ClubManager — Terms of Service
1. About these terms
Who we are. Club Manager Limited — "we", "us", "our".
What these terms cover. They govern your use of the Services and form a legally binding contract between us and the Account Holder.
The documents that make up our agreement, in order of precedence where they conflict:
- any Order Form or written agreement signed by both parties;
- any Product Schedule for a Service you have taken;
- any Territory Annex for the country in which the Account Holder is established;
- these terms, including the Schedules;
- our Privacy Policy.
Language and jurisdiction. Concluded in English, governed by English law. See clause 19.
2. What some words mean
- "Account Holder" — the organisation holding a ClubManager account.
- "Subscriber" — the person who registers on the Account Holder's behalf.
- "Invited User" — anyone else the Subscriber authorises to use the Services.
- "Member" — an individual member, customer, patient, participant or contact of the Account Holder whose details it records in the Services.
- "the Services" — the ClubManager management application; the member-facing app and portal; a club-branded app; public-facing joining, booking and payment pages; the API; and any other product supplied under a Product Schedule.
- "our Websites" — www.clubmanager.com and secure.clubmanagercentral.com, and any other website we operate for the Services.
- "your Data" — data entered, uploaded or generated by the Account Holder or its Invited Users, including Member data.
- "you" — the Subscriber and, where the context permits, an Invited User.
3. Your account
How to apply. Apply on the sign-up page of our Websites.
How the contract is formed. If we accept, we confirm by email and the contract forms at that point. If you apply, you confirm you are authorised to do so for the Account Holder.
We may decline an application at our discretion. No charge for a declined application.
Correcting details. You can review and correct the details you have entered before submitting an application, and can update your account details afterwards.
Users and access. Subject to any separate agreement between the Account Holder and its Invited Users:
- the Subscriber decides who is an Invited User and what access each has;
- the Account Holder is responsible for all use by its Invited Users;
- the Subscriber controls each Invited User's access at all times and may change or revoke it;
- if the Subscriber and an Invited User disagree about access, the Subscriber decides.
Account security. The Account Holder is responsible for administering and safeguarding its credentials. Keep any password secure and do not share it. Multi-factor authentication is available and we recommend enabling it.
4. Licence and permitted use
We grant the Account Holder, and you as an authorised user, a non-exclusive, non-transferable, non-sublicensable licence to access and use the Services for the Account Holder's own business purposes, for as long as the subscription is in force and these terms are complied with.
Roles and features available depend on the subscription and Product Schedule.
5. Your obligations
You must:
- access the account only using credentials the Account Holder has authorised;
- use the Services only on behalf of that Account Holder, and only for lawful purposes;
- keep contact and billing details complete and accurate.
You must not:
- do anything that could reasonably be expected to damage, disable, overburden or materially impair the Services or our Websites, or interfere with anyone else's use;
- attempt unauthorised access to any part of the Services or to another Account Holder's data;
- copy, modify, reverse-engineer, decompile or create derivative works, except as law expressly permits;
- resell, sublicense or make the Services available to a third party, except as agreed in writing;
- introduce malicious code, or store or transmit unlawful, defamatory or infringing material.
Competitors and benchmarking. You must not access the Services to build a competing product, or to publish a competitive benchmark or comparison, without our written consent.
Communications you send to your Members. The Account Holder is the sender of messages sent through the Services and is responsible for them. It warrants that for every message it has:
- a lawful basis, and any consent required under the Privacy and Electronic Communications Regulations 2003 or equivalent law in its territory;
- given Members the information and opt-out that law requires; and
- honoured all opt-outs and suppression requests.
The Account Holder will indemnify us against any claim, fine or reasonable cost arising from breach of this warranty. We may suspend sending functions immediately where we reasonably suspect breach, or use that threatens platform deliverability for other customers.
6. Fair use
Without our prior agreement, you must not:
- send more than 25,000 emails, SMS messages, push notifications and WhatsApp messages in total per calendar month;
- store more than 1GB of uploaded files;
- add more than 50,000 contacts;
- create more than 5,000 bookings within a calendar month;
- request additional training, beyond the initial getting-started training, more than once every three months.
