate, and prevent fraud or security incidents.
- Send marketing communications about ClubHQ updates and features, only with your consent, which you can withdraw at any time.
6. How and Why We Share Your Data
We do not sell your personal data. We share it in the following limited circumstances:
6.1 With Other Platform Users
Certain information (your name, profile photo, availability, and performance statistics) may be visible to other members of clubs or teams you have joined. Club administrators can configure visibility settings, subject to the default protections described in Section 2.8 for under-18 members.
6.2 With Club Administrators and Coaches
If you join a club or team through ClubHQ, the administrator or coach of that club will have access to your personal data as provided or generated through your participation. See Section 13 for a full explanation of how responsibility for your data is shared between ClubHQ and club administrators.
6.3 With Service Providers (Data Processors)
We work with trusted third parties who process data on our behalf, under written contractual obligations:
| Provider | Purpose |
|---|---|
| Microsoft Azure | Cloud hosting and data storage (UK South and UK West regions). |
| Cloudflare, Inc. | Website infrastructure, DDoS protection, and security. |
| Resend (via Railway infrastructure) | Transactional email delivery for the enquiry form and account emails. |
| Google Workspace / Google Sheets | Internal sales pipeline for enquiry data; support correspondence. |
| Expo (Expo Application Services) | Building the ClubHQ mobile apps and delivering push notifications (device push token, app metadata, notification content). |
| Sentry (Functional Software, Inc.) | Crash and error diagnostics from the mobile app (error details, device model and operating system, app version). |
All providers are bound by data processing agreements and may only process your data in accordance with our documented instructions.
6.4 Legal and Regulatory Disclosures
We may disclose personal data if required to do so by law, court order, or a lawful request from a public authority. Where legally permitted, we will notify you.
6.5 Business Transfers
In the event of a merger, acquisition, or sale of the business, your personal data may transfer to the acquiring party. We will provide notice before this takes place.
7. International Data Transfers
Most of our infrastructure is UK-based. Where a provider processes data outside the UK or EEA, we ensure appropriate safeguards are in place:
| Provider | Location | Transfer Mechanism |
|---|---|---|
| Microsoft Azure | UK (UK South / UK West) | No international transfer, data stays in the UK. |
| Cloudflare, Inc. | USA | Standard Contractual Clauses (SCCs). |
| Google Workspace | EEA | UK Addendum to the EU Standard Contractual Clauses. |
| Railway (Resend infrastructure) | USA | UK Extension to the EU to U.S. Data Privacy Framework. |
| Expo (Expo Application Services) | USA | Standard Contractual Clauses (UK Addendum). |
| Sentry (Functional Software, Inc.) | EU (Frankfurt) | Crash data is stored in the EEA, so there is no international transfer of the stored data; the US-incorporated processor's DPA (SCC / UK Addendum) covers the contractual relationship. |
Contact us to request further details of the specific safeguards in place for any transfer.
8. How Long We Keep Your Data
| Data Type | Retention Period |
|---|---|
| Legacy waitlist data (collected before the waitlist closed) | Until you unsubscribe or request deletion, or 24 months after the waitlist closed if unused. |
| Enquiry form data | Until consent is withdrawn or you ask us to delete it, or 24 months of inactivity following your last contact with us, whichever is sooner. |
| Platform account and profile data | Until account deletion, then 30 days for account recovery, then permanently deleted. |
| Injury and health records | 12 months from the date of membership ending or account closure, whichever is earlier. After this period, injury records are permanently deleted or anonymised, unless you have expressly consented to longer retention or we are required to retain them by law. If your club's governing body requires longer retention (for example, for insurance or welfare reporting), the club (as data controller for that requirement) is responsible for meeting it independently of ClubHQ's retention schedule. |
| Email and support correspondence | 3 years from the date of last contact. |
| Technical / server logs | Up to 12 months, unless required longer for security investigations. |
| Marketing consent records | Until consent is withdrawn, plus 3 years for record-keeping. |
| Parental consent records (under-18 members) | For the duration of the child's membership, plus 3 years after membership ends. |
9. Your Rights Under UK GDPR
As a data subject under UK GDPR, you have the following rights. Exercise any of them by contacting us using the details in Section 1.
9.1 Right to be Informed. This Privacy Policy fulfils that obligation.
9.2 Right of Access. You can request a copy of the personal data we hold about you (a Subject Access Request). We will respond within one calendar month, extendable by up to two further months if your request is complex.
9.3 Right to Rectification. You can ask us to correct inaccurate or incomplete data, or update most information directly within your account.
9.4 Right to Erasure. You can request deletion of your personal data where it is no longer necessary for the purpose it was collected, or where you withdraw consent. We may need to retain certain data for legal reasons.
9.5 Right to Restrict Processing. You can ask us to pause processing in certain circumstances, for example while accuracy is disputed.
9.6 Right to Data Portability. Where processing is based on consent or contract and carried out by automated means, you can request a structured, machine-readable copy of your data.
9.7 Right to Object. You can object to processing based on our legitimate interests, or to direct marketing, at any time.
9.8 Rights Around Automated Decision-Making. ClubHQ does not make decisions about you based solely on automated processing that produce legal or similarly significant effects, and does not profile users for commercial or advertising purposes.
9.9 Right to Withdraw Consent. Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.
9.10 Rights for Under-18 Members and Their Parents/Guardians. Parents or legal guardians may exercise all of the above rights on behalf of a child under 18 registered on ClubHQ. Where an under-18 member approaches us directly, we will consider their age and maturity in deciding how to respond, in line with ICO guidance.
