# Privacy Policy _Last updated: September 2026_ This Privacy Policy explains how personal information is used when you use this league website (the “Site”). The Site is a **Footy League** league site operated by the organisation that runs this league. Please read it together with our [Cookies Policy](/cookies-policy) and [Terms](/terms). We process personal data in line with applicable **UK law**, including **UK GDPR** (Retained Regulation (EU) 2016/679 as it applies in UK law) and the **Data Protection Act 2018**. **This Policy is factual about how this league website works.** External **UK legal review** of the May 2026 version was completed in **May 2026**. The later acquisition-attribution, youth-safeguarding, and optional Stripe club-payment additions should be reviewed with your adviser before production publication. --- ## Who we are **Controller:** the organisation that operates this league website. **Platform:** Footy League provides the software used to run the Site. **Privacy / data requests:** Contact the league administrator through the Site (for example via an administrator account, or the contact details published by your league). We will verify your identity when needed before responding. --- ## What this Site does The Site lets league participants and officials use accounts to view and manage league information, including teams, registrations, fixtures, results, match administration, discipline-related records, fines and balances, lineups (where relevant), uploads such as photos or badges where enabled, and account-related notices. Some information is displayed to other authorised users according to league rules and access controls implemented on our systems. --- ## What personal information we collect Depending on how you use the Site, categories may include: - **Account & profile** — Email address; name; identifiers for your login; approval or role flags (for example administrator, referee, team manager); team association. - **League operational data** — Player roster records (such as names, slug or internal IDs, shirt numbers, dates of birth if supplied, registration or approval workflow state); fixtures; lineups and match-event data entered through the league tools; disciplinary or card-related summaries where recorded; referee assignments. - **Financial and payment records** — Competition entry fees, fines, adjustments, due dates, financial holds, and online or offline payment records associated with a club. If online collection is enabled, this includes limited Stripe transaction identifiers and payment status; Footy League does not store full card details. - **Images** — Adult player photos, adult team squad photos and team badge images when uploaded through manager or admin tools. Player and squad-photo uploads are disabled for teams assigned to U7–U18 divisions; club badges remain available. Depending on Site configuration, files use **league-operated HTTPS media hosting** (for example website / cPanel media) or tenant/team-scoped Supabase Storage. - **Communications** — Operational email delivery to addresses we hold (for example account, registration, fixture, or administrative notices). New Footy League owner accounts may also receive a short, behaviour-based setup sequence with guidance relevant to whether they have created or finished setting up a league. Optional setup guidance can be disabled from any follow-up email. We do **not** use this Site as a promotional / marketing mailing list. We may also retain **technical identifiers** strictly as needed for security or reliability (handled through our processors, for example service logs hosted by suppliers). --- ## Why we use it and lawful bases (summary) Lawful bases under UK GDPR must fit each purpose precisely. Typical alignments for this league website are summarized below — **adjust with your adviser** if your practices differ: - **Providing accounts and the Site** — **Performance of a contract** with you / steps prior to entering it; League rules and legitimate expectations. - **Running the competition (fixtures, rosters, results, officiating workflows)** — **Legitimate interests** (operating a football league proportionately) **and/or** contractual necessity. - **Optional error reporting (Sentry) and video embeds (YouTube)** — **Consent** (managed via the cookie banner and footer settings). - **Emails strictly needed to administer the league (not marketing)** — **Legitimate interests** and/or contractual necessity (**PECR**: service messages aligned with league participation). - **Optional owner onboarding guidance** — **Legitimate interests** in helping a new owner configure the service they requested, limited to a short setup sequence with an email-level opt-out. - **Legal, regulatory or serious incident handling** — **Legal obligation** and/or substantial public interest — as applicable. We **do not** intend to rely on automated decision-making that produces legal or similarly significant effects about you solely by automated processing. Ordinary league administration workflows are human-reviewed. --- ## Who we share data with — processors & infrastructure We use suppliers who process personal data **only on our instructions**. Key categories: - **Supabase** — Cloud database (PostgreSQL), authentication, APIs, hosted server logic (“Edge Functions”), and tenant/team-scoped file storage when the Site does not use