If you expect to exceed any of these, contact us. We will not suspend or restrict an account for exceeding a fair use limit without first contacting the Account Holder, except where the excess is causing immediate harm to the platform or to other customers.
7. Fees and payment
Subscription fee. Payable monthly in advance. Current rates are on our pricing page.
Currency and tax. Quoted in the currency shown for the Account Holder's territory, excluding VAT / GST / sales tax, payable in addition where it applies.
Changing your package. Takes effect from the next billing cycle.
Free and trial periods. No charge during a free or beta trial. One free trial per Account Holder. If more than one is taken, the Account Holder becomes liable for the fee for all use after the first trial period.
Automatic renewal. After any trial, the subscription renews automatically each month and we bill the payment method on file until the account is closed.
Price changes. We will give at least 30 days' written notice of any increase, to the billing contact email address. The new rate applies from the first billing date after the notice period ends. The Account Holder may terminate under clause 14 before the new rate takes effect, without penalty and without serving the notice period in clause 14.
Non-payment. The Account Holder must keep complete and accurate billing and contact information with us. If fees become overdue we will notify the billing contact and allow 14 days to remedy before suspending access. If the amount remains unpaid after that, we may suspend the account and, after a further 30 days, close it. We are not obliged to provide the Services while fees are overdue.
Commission from third parties. We may receive one-off or ongoing commission from providers Account Holders connect to their accounts, including payment providers. Where a provider we recommend or promote pays us commission, we will say so at the point of recommendation.
8. Buying through a reseller
If purchased from an authorised reseller then, unless we or the reseller say otherwise:
- the fee is based on the reseller's rates as varied from time to time; and
- the fee is payable directly to the reseller.
These terms continue to govern use of the Services, and we may act under clause 7 (Non-payment) if the Account Holder does not pay its reseller.
The Account Holder may also be required to accept the reseller's own terms. Those terms govern the relationship between the Account Holder and the reseller only. They do not form part of our agreement with the Account Holder, and a breach of them is not a breach of these terms. We require resellers to pass on obligations equivalent to clauses 5, 6 and 13.
9. Support
We provide support to Account Holders with an active subscription.
First line support is available 09:00 to 17:00, Monday to Friday, local time in each territory we serve, excluding public holidays.
Second line support — where a query needs escalating to our technical team — operates on United Kingdom time, 09:00 to 17:00, Monday to Friday. An escalated query raised outside UK working hours is picked up when UK working hours resume.
We do not offer out-of-hours support. No out-of-hours or emergency service is available, and none can be purchased. Faults reported outside working hours are picked up when working hours resume.
This does not affect the personal data breach notification commitment at Schedule 3, paragraph 3.8, which runs in calendar hours. Security reports are handled separately — see Schedule 1, paragraph 4.
Channels. Support is available by email and telephone. You can also raise and review support tickets in our Help Centre.
Response targets are in Schedule 1.
Support is provided on a fair use basis of up to one hour per month per Account Holder, not cumulative. Additional support and training can be purchased.
10. Availability, maintenance and changes to the Services
Availability. We work to keep the Services available, and monitor availability continuously through an independent third-party provider. We do not give a contractual uptime commitment under these terms.
Planned maintenance. We may suspend the Services for maintenance, giving at least 48 hours' notice of maintenance expected to cause a material interruption, other than urgent or security-related work.
Changes to the Services. We may add, change or remove features. We will not materially reduce the core functionality subscribed to without at least 30 days' notice, in which case the Account Holder may terminate the affected Service without penalty.
11. Who owns what
Your Data. The Account Holder retains all intellectual property rights in your Data. Nothing here transfers them to us. The Account Holder is solely responsible for the accuracy, quality and lawfulness of your Data, and for managing what it retains in its account.
Our platform. All intellectual property rights in the Services and our Websites are owned by or licensed to us. Nothing in these terms or any Schedule transfers any ownership right in the Services to you or the Account Holder. This applies to everything we create in operating and developing the Services, including anything built in response to a request or suggestion from an Account Holder.