9.11 Right to Lodge a Complaint.
| ICO Website | www.ico.org.uk |
| ICO Helpline | 0303 123 1113 |
| ICO Address | Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF |
10. Security of Your Personal Data
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption of data in transit (TLS 1.2 or higher) and at rest;
- Role-based access controls limiting access to authorised personnel;
- Multi-factor authentication for internal system access;
- Cloudflare DDoS protection and web application firewall;
- Passwords stored using secure one-way hashing, never in plaintext;
- Regular backups with tested restore procedures;
- Regular penetration testing and security reviews.
Our hosting infrastructure, Microsoft Azure, holds ISO 27001, ISO 27017, and ISO 27018 certification.
In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify the ICO within 72 hours and notify affected individuals without undue delay where required.
11. Cookies and Similar Technologies
The ClubHQ website and platform currently use only the cookies set by Cloudflare as part of its infrastructure and security services. These are strictly necessary and cannot be disabled. No analytics, advertising, or tracking cookies are currently in use.
We will shortly be introducing a cookie consent mechanism ahead of adding:
- Essential functionality cookies (session management, keeping you logged in);
- Preference storage (remembering your settings); and
- Platform analytics (understanding usage patterns to improve the product).
We will not set any non-essential cookie until the consent mechanism is live, and you will be able to manage your preferences at any time. Full details are set out in our separate Cookie Policy, published alongside the consent mechanism.
12. Third-Party Links and Services
The ClubHQ website and platform may link to third-party services. We are not responsible for the privacy practices of third parties and encourage you to review their privacy policies directly.
13. ClubHQ and Club Administrators: How Responsibility for Your Data is Shared
Understanding who is responsible for your personal data depends on who controls the purposes and means of processing. At ClubHQ, this involves more than one relationship, depending on what the data is and how it is used.
13.1 ClubHQ as Independent, Separate Data Controller
ClubHQ is the sole data controller for personal data it collects and uses for its own purposes, including:
- Enquiry form submissions (before you join a specific club through the platform);
- Legacy waitlist data;
- Platform analytics;
- Security logs; and
- Account infrastructure (e.g. login and authentication data).
For this processing, ClubHQ alone determines why and how your data is used, and this Privacy Policy is our notice to you.
13.2 ClubHQ as Data Processor
When a club or organisation uses ClubHQ to manage its members, the club acts as an independent data controller for its members' personal data. For the great majority of that processing, ClubHQ acts as a data processor on the club's behalf. We process the data on the club's instructions, not for our own purposes. This means:
- The club is responsible for having a lawful basis for processing its members' data;
- The club must provide its own privacy notice to members explaining how it uses their data;
- If a member's data was added to ClubHQ by a club administrator, the club, not ClubHQ, is the controller for that data; and
- Members should refer to their club's own privacy policy for how the club uses their personal data.
ClubHQ requires every club administrator to accept a Data Processing Agreement (DPA) before using the platform to process member data. That agreement sets out the terms on which we process member data on the club's behalf, including the two carve-outs described below.
13.3 Where ClubHQ and the Club Are Joint Controllers (Article 26)
For two specific activities, both ClubHQ and the club independently influence how your data is processed, meaning we act as joint controllers under Article 26 UK GDPR. This is more limited than full independent controllership, and more involved than a simple processor relationship.
(a) Setting up your member profile. Only your email address, password, and full name are required to create a ClubHQ account. Every other profile field, including contact details and the injury/health fields, is optional. ClubHQ decides which optional fields exist on the platform and designs them to collect no more data than necessary. Your club decides the context in which it asks you to complete your profile, and what it tells you about why certain information is useful (for example, for safeguarding, communications, or team selection). You always retain the choice not to fill in any optional field.
(b) Injury and health data. Where injury or health data is entered about you, ClubHQ determines how that data is structured, the fields available and the access controls around it. Your club determines who, within the club, is allowed to see this data, and for which members, via its nominated administrator.
Who to contact: because your club has a direct relationship with you, your club is the primary point of contact for exercising your data protection rights in relation to either of these two activities. If you contact ClubHQ directly about them, we will redirect you to your club and let the club know a request has been made. ClubHQ acts as a backstop, stepping in to assist directly, only if your club cannot be reached within a reasonable time, or has otherwise failed to respond, having regard to the urgency of your request.
The full legal arrangement between ClubHQ and clubs for these two activities, including each party's specific responsibilities, is set out in the Data Processing Agreement.
13.4 Quick Reference
| Scenario | Controller Position |
|---|---|
| You submit an enquiry or (previously) joined the waitlist | ClubHQ is the sole, independent controller. |
| A club administrator adds your member data directly | The club is the controller; ClubHQ processes it as instructed. |
| You set up your own profile after joining a club | Joint controllers (Section 13.3(a)). |
| Injury or health data is entered about you | Joint controllers (Section 13.3(b)). |
| A club exports your data to use outside ClubHQ | The club is the sole controller for the exported data; ClubHQ has no responsibility for its use outside the platform. |
14. Changes to This Privacy Policy
We will update this Privacy Policy as ClubHQ develops, including ahead of the mobile app's launch and the introduction of cookie consent. When we make material changes, we will:
- Display a prominent notice on the website or within the platform;
- Send an email notification to registered users where appropriate; and
- Update the version number and effective date at the top of this policy.
Continued use of the website or platform after an update constitutes acceptance of the revised policy.
15. Contact Us
For any questions, concerns, or data protection requests:
| [email protected] | |
| Subject Line | "Data Protection Enquiry, ClubHQ" |
| Response Time | We aim to respond to all data protection enquiries within 30 days. For Subject Access Requests, we will acknowledge receipt promptly and respond within one calendar month. |
© 2026 ClubHQ (clubhq.uk). All rights reserved. This Privacy Policy is issued by MBassett & Co LTD (Company No. 17295778), registered in England and Wales.