Privacy Policy

Interpretation & Definitions

The words of which the initial letter is capitalised have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

• Account means a unique account created for You to access our Service or parts of our Service.
• Company (referred to as either “the Company”, “We”, “Us” or “Our”) refers to ClubPal Ltd, 20–22 Wenlock Road, London, N1 7GU. For the purposes of UK GDPR, ClubPal is the Data Controller for data collected through the ClubPal website (clubpal.app).
• Customer refers to a ClubPal customer who runs their own instance of the Application. For the purposes of UK GDPR, the Customer is the Data Controller for personal data relating to their members and users collected through the Application.
• Cookies are small files placed on Your computer, mobile device or any other device by a website, containing details of Your browsing history on that website.
• Country refers to: United Kingdom
• Data Controller, for the purposes of UK GDPR, refers to the Company as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data.
• Device means any device that can access the Service such as a computer, a mobile phone or a digital tablet.
• Personal Data is any information that relates to an identified or identifiable individual.
• Service refers to the Application and/or the Website.
• Service Provider means any natural or legal person who processes the data on behalf of the Company.
• Third-party Social Media Service refers to any website or social network website through which a User can log in or create an account to use the Service.
• Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself.
• Website refers to the ClubPal website, accessible from https://www.clubpal.app/.
• Application refers to Customer-specific URLs, e.g. https://[customer].clubpal.app/, and to the ClubPal mobile applications for iOS and Android.
• You means the individual accessing or using the Service, or the company or other legal entity on behalf of which such individual is accessing or using the Service.

What We Collect

Data collected through the ClubPal Website (clubpal.app)

When you enquire about, sign up for, or use ClubPal as a club administrator, we collect:

• Name and email address
• Phone number (if provided)
• Date of birth, when you sign up a club, for your own member profile in it
• Club name and sport
• Usage data (pages visited, time on site, browser type)

Data collected through the Customer Application

Your club's instance of ClubPal may collect the following data about your members on your behalf, as directed by you as the Data Controller:

• Date of birth
• Emergency contact details
• Medical conditions or notes (if your club collects these)
• Membership and booking history
• Payment references (not full card details, these are held by our payment processing partner)
• Push notification tokens and app session data, for members using the ClubPal mobile app

By using the Application, you agree to our Terms of Service, which includes your obligations as the Data Controller for your members' data.

How We Use Your Data

We use the data we collect about you (as a Customer) for the following purposes:

• To provide, operate, and maintain the ClubPal Service
• To manage your account and provide customer support
• To send you service-related communications (including updates and security alerts)
• To send you marketing communications about ClubPal (you can opt out at any time)
• To analyse usage and improve the Service
• To comply with legal obligations

Lawful basis for processing

We rely on the following lawful bases under UK GDPR:

• Contract (Art. 6(1)(b)): Processing necessary to perform our contract with you as a Customer.
• Legitimate interests (Art. 6(1)(f)): For analytics, security monitoring, and improving the Service.
• Legal compliance (Art. 6(1)(c)): Where required by law.

Third-Party Processors

We share your data only with third-party processors who help us deliver the Service, and only to the extent necessary. Our current sub-processors are:

• ClubPal Payments, payment processing. Card data is sent directly to our payment processing partner and is never stored by ClubPal.
• Microsoft Azure, cloud hosting and database infrastructure (North Europe region).
• HubSpot, CRM for managing Customer enquiries and communications.

All sub-processors are required to process data only on our instructions, maintain appropriate security measures, and comply with applicable data protection law. We will notify you of any changes to our sub-processor list in advance.

Cookies

We use cookies and similar tracking technologies to monitor activity on our Service and hold certain information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.

If you do not accept cookies, some parts of the Service may not function correctly.

Types of cookies we use

• Necessary cookies: Essential for the Service to function. They cannot be switched off in our systems.
• Functionality cookies: Allow us to remember choices you make (such as your login status) to provide a more personalised experience.
• Analytics cookies: Help us understand how visitors interact with the Service so we can improve it.

Our own website statistics

Separately from cookies, the ClubPal website keeps a random visitor ID in your browser's local storage, along with the link or campaign that first brought you to the site and the most recent one. We use this to count page views and to understand which pages, searches and campaigns lead clubs to sign up, so we can improve the site. It does not contain your name or contact details, it is not shared with advertisers, and it is not used to show you ads.

If you sign up, this information is stored with your club's account so we can see how the club found us. These statistics are not controlled by the cookie banner, which covers Google Analytics only. To object, use the switch below. Turning them off deletes the stored ID and campaign details from your browser and stops us storing them again. Page views are still counted, with no ID attached.

If you sign up a club, the website also remembers that club's name and address in your browser's local storage, so the Log in page can take you straight back to it. It is not sent to us and is only used on that page and the signup confirmation page. Clearing your browser's site data removes it.

Security & Retention

How we secure your data

The security of your data is important to us. We use commercially acceptable means to protect your personal data, including encryption in transit (TLS 1.3) and at rest (AES-256), access controls, and regular security reviews. However, no method of transmission over the internet or method of electronic storage is 100% secure.

ClubPal is hosted on Microsoft Azure infrastructure in North Europe (Dublin), which meets ISO 27001 and SOC 2 compliance standards.

Retention

We retain your personal data for as long as necessary to fulfil the purposes outlined in this policy, or as required by law. If you close your ClubPal account, we will delete or anonymise your personal data within 90 days, except where we are required to retain it for legal, tax or regulatory purposes.

Member data held within a Customer's Application instance is retained according to the Customer's own retention policies, as they are the Data Controller for that data.

Your Rights

Under UK GDPR, you have the following rights in relation to your personal data. We will respond to all requests within 30 days.

To exercise any of these rights, please contact us at privacy@clubpal.app.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data lawfully.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last revised” date at the top.

We will let you know via email and/or a prominent notice on our Service prior to the change becoming effective. We encourage you to review this Privacy Policy periodically for any changes.

Contact Us

If you have any questions about this Privacy Policy or would like to exercise your data rights, please contact our privacy team. We will respond within 3–5 business days.