Bespoke work. If we agree in writing to build something specifically for an Account Holder and it pays for that work, ownership of that deliverable is dealt with in that agreement.
Feedback. We may use suggestions or feedback freely and without obligation to you.
How we may use your Data. To provide, support and secure the Services, and as described in our Privacy Policy and Schedule 3. In addition:
- Aggregated and anonymised insights. We may create aggregated, anonymised statistics from data across our customer base and use and publish them. Anonymisation is irreversible: outputs will not identify the Account Holder, any Member or any individual.
- We do not track Members and we do not serve advertising to Members. This applies to Members of any age, in every territory. We do not use Member data to market our own or anyone else's products to your Members, and we do not build advertising or behavioural profiles of them.
Disclosure to authorities. We may disclose your Data where legally required, or in the investigation of fraud or other alleged unlawful activity. Where we are permitted to tell you, we will.
12. Confidentiality
Each party will keep the other's non-public information confidential and use it only for this agreement. This does not apply to information that is public through no fault of the receiving party, already lawfully held, independently developed, or required to be disclosed by law. This clause survives termination for three years.
13. Data protection
- For your Data, including Member data, the Account Holder is controller and we are processor. The Data Processing Agreement at Schedule 3 governs that processing and forms part of this agreement. No separate signature is required.
- For the Subscriber's and Invited Users' account, billing and support data, and for visitors to our Websites, we are controller. Our Privacy Policy explains that processing.
Each party complies with data protection law as it applies to it.
Special category data. The Services do not require it. The Account Holder may choose to record it — for example health, injury, medical or disability information about a Member. Where it does, we process it as processor on the Account Holder's instructions, and the Account Holder is responsible for satisfying the Article 9 UK GDPR condition.
Children. Members are frequently children. The Account Holder is responsible for the lawful basis and for parental consent where required. We do not track or advertise to Members of any age — see clause 11.
14. Term, suspension and termination
Term. Month to month, renewing automatically until terminated.
Cancellation by the Account Holder
The Account Holder may close its account using the Cancel My Account button at the foot of Settings › Branch Details in the application.
When cancellation takes effect. The next scheduled subscription payment after we receive notice will still be taken, and the subscription then ends one month after that payment date. No further payments are taken after that.
Worked example. If the Account Holder is billed on the 1st of each month and cancels on 5 January, the payment on 1 February is still taken and the subscription ends on 1 March. If it cancels on 28 January, the payment on 1 February is still taken and the subscription still ends on 1 March.
So one further payment is always taken after cancellation, and the Account Holder keeps access for between approximately one and two months from the date of cancellation.
Fees already paid are not refunded.
Termination by us for convenience. We may close an account on 30 days' written notice, refunding pro rata any fee paid for the period after closure.
Suspension and termination by us for cause. We may suspend immediately, or terminate on notice, for material breach, for fees overdue after the clause 7 process, or where required by law. No refund is payable where we terminate for cause.
What happens to your Data
During your subscription, what you keep in your account is yours to manage. You can delete records at any time. Data you delete is erased from our systems six months after deletion.
When you cancel, you may export your data using the export function, or by asking us, for 30 days after your subscription ends.
We retain your Data for six months from the date your subscription ends, and then delete it. That six month period covers live data, backups and previously deleted records — after it, no copy remains in our systems. You may ask us to delete it sooner, or to return it, under Schedule 3, paragraph 11.
We retain payment and invoice records for as long as tax and accounting law requires, which is longer than six months.
Surviving clauses. 11, 12, 15, 16 and 19.
15. Liability
Nothing is excluded where it cannot be. Neither party excludes or limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be excluded.
What we do not accept liability for. Subject to the above, we are not liable for loss of profit, business, anticipated savings or goodwill, or for any indirect or consequential loss.
Our general cap. Subject to the above, our total liability in any twelve month period is limited to the total subscription fees paid by the Account Holder in the twelve months immediately before the event giving rise to the claim.
