ClubManager — Privacy Policy
1. What this policy covers
This policy explains how we handle personal data when you:
- visit our website at www.clubmanager.com;
- use our application at secure.clubmanagercentral.com;
- use a ClubManager member app or member portal, including an app branded by your club; or
- otherwise contact us or provide us with personal data.
We refer to these together as our Services.
Read this together with our Terms of Service, our sub-processor list, our Cookie Notice and — if you are a member of a club rather than someone who runs one — our Member Privacy Notice.
2. The two roles we play
We are the controller for:
- personal data about the people who run a club and use our application — names, work email addresses, telephone numbers, job roles and login records;
- billing and account data;
- correspondence with our support and sales teams;
- data about visitors to our website.
This policy explains that processing.
We are the processor for:
- everything a club records in ClubManager about its own members, customers, patients or participants — Member data.
For Member data, the club is the controller and we act only on its instructions.
If you are a member of a club that uses ClubManager and you want to know what is held about you, or want it corrected or deleted, contact your club, not us. We will help your club respond, but we cannot act on your data without its instruction. See our Member Privacy Notice.
Our obligations to clubs are set out in the Data Processing Agreement at Schedule 3 of our Terms of Service.
3. What we collect, and why
Information you give us. When you sign up, subscribe to our emails, complete a form, answer a survey, fill in your account profile or contact support: your name, email address, telephone number, organisation name and type, your role, and the content of your correspondence.
Information we collect automatically. Usage data such as login dates and features used; technical data such as IP address, device and browser information, used to operate and secure the Services; and whether our emails were opened and which links were clicked.
Information from others. From a third party you have authorised — for example a payment provider you have connected, or a reseller through whom you purchased. We may also validate information against public sources such as Companies House.
Special category data
We do not require special category personal data about the people who run a club, and we do not seek it.
A club may choose to record it about its members — for example an injury, a medical condition or an accessibility need. Where it does, we hold that data as processor on the club's instructions, and the club is responsible for satisfying the Article 9 UK GDPR condition.
Children
Our application is a business tool and is not directed at children. We do not knowingly collect personal data directly from a child in our own right, as controller.
However, clubs using ClubManager routinely record data about children — junior members of gymnastics clubs, dance schools, martial arts clubs and similar — and children may use a club's member app. That is Member data. The club is the controller, and is responsible for the lawful basis and for parental consent where required.
We do not track members and we do not advertise to members, of any age, in any territory.
If you believe we hold personal data that a child provided directly to us as controller, contact us and we will delete it.
4. Our lawful bases
| What we do | Why | Lawful basis |
|---|---|---|
| Create and administer your account; provide the Services | To perform our contract | Contract |
| Take payment and chase overdue amounts | To perform our contract; to recover sums due | Contract; legitimate interests |
| Provide support and training | To perform our contract | Contract |
| Keep the Services secure; investigate misuse | To protect our systems, our customers and their members | Legitimate interests |
| Understand how the application is used, to improve it | To develop the product | Legitimate interests |
| Send you service messages about your account | To perform our contract | Contract |
| Send you marketing about our products | To promote our business to business customers | Legitimate interests, or consent where required |
| Comply with accounting, tax and other legal obligations | Because the law requires it | Legal obligation |
Where we rely on legitimate interests, we have assessed that our interest is not overridden by your rights and freedoms. You can ask us for that assessment.
If you do not provide the information we need, we will not be able to provide the Services.
5. Marketing
We may contact you by email, post, telephone, SMS, WhatsApp or social media about our products, where you have consented or we are otherwise entitled to do so.
You can opt out at any time — use the unsubscribe link in any marketing email, or contact us using the details in section 13. Opting out may take up to one working day to take effect.
Opting out of marketing does not stop service messages about your account. If you no longer want those, close your account.
We do not use Member data to market to your members. Your members are your contacts, not ours.
6. Aggregated and anonymised insights
We may produce aggregated, anonymised statistics from data across our customer base, and publish or share them. These outputs are irreversibly anonymised: they will not identify any club, member or individual, and cannot be used to re-identify anyone.
7. Who we share information with
Our sub-processors. We use a small number of suppliers to help deliver the Services — hosting, email and SMS delivery, customer support tooling, and content delivery and security. They process personal data only on our instructions, under written contracts imposing obligations equivalent to our own. Our current list is published on our website, with each supplier's function, location and transfer mechanism. We give 30 days' notice before adding or replacing one.
Services you choose to connect. You may connect third party services to your account, including payment providers. Those providers are chosen by you and handle data under their own terms. We are not responsible for their privacy practices. The same applies where you enable API access for a third party.
Other circumstances. We may share personal data with our group companies; with professional advisers, auditors and insurers under duties of confidentiality; where a legal obligation requires it, or to cooperate with law enforcement or a regulator; to establish, exercise or defend legal claims or enforce our agreement; for fraud prevention and credit risk reduction; and if our business or substantially all of its assets are acquired, in which case personal data may be a transferred asset — we will tell you if that happens.