the configured cPanel media uploader. Our Supabase **project region** is **West EU (Ireland)**. - **Resend** — Delivering transactional / operational league email messages initiated by automated jobs from our backend when notifications are configured and enabled. We have **executed Resend’s Data Processing Agreement (DPA)**, which sets out how Resend processes personal data on our behalf and includes appropriate safeguards for international transfers where they apply. - **Stripe** — If the league enables online club collection, Stripe hosts onboarding and Checkout, processes the club's payment for the league, supplies payment/refund/dispute status, and handles payouts to the league's connected account. The league is the business the club pays; Stripe's own privacy notice also applies to information supplied to Stripe. **League HTTPS media hosting** — When configured, permitted adult player/team images and club badges are uploaded to **HTTPS endpoints and storage configured for this league website** instead of the Supabase Storage fallback. That processing remains under our direction. Processors publish their own **privacy notices** and **documentation** about security and transfers. Retain your signed supplier documents (including the Resend DPA) with your records. --- ## International transfers **Supabase (database, auth, Edge Functions)** is configured in **West EU (Ireland)**. Processing in the EEA on our instructions is covered by our arrangements with Supabase and their published terms and documentation. **Resend (email delivery)** is a service with **global infrastructure** (including the United States). Personal data needed to send messages (such as **email addresses** and **message content**) may be processed outside the UK. We rely on **appropriate safeguards** recognised under UK GDPR, **including our executed Data Processing Agreement with Resend** and such further measures as described in Resend’s documentation. Keep your **signed Resend DPA** with your compliance records alongside this Policy. UK personal data may also be disclosed to recipients (for example hosting or DNS operators) incidental to displaying **Google Fonts** and similar requests described in our [Cookies Policy](/cookies-policy); see that Policy and supplier documentation for detail. --- ## Club payments on the Site The league may enable Stripe-hosted online collection for competition entry fees, fines, and other displayed club balance items. Payments are presented in the league's locked collection currency and are made directly to the league's connected Stripe account. The league is responsible for the charge, refunds, disputes, its Stripe account, and any currency conversion or settlement costs. Footy League provides the software connection, does not take a per-payment platform fee, and does not collect VAT or GST. Stripe, rather than the Site, collects card details and sends its own receipt. The league may also record bank, cash, or other offline payments with a reference. --- ## Retention We keep personal information **only as long as needed** to run league seasons, handle disputes or complaints, meet legal obligations, and maintain sporting integrity records as appropriate for your federation rules. Exact schedules may vary — contact the league administrator to ask **what we hold about you** and deletion options. --- ## Security Access to privileged areas relies on passwords and Role-Based safeguards in software. Keep your credentials confidential ([Terms](/terms)). Despite safeguards, transmission over the open internet carries residual risk — no system is perfectly secure. --- ## Your rights under UK GDPR Subject to exemptions, you may have the following rights regarding your personal data: - **Access** — copy of personal data - **Rectification** — correct inaccurate information - **Erasure** — “right to be forgotten” where applicable - **Restriction** of processing — in defined circumstances - **Data portability** — where technically feasible for structured machine-readable supplies you supplied through automated processes - **Object** — to processing relying on legitimate interests in certain contexts - **Withdraw consent** — where consent was the lawful basis (we minimise consent-only processing here) **Subject access:** You may normally exercise these **free of charge**. We may decline manifestly unfounded or excessive repetitive requests under law. --- ## Complaints — ICO If you remain concerned about how we use personal data after contacting us, you may complain to the **Information Commissioner’s Office** (ICO), the UK regulator: [ico.org.uk](https://ico.org.uk). --- ## Cookies & similar technologies Short summary: authentication material for your session may be stored via **cookies** and/or **`localStorage`** in your browser. Optional **error reporting** (Sentry) and **YouTube embeds** load only after you consent in the cookie banner. Footy League advertising tags do not run on tenant league sites. See the [Cookies Policy](/cookies-policy) for categories and how to change your choice. --- ## Links to third-party sites The Site may contain links elsewhere. Third-party privacy practices are **their** responsibility, not ours. --- ## Changes We may update this Policy without individual notice — the current version will always carry a “Last updated” line. Meaningful changes merit republishing visibly on the Site.