Data protection cap. Our total liability for claims arising from breach of Schedule 3 or of data protection law is limited to 200% of the total subscription fees paid by the Account Holder in the twelve months immediately before the event giving rise to the claim.
Our obligations to you. We will provide the Services with reasonable skill and care. We do not warrant that they will be uninterrupted, error-free or entirely secure, or that they will meet a requirement not notified to us in writing.
16. Indemnities
By the Account Holder — against claims, fines and reasonable costs arising from breach of clause 5 (communications to Members); from your Data infringing third-party rights or breaching law; and from its breach of data protection law as controller.
By us — against claims that the Services, used in accordance with this agreement, infringe a third party's intellectual property rights.
17. Force majeure
Neither party is liable for delay or failure caused by events outside its reasonable control, provided it notifies the other in writing. If the event continues beyond 28 consecutive days, either party may terminate on written notice.
18. Changes to these terms
We may change these terms. We will publish the new version and, where the change is material, give at least 30 days' notice by email before it takes effect. Continued use after that constitutes acceptance. If the Account Holder does not accept a material change, it may terminate under clause 14 before it takes effect, without serving the notice period.
Every version carries a version number and effective date. Superseded versions are available on request from [email protected].
19. General
Assignment. We may transfer our rights and obligations provided this does not reduce the Account Holder's rights. Neither the Account Holder nor you may transfer without our written consent.
Entire agreement. The documents listed in clause 1 form the entire agreement and supersede prior understandings.
Waiver and severability. Overlooking a breach does not prevent enforcing a later one. An invalid provision is replaced by one achieving the same purpose as closely as the law allows; the rest continues in force.
Notices. To us: [email protected], or by post to Club Manager Limited, 195 St. Marys Lane, Upminster, RM14 3BU. To the Account Holder: the billing contact email address on the account.
Third parties. No one other than the parties may enforce this agreement under the Contracts (Rights of Third Parties) Act 1999.
Governing law. English law; the courts of England have exclusive jurisdiction, subject to any Territory Annex. You are responsible for compliance with the laws of the country from which you access the Services.
20. Contact
Club Manager Limited, 195 St. Marys Lane, Upminster, RM14 3BU
General enquiries and support: [email protected]
Telephone support is available during the hours in clause 9; current numbers are published on our
website.
Security concerns: [email protected]
Privacy and data protection: see our Privacy Policy.
21. Products not covered by these terms
These terms govern business-to-business supply to a club, gym, studio, clinic or similar organisation.
They do not govern any subscription sold directly by us to an individual consumer. Where offered, that is supplied under separate consumer terms and a separate privacy notice.
Schedule 1 — Support
1. Reporting a fault
Report faults through the support channels in clause 9. Tell us what you were doing, what happened, and how many people are affected — that is what allows us to prioritise.
2. Response target
We aim to acknowledge a reported fault within 4 working hours.
Working hours means the first line support hours for your territory — 09:00 to 17:00, Monday to Friday, local time. Escalation to second line operates on United Kingdom working hours. A fault reported outside working hours is treated as received at the start of the next working day.
3. Prioritisation and resolution
We prioritise faults by their effect on your ability to operate, taking into account how many users are affected and whether a workaround exists.
We will use reasonable endeavours to resolve faults, and will keep you informed of progress on faults preventing you from operating. We do not commit to a fixed resolution time, because the time required depends on the nature of the fault.
4. Security incidents
Report security concerns to [email protected]. This address is monitored outside our normal support hours.
We will acknowledge a security report within 1 working day. Where a report concerns a personal data breach we will act on the timescales in Schedule 3, paragraph 8.
On becoming aware of a security threat we will: establish its nature; assess the risk to customer data by likelihood and impact; scope the work needed to mitigate or eliminate it; prioritise accordingly; and, where customer data is affected, notify affected Account Holders under Schedule 3, paragraph 8.
Schedule 2 — Product Schedules
Where a Service requires terms specific to it, those terms are set out in a Product Schedule agreed with the Account Holder. A Product Schedule takes precedence over these terms to the extent of any conflict, and applies only to the Service it names.