We do not sell personal data.
8. Where your data is held, and international transfers
Hosting.
- For customers within India, all data is hosted on infrastructure located within India, provided by OVHcloud.
- For customers in all other territories, data is hosted on Hetzner infrastructure in Germany and Finland. Both are EEA member states.
Processing that takes place elsewhere. Hosting location is not the whole picture, and we say so plainly. Our support team in the United Kingdom accesses the infrastructure to provide support and onboarding, including for customers in India. Emails, SMS and WhatsApp messages are delivered through our messaging providers, and support correspondence is held in our support system. Each provider, its location and its transfer mechanism is listed in our sub-processor list.
Where we transfer personal data outside the United Kingdom, we put an appropriate safeguard in place first — a relevant UK adequacy decision, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses together with a transfer risk assessment.
9. How long we keep it
While you are a customer, what you keep in your account is yours to manage. You can delete records at any time, and data you delete is erased from our systems six months after deletion.
When your subscription ends, we keep your data for six months and then delete it. That period covers live data, backups and previously deleted records — after it, no copy remains in our systems. You can ask us to delete it sooner, or to return it, instead.
| Data | Retention |
|---|---|
| Account and profile data | Six months from the end of the subscription |
| Member data held as processor | Six months from the end of the subscription, or sooner on the club's instruction |
| Records you delete during your subscription | Six months from deletion |
| Backups | Taken hourly; no backup is retained beyond six months |
| Billing, invoices and payment records | As long as tax and accounting law requires, which is longer than six months |
| Support tickets and correspondence | While needed to support your account and to handle any related query or claim |
| Marketing contact data | Until you opt out, or until you have not engaged with us for a sustained period |
Closing your account does not automatically remove you from our marketing list. To be removed, use the unsubscribe link or contact us.
10. Your rights
These rights apply to personal data we hold about you as controller. For Member data, contact your club — see section 2.
- Access — ask whether we process your data and receive a copy.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure — ask us to delete your data, in certain circumstances.
- Portability — receive certain data in a structured, machine-readable format. You can also export your data from the application at any time.
- Object — to processing based on legitimate interests, and at any time to direct marketing.
- Restriction — ask us to restrict processing in certain circumstances.
- Withdraw consent — where we rely on consent. This does not affect processing carried out before you withdrew it.
To exercise any of these, contact [email protected]. We will respond within one month. That period can be extended by up to two further months for complex requests, and we will tell you if we extend it. We may ask you to clarify your request or verify your identity.
Complaints. If you are unhappy with how we have handled your personal data, please tell us first at [email protected]. We will acknowledge your complaint within 5 working days and respond substantively within 30 days.
You can also complain to the Information Commissioner's Office at ico.org.uk, or to the supervisory authority in your own country. You do not have to complain to us first, but it will usually be quicker.
11. Cookies
We only use cookies that are strictly necessary to make our websites and application work and to keep them secure — maintaining your session, keeping you signed in, and the security challenge applied at login.
We do not use analytics cookies. We do not use advertising or tracking cookies. We do not serve advertising.
Where you make a payment to a club that uses Stripe, Stripe's payment components load on that page and may set cookies. They load only where a payment is being taken.
Because we use only strictly necessary cookies, there is nothing to opt out of. Full details are in our Cookie Notice.
12. Security
We maintain technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls, multi-factor authentication, a security challenge at login, and staff confidentiality obligations. Encrypted backups are taken hourly.
We do not store payment card details. Card payments are handled by providers certified to PCI DSS Level 1. Where card information passes through our systems, it is transmitted directly to the provider and is not retained.
Our website is served through Cloudflare, which provides content delivery and protection against denial-of-service attacks. The application is not proxied through Cloudflare; traffic goes directly to our own servers.
Availability of the live service is monitored continuously by an independent third-party monitoring provider, and automated checks run against the live environment to identify early signs of degradation.
Our measures for Member data are set out in Annex B of our Data Processing Agreement.
You are responsible for keeping your password confidential. No transmission over the internet can be guaranteed completely secure, and any transmission is at your own risk.
To report a security concern, contact [email protected]. This address is monitored outside our normal support hours.
13. Contact us
Club Manager Limited, 195 St. Marys Lane, Upminster, RM14 3BU
Privacy enquiries, rights requests and complaints: [email protected]
Security concerns: [email protected]
Support is available 09:00 to 17:00, Monday to Friday, local time in each territory. There is no out-of-hours support.
14. Changes to this policy
We may update this policy. When we make a material change we will publish the new version here, update the version number and effective date, and notify Account Holders by email at least 30 days before it takes effect. Superseded versions are available on request from [email protected].
Club Manager Limited · Registered in England and Wales, company number 06734233.