Our compliance register
The official standard for each area of how we run the platform — and where we honestly stand. We link the real source every time, and we never mark something done before it is.
We keep the company’s filings with Companies House and HMRC up to date, and every deadline is tracked.
gov.uk — life of a company: annual requirements →We keep the company’s tax affairs in order, including VAT as the business grows.
gov.uk — register for VAT →We are registered with the Information Commissioner’s Office, keep a record of what we process and why, and have a plan for acting quickly if anything goes wrong.
ICO — data protection fee →We design to the ICO’s Children’s Code: private settings by default, no location tracking, no nudges, and a child’s record owned by their guardian. Anything new that touches children’s data is reviewed against it.
ICO — Children's code guidance and resources →Club messaging means the Online Safety Act applies to us. We assess the risks it asks us to, keep those assessments current, and give members a clear way to report anything that should not be there.
Ofcom — illegal content duties under the Online Safety Act →We have a named safeguarding lead and a safeguarding policy we keep under review. The platform’s own safeguarding rules, such as every message to a child reaching their parent too, are enforced in the product itself.
The FA — safeguarding →Card details are taken by our payment provider’s own secure forms and never reach ClubTitan. Club money is never pooled: each club is paid directly.
Stripe — security and PCI →We meet Apple’s and Google’s requirements for our apps, including accurate privacy labels and account deletion from inside the app.
Apple — EU DSA trader requirements →Every provider that handles data for us does so under a data processing agreement. We publish the full list of sub-processors and give clubs notice before it changes.
Stripe — data processing agreement →We test our own security rigorously against industry standards and keep raising the bar, so our protection stays at the forefront and matches or exceeds the best in our industry.
NCSC — Cyber Essentials →We carry the insurance a business that holds club data should, from the day the first club joins.
gov.uk — employer's liability insurance →Every marketing message asks first and carries a one-tap unsubscribe, and children are never sent marketing at all.
ICO — direct marketing and PECR →