Schedule 3 — Data Processing Agreement
1. Scope and roles
1.1 This Schedule applies where we process personal data on behalf of the Account Holder in providing the Services.
1.2 The Account Holder is the controller; we are the processor.
1.3 Nothing here relieves either party of its own direct obligations under data protection law.
1.4 It takes effect with the agreement and requires no separate signature. A Territory Annex modifies this Schedule to the extent stated in it.
2. The controller's obligations
2.1 The Account Holder warrants that it has and will maintain all lawful bases, conditions and notices required to permit lawful transfer of personal data to us for the processing described in Annex A, including any Article 9 condition for special category data and any parental consent for children's data.
2.2 The Account Holder is responsible for the accuracy of the personal data, for the privacy information it gives its Members, and for managing what it retains in its account.
3. Our obligations
We will:
3.1 process personal data only on the Account Holder's documented instructions, including as to international transfers, unless required otherwise by law — in which case we will inform the Account Holder first unless prohibited from doing so. This agreement, the functionality of the Services, and the Account Holder's use of that functionality, together constitute those instructions;
3.2 immediately inform the Account Holder if, in our opinion, an instruction infringes data protection law;
3.3 ensure that people authorised to process the data are under a duty of confidentiality and have received appropriate training;
3.4 implement and maintain the measures described in Annex B;
3.5 restrict access to personnel who require it;
3.6 assist the Account Holder in responding to data subject rights requests, taking into account the nature of the processing and the information available to us. Where the Account Holder can action a request itself within the Services, it will. We may charge for disproportionate assistance, on advance notice. Telling the Account Holder that a request has been received is never chargeable;
3.7 assist the Account Holder with Articles 32 to 36 UK GDPR — security, breach notification, data protection impact assessments and prior consultation;
3.8 notify the Account Holder without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting the personal data. That period runs in calendar hours and is not limited to working hours. A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to that data, including where it is subsequently recovered. Notification will include, so far as known: the nature of the breach; the categories and approximate numbers of data subjects and records affected; the likely consequences; the measures taken or proposed; and a contact point. We will provide further information as it becomes available, so that the Account Holder can meet its own 72-hour obligation, and will assist with notification to data subjects where required;
3.9 notify the Account Holder promptly on receiving any notice from a supervisory or government body relating to the processing;
3.10 restore personal data from backup at no cost where it is lost, corrupted or rendered unusable while under our control;
3.11 on termination, at the Account Holder's choice, return or delete the personal data and delete existing copies, unless required by law to retain it. That choice must be made within 30 days of termination. If it is not, we delete the personal data six months after the subscription ends, and that period covers live data, backups and previously deleted records;
3.12 maintain records of processing under Article 30(2) UK GDPR.
4. Sub-processors
4.1 The Account Holder gives general written authorisation for us to engage sub-processors.
4.2 Our current sub-processors are published in our sub-processor list, linked from our Privacy Policy.
4.3 We give at least 30 days' notice before adding or replacing a sub-processor.
4.4 The Account Holder may object within that period on reasonable data protection grounds. We will work in good faith to resolve the objection; failing resolution, the Account Holder may terminate the affected Service without penalty and receive a pro rata refund of fees paid in advance.
4.5 We impose obligations equivalent to this Schedule on each sub-processor and remain fully liable for their performance.
5. International transfers
5.1 Personal data is hosted as described in Annex B.
5.2 Where we transfer personal data outside the United Kingdom, we ensure an appropriate Article 46 safeguard is in place — a relevant adequacy decision, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses together with a transfer risk assessment. The mechanism applying to each recipient is stated in our sub-processor list.
5.3 We do not rely on data subject consent as the mechanism for routine transfers.
6. Audit
6.1 We will make available the information reasonably necessary to demonstrate compliance with this Schedule.
6.2 The Account Holder may audit once in any twelve month period, and additionally following a personal data breach affecting its data. Audits are subject to 30 days' notice, take place during business hours, must not cause unreasonable disruption, and are subject to confidentiality. The Account Holder bears its own costs and our reasonable costs of supporting the audit.
