Privacy notice

This notice explains what personal data ClubTitan handles, why, and the rights you have over it. We've written it to be read, not skimmed past — if anything is unclear, contact us and we'll explain it plainly.

Who we are

ClubTitan is operated by [to be confirmed before launch — registered company name and number], registered in [to be confirmed before launch]. Our ICO registration number is [to be confirmed before launch]. You can reach us about anything in this notice at [to be confirmed before launch — privacy contact email].

Two roles: your club's data, and our own

Most of the personal data on ClubTitan belongs to clubs, not to us. When a club uses ClubTitan to manage its members, the club decides what data is collected and why — the club is the data controller, and we process that data on the club's behalf and on its instructions.

For a smaller set of data we are the controller ourselves: your ClubTitan account details (name, email, sign-in information), records we need to run and secure the service, and — only where the law allows — marketing communications about ClubTitan.

What we hold for clubs

• Member and team records: names, contact details, dates of birth, registrations.
• Guardian and family links — who is responsible for which child (see the children's section below).
• Consents the club records: photo consent, trips, medical information the club needs for duty of care — versioned, per person, withdrawable at any time.
• Payment records: what was owed and paid. Card details never touch our systems — payments are processed by Stripe, and money goes to the club's own Stripe account.
• Messages, availability responses, fixtures, results and club website content.

Children's data — built children-first

Around half the people at a grassroots club are under 18, so this is not fine print for us. A child's profile is owned and controlled by their guardian — a verified parent or guardian creates it, answers for it, and can withdraw any consent at any time. That boundary is enforced in the database itself, not just in the interface.

We follow the ICO's Age Appropriate Design Code (the Children's Code) by default:

• High-privacy settings by default — nothing about a child is public unless a guardian chooses it.
• No geolocation tracking of children.
• No nudge techniques designed to keep children on screens — recognition rewards what happens on the pitch, never app time.
• When a coach messages a young player, the guardians are automatically included — the platform cannot send a private adult-to-child message.

DBS and safeguarding checks

To help welfare officers track that coaches' checks are current, we store DBS certificate numbers and dates only — never the certificates or any supporting documents.

Marketing communications

We follow GDPR (for the lawful basis) and PECR (for the channel). Marketing is adult-only — we never market to children. There are three separate streams, and you control each of them any time in your marketing preferences:

• ClubTitan and your club— product news and club updates. Sent under the PECR “soft opt-in” because you signed up; every message carries a one-tap, no-login unsubscribe that takes effect immediately. Club-to-member marketing through the platform follows the same rules with the same tokenised unsubscribe.
• Other things we build (group) — other products from Dobl Ltd, the company behind ClubTitan (for example our word game Elementle). Sent only with your consent — off unless you turn it on.
• Vetted partner offers (third party) — relevant offers by category (for example kit and equipment). Sent only with your consent, off by default; we tell you the partner categories and we never sell your personal data to them.

Where you are matters: in the UK and EU the consent streams are off until you opt in; in the US they may be on by default and you can opt out at any time (including a “Do Not Sell or Share” control). When we can’t tell where you are, we apply the stricter UK/EU model.

Controllers and joint controllers

For your club’sdata, the club is the controller and ClubTitan is the processor, acting on the club’s instructions under a data-processing agreement (the club DPA). For your ClubTitan account and our own and group marketing, Dobl Ltd is the controller. Where we and a partner genuinely decide a purpose together we would be joint controllers and would tell you plainly — today no such arrangement is active.

Where your data goes

We use a small number of service providers to run the platform — hosting, database and payment processing (Stripe) — under contracts that bind them to protect your data. We do not sell personal data, and we never will. The full list of sub-processors will be published at [to be confirmed before launch].

International transfers

We aim to keep personal data in the UK/EU. Where a provider processes data outside the UK/EU, we rely on an adequacy decision or the UK/EU Standard Contractual Clauses (with an International Data Transfer Addendum for the UK), so your data keeps an equivalent level of protection wherever it is handled. The specific locations and safeguards are listed in the sub-processor list [to be confirmed before launch].

How long we keep it

Club data is kept for as long as the club uses ClubTitan and instructs us to hold it. When a club leaves, it can export everything first; we then delete the club's data on a published schedule [retention periods to be confirmed before launch]. Account data is deleted when you delete your account, except the minimum we must keep to meet legal obligations.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to or restrict processing, and take your data elsewhere. Export is built into the product — clubs and members can download their data in open formats at any time, without asking us. For anything else, including subject access requests, contact [to be confirmed before launch — privacy contact email]. Where we process data on a club's behalf, we'll pass your request to the club and help them answer it. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Changes to this notice

If we change this notice in a way that matters, we'll tell clubs and members directly — not bury it. This draft was last updated in July 2026.