Club data processing agreement

This agreement sets out how ClubTitan handles the personal data of your club’s members. It is the agreement UK GDPR Article 28 requires between a data controller and a data processor, written in plain English, and it forms part of the club terms.

1. The parties

• The controller is your club. The club decides what personal data is collected about its members and why.
• The processor is Dobl Ltd, trading as ClubTitan, registered in England and Wales, company number 16739677, registered office 10 Hamilton Avenue, Henley-on-Thames RG9 1SH, registered with the Information Commissioner’s Office under reference ZC058359. ClubTitan processes the club’s data only to provide the ClubTitan service to the club, on the club’s instructions.

The club accepts this agreement in the app, through an administrator who has the club’s authority. A club that is a company or a charity accepts through an officer its board or committee has authorised. The acceptance is recorded against the club with the officer’s name, role, the time and the version.

2. What this agreement covers

• Subject matter: running the club on ClubTitan — membership, teams, fixtures and training, availability, messages, payments, bookings, the club website and the club’s safeguarding tools.
• The whole product: this agreement covers every ClubTitan feature, including features the club has not switched on and features we release later — payments by card and by bank, lift sharing, sign-ins for 13 to 17-year-olds, messages from the club’s own WhatsApp number, the club website and custom domains, the shop, camps and bookings, fundraising, digital membership passes, AI drafting help and migration from another platform. When the club switches a feature on, this agreement already applies to it.
• Duration: for as long as the club uses ClubTitan, then as clause 11 sets out.
• Nature of the processing: storing, organising, displaying, sending notifications about, and deleting the data, through the ClubTitan apps and website.
• Purpose: the club’s administration, and the safeguarding tools the club’s welfare officer uses.
• Categories of people: the club’s players (children and adults), their parents and guardians, coaches, managers and helpers, the welfare officer, the club’s officers and administrators, and, where the club uses those features, people who pay the club, book a camp or event, give to a fundraiser or visit the club website.
• Types of data: as listed in Annex A.
• Special category data: health information (medical notes, medication, emergency details) where the club collects it, encrypted field by field (Annex B). DBS information is numbers and dates only, never a certificate.

3. ClubTitan acts only on the club’s instructions

1. ClubTitan processes the club’s personal data only on the club’s documented instructions. The ClubTitan service, as the club configures it, and this agreement are those instructions. The club’s officers give further instructions through the settings in the app and the management console, or in writing to privacy@clubtitan.com.
2. If ClubTitan believes an instruction breaks data protection law, it tells the club straight away and does not carry it out until the club confirms or changes it.
3. If the law requires ClubTitan to process the data in some other way (for example, a court order), ClubTitan tells the club first, unless the law forbids that.
4. ClubTitan does not use the club’s data for its own purposes. It does not sell it, use it for advertising, or use it to train artificial-intelligence models. It does not market to children.
5. ClubTitan is a controller in its own right only for each user’s sign-in account (e-mail address and sign-in records), for the technical and security data needed to keep the service safe, and for its own marketing, as its privacy notice explains. Everything else about the club’s members is the club’s data under this agreement.
6. Where the club uses AI drafting help, a staff member can ask it to help draft text, such as a match report or a message. It works only on the text that staff member gives it, can never be given medical, welfare, safeguarding or DBS information, makes no decisions about anyone, and nothing it drafts is sent or published until a person approves it. The AI provider does not train on the data.
7. The club instructs ClubTitan to let a member, or a child’s parent, re-use answers they gave the club when they join another club on ClubTitan, and to accept, in the same way, answers its members bring from another club on ClubTitan. ClubTitan copies an answer only when the member or parent asks, shows it to them first, never carries a consent, and records the copy at both clubs.

4. Confidentiality

1. Only people who need access to provide the service can reach the club’s data, and each of them is bound by a duty of confidentiality. ClubTitan’s development tools work on test data, never on the club’s.
2. ClubTitan staff do not read safeguarding concerns raised in the app. Concern text is sealed. The only exception is where the law compels access; any such access is logged and the club is told unless the law forbids it.

5. Security

1. ClubTitan keeps appropriate technical and organisational measures in place to protect the data, as UK GDPR Article 32 requires. Annex B describes them.
2. ClubTitan may improve these measures at any time. It will not reduce the overall level of protection.