6.3 We may satisfy an audit request by providing a completed security questionnaire, our current measures documentation, or an independent third-party report.
7. Intellectual property
Nothing in this Schedule transfers any intellectual property right in the Services. Clause 11 governs ownership.
8. Governing law
English law; exclusive jurisdiction of the English courts, subject to any Territory Annex.
Annex A — Details of processing
| Item | Detail |
|---|---|
| Subject matter | Provision of the Services to the Account Holder |
| Duration | The term of the agreement, plus six months from the end of the subscription, subject to paragraph 3.11 |
| Nature and purpose | Hosting, storage, retrieval, organisation, transmission and deletion of personal data, to enable the Account Holder to manage members, bookings, communications, payments and related operations |
| Categories of data subject | Members of the Account Holder, including children; the Account Holder's staff and Invited Users; contacts and prospects it records |
| Categories of personal data | Names and contact details; dates of birth; emergency contacts; membership, attendance and booking records; communications; bank account and payment details; photographs where uploaded; and any other data the Account Holder chooses to record |
| Special category data | Health, injury, medical and disability information, where the Account Holder records it |
| Children's data | Routinely processed, because Members of many Account Holders are minors. We do not track or advertise to Members of any age |
Annex B — Technical and organisational measures
Encryption. Data in transit is encrypted using HTTPS. Data at rest is encrypted.
Authentication. Passwords are stored using a one-way hashing function and are never stored in readable form. Multi-factor authentication is available. A security challenge is applied at login to protect against automated attacks and credential stuffing.
Hosting.
- For Account Holders within India, all data is hosted on infrastructure located within India, provided by OVHcloud.
- For Account Holders in all other territories, data is hosted on Hetzner infrastructure in Germany and Finland. Both are EEA member states, and both fall within the scope of Hetzner's ISO/IEC 27001 certification.
Processing outside the hosting location. Our support team in the United Kingdom accesses the infrastructure to provide support and onboarding, including for Indian customers. Messages to Members are delivered through our messaging sub-processors, and support correspondence is held in our support system. Each provider, its location and its transfer mechanism is listed in our sub-processor list.
Payment card data. We do not store card details. For most payment providers, payment pages are hosted by the provider, which is certified to PCI DSS Level 1; card details are entered directly with the provider and we never hold them. Where card information is submitted through a server operated by us, it is passed directly to the payment provider and discarded immediately. It is not retained and is not written to logs.
Network security. Our marketing website is served through Cloudflare, which provides content delivery and protection against denial-of-service attacks. The application is not proxied through Cloudflare; traffic goes directly to our own servers.
Monitoring and resilience.
- Availability monitoring. Server availability is monitored continuously by an independent third-party provider, from multiple geographic locations, independently of our own infrastructure.
- Automated health monitoring. Automated checks run continuously against the live environment and alert on early indicators of degradation, including message-queue processing delays, payment submission failures or delays, background job processing health, application error rates, data integrity checks and backup freshness.
- Backup monitoring. An alert is raised where the most recent database backup is more than two hours old.
Backups. Encrypted backups are taken hourly. No backup is retained beyond six months, so no data outlives the retention periods in clause 14.
Access control. Access to production systems is restricted to personnel who require it for their role.
Personnel. Personnel with access to personal data are bound by confidentiality obligations and receive data protection training.
Annex C — Sub-processors
Our sub-processor list is published on our website and linked from our Privacy Policy. It forms part of this Schedule and is maintained under paragraph 4.
Schedule 4 — Territory Annexes
Where the position for a particular country differs from these terms, that difference is set out in a Territory Annex covering: the applicable data protection law and local regulator; governing law and jurisdiction if different; currency and tax treatment; first line support hours; the payment providers available; and any local consumer law provisions.
Support model across all territories. First line support operates 09:00 to 17:00, Monday to Friday, local time. Second line support operates on United Kingdom time. No out-of-hours support is available in any territory.
India. Data is hosted within India. Payments are processed on pages hosted by the payment provider, so card information is not handled by us.
Club Manager Limited · Registered in England and Wales, company number 06734233.