6. Sub-processors

1. The club gives ClubTitan general permission to use the sub-processors published at clubtitan.com/legal/subprocessors, which lists what each one does, where it processes data and the transfer safeguard.
2. ClubTitan binds each sub-processor by a written contract that gives the data at least the protection this agreement gives it, and remains responsible to the club for what its sub-processors do.
3. ClubTitan tells the club at least 30 days before it adds or replaces a sub-processor that will handle the club’s personal data. The club may object on reasonable data-protection grounds. If the objection cannot be resolved, the club may leave and take its data with it (clause 11).

7. Data outside the UK

1. The club’s database is held in the UK.
2. Where personal data leaves the UK, ClubTitan relies on a UK adequacy decision (for example the UK–US data bridge, where the provider is certified), or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. The sub-processor list gives the safeguard for each provider.

8. Helping the club with people’s rights

1. ClubTitan helps the club respond to people who exercise their data protection rights: access, correction, deletion, restriction, objection and portability.
2. Most of this is built into the product. A family can ask for a copy of its data, or ask to be deleted, in the app; the request goes to the club’s data protection contact, who reviews and releases it in the management console.
3. If a request comes to ClubTitan directly, ClubTitan passes it to the club within two working days and does not answer it on the club’s behalf unless the club asks.

9. Helping the club with its other duties

ClubTitan helps the club, taking into account what ClubTitan can know, with keeping the data secure (Article 32); personal data breaches (Articles 33 and 34; clause 10); the data protection impact assessment (Article 35) — ClubTitan provides a ready-made assessment for the club to review and adopt; and any consultation with the Information Commissioner’s Office (Article 36).

10. Personal data breaches

1. If ClubTitan becomes aware of a personal data breach affecting the club’s data, it tells the club’s named contact without undue delay, and in any case within 24 hours.
2. ClubTitan gives the club what it needs to decide whether to report the breach to the ICO within 72 hours and whether to tell the people affected: what happened, what data and how many people, the likely consequences, and what has been done about it. Where not everything is known at once, ClubTitan gives it in stages.
3. ClubTitan takes immediate steps to contain the breach and limit harm, and keeps a record of every breach.

11. When the club leaves

1. This agreement continues while the club uses ClubTitan. The club can export all of its data in open formats at any time, without asking.
2. If the club stops using ClubTitan, ClubTitan deletes the club’s data within 30 days of the club’s choice to stop, apart from what the law requires ClubTitan to keep. Backup copies expire on their normal cycle, no more than 36 days after the deletion, and are not restored in the meantime except to recover from an incident.
3. ClubTitan confirms the deletion to the club in writing.

12. Showing compliance

1. ClubTitan gives the club the information it reasonably needs to show that this agreement is being followed.
2. The club, or an auditor it chooses who is bound by confidentiality, may audit ClubTitan’s compliance with this agreement on reasonable notice.

13. The club’s own responsibilities

As controller, the club:

• gives its members a privacy notice — ClubTitan provides a template the club can use;
• makes sure it has a lawful basis for the data it asks ClubTitan to process, and collects only what it needs;
• keeps its own safeguarding policy and its welfare officer. ClubTitan supports the welfare officer; it never replaces them and takes no welfare role;
• keeps its coaches’ DBS and course dates accurate in the app;
• records, through its welfare officer, any family where a court order or similar restriction means an adult must not see a child’s information;
• keeps the short appropriate policy document the law requires for DBS and safeguarding data (ClubTitan provides one for the club to adopt with its impact assessment);
• checks whether it needs to pay the ICO’s data protection fee itself. Many not-for-profit clubs are exempt; the ICO’s self-assessment at ico.org.uk answers it.

14. Liability

1. Each party is responsible for its own breaches of this agreement and of data protection law. Where both are liable to a person under UK GDPR Article 82, each may recover from the other the share that matches its responsibility.
2. The limit on ClubTitan’s liability in section 13 of the club terms applies to the club terms and this agreement together.
3. Nothing in this agreement limits any liability that cannot be limited by law.

15. General

1. This agreement is governed by the law of England and Wales, and the courts of England and Wales decide any dispute.
2. If this agreement conflicts with any other terms between the club and ClubTitan, this agreement wins on anything to do with personal data.
3. Changes are made by a new version, published here and accepted by the club in the app; the club is told in advance.
4. Questions about this agreement: privacy@clubtitan.com.

Annex A — The data

Never processed: a child’s precise location, any automated decision about a person, card numbers, and bank details for taking a payment (Stripe and GoCardless hold those), and DBS certificates or any supporting document.

Annex B — Security measures

Version 1 · last updated October 2026. The version a club accepted is recorded against the club.