Privacy Notice

1. Who we are

Club Kickoff is a mobile application for organising grassroots and amateur sports club activities (events, RSVPs, team messaging and member management).

The data controller for personal data processed in the Club Kickoff app is transparently.tech. The app is published and distributed under transparently.tech’s Google Play and Apple App Store accounts.

Relationship with clubs. Clubs and their administrators/coaches are users of the Club Kickoff platform. transparently.tech is the controller for the personal data held inside the app. A club that keeps its own separate records offline (for example, paper registration forms or its own spreadsheets) may be an independent controller for those records — that is outside the scope of this notice.

2. The personal data we collect

We collect and process the following categories of personal data.

2.1 Account & profile data

• Email address, display name
• Profile photo (optional)
• Phone number (optional)
• Postal address (optional) and approximate location/home area (optional) — used to estimate travel/departure times to events
• Account status, role within clubs, notification preferences

2.2 Children’s data (processed via the parent/guardian account)

• Child’s name
• Child’s date of birth (optional)
• The clubs/teams a child is enrolled in
• The child’s attendance/RSVP responses to events and polls

Children’s data is always entered and managed by a parent or guardian through their own account. Children do not hold their own accounts and cannot consent on their own behalf. See section 6.

2.3 Club & event participation data

• Club membership and the member’s role (admin / coach / member)
• Event attendance (RSVP “going / not going”), including on behalf of children
• Poll responses and group/event assignments
• Club and event invitations (the invitee’s email address and invitation status)

2.4 Messaging data

• Messages you send in club chat, event threads and event broadcasts (message text, sender name, timestamp)
• The list of participants in each conversation
• If you report a message or another person, or if a coach or admin removes a message, we keep a record of that report or removal — including a copy of the reported or removed message — so we can review it and keep the club safe.

2.5 Location & travel data (optional feature)

• A home or origin address and chosen transport mode that you provide, used only to calculate an estimated departure time to a specific event. This is processed on request and is not used to track you.

2.6 Technical data

• Device push-notification token (to deliver event and chat notifications)
• Authentication metadata (account creation time, last sign-in time)
• Crash and diagnostic data (crash reports, non-fatal errors, breadcrumbs and device/operating-system state) collected when the app encounters a problem, to help us keep the app stable. Your account identifier (Firebase user ID) is attached to these reports so we can correlate a crash to the affected account. We do not include your name, email or phone number in these reports.

We do not intentionally collect special-category data (e.g. health, religion). Please do not enter such data into free-text fields (e.g. messages or notes).

3. How we use your data and our lawful basis

For all core club-management processing, our lawful basis is Legitimate Interests under UK GDPR Article 6(1)(f). Our legitimate interests are: operating a functioning club-organisation service, enabling clubs to coordinate events and communicate with their members, and keeping members informed about activities they have chosen to take part in.

Consent is reserved for optional, non-core features. Core processing does not rely on consent and therefore cannot be “withdrawn” in a way that would stop the service functioning — but you retain the right to object (see section 8).

4. Who we share your data with

Your data is visible to other people within the clubs you belong to, as required for the service to work:

• Club admins and coaches can see member and child names, roles, RSVP/attendance status and group assignments for their club’s events.
• Other club members can see your display name in shared conversations (club chat, event threads/broadcasts you are part of).

We use the following sub-processors (third parties who process data on our behalf, under a data-processing contract):

When you report a safety concern, the report is sent to the other admins of your club (never to the person you are reporting) and always to us, the operator (transparently.tech), as an independent safety backstop — so a concern can be acted on even if the problem is a club admin. We send these alerts by email as well as in the app. The email tells the recipient that a report has been made, its category, who made it (and, if it was made on behalf of a child, that child’s name), a short extract of the reported message, and a link to view the full report in the app. Because we use an email provider (Resend, see above) to deliver these alerts, that limited report information passes through that provider. For a concern that a child may be at risk, we may share the report with the police or the relevant child-safeguarding authority.

We do not sell your personal data. We do not share it with advertisers.

5. How long we keep your data

We keep personal data only as long as needed for the purposes above.

When you delete your account, your profile and child profiles are deleted or anonymised, subject to any retention we are legally required to keep.

6. Children’s data

Club Kickoff is built for clubs whose members include children. We take the stricter obligations for children’s data seriously:

• A child never has their own account, and the app is not used by children. All of a child’s data is entered and controlled by their parent or guardian through the parent/guardian’s account.
• The parent/guardian provides the data and exercises the child’s rights (access, correction, deletion) on the child’s behalf.
• A child’s data is shared only within the club(s) the child is enrolled in, and only with the admins/coaches who need it to organise activities.
• We do not profile children, do not use children’s data for marketing, and do not show advertising in the app.
• The optional photo-sharing feature will require explicit consent before any child image is processed, and is not active in this release.

Because children do not access or use Club Kickoff themselves — only adult parents, guardians, coaches and administrators do — the service is not an “information society service likely to be accessed by children” under the ICO’s Age Appropriate Design Code (Children’s Code). We nonetheless apply the heightened-care commitments above to all children’s data we hold on a guardian’s behalf.

If you report a concern that a child may be at risk, we treat it as a safeguarding matter: we keep the report for as long as we need to act on it and to pass it to the right safeguarding authority, and we keep other safety records about a child for a shorter time than ordinary records.

If you are a parent/guardian and want a child’s data removed, use the contact details in section 1 or section 8.

7. International transfers

Our primary infrastructure (Google Firebase / Google Cloud) stores your member data — your profile, children’s profiles, club and event records, RSVPs and messages (Firestore) and any uploaded files (Storage) — in the United Kingdom (Google Cloud’s London region, europe-west2). Because this data stays in the UK, storing it does not involve a restricted transfer of your data out of the UK.

A small number of transfers outside the UK still apply, each protected by appropriate safeguards — the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum (and, for Resend, the EU–US / UK Data Privacy Framework) — as set out in each provider’s data-processing terms:

• Firebase Authentication credentials (such as the email address you sign in with) are processed by Google on its global infrastructure and cannot be pinned to a single region; that processing is covered by Google’s Cloud Data Processing Addendum, which incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.
• Google Maps Platform (Distance Matrix API) (used only when you request a travel estimate) may process the location you submit outside the UK, under Google’s Cloud Data Processing Addendum.
• Google Firebase Crashlytics (crash and diagnostic reports, with your Firebase user ID attached) is processed by Google on its global infrastructure and cannot be pinned to a single region; that processing is covered by Google’s Cloud Data Processing Addendum, which incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.
• Resend (Plus Five Five, Inc.), our transactional-email provider, processes email content in the United States under its Data Processing Addendum.

You can ask us for more detail about the safeguards for any specific transfer using the contact details in section 1.

8. Your rights

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you (a Subject Access Request / SAR).
• Rectification — ask us to correct inaccurate or incomplete data (you can edit most profile data directly in the app).
• Erasure — ask us to delete your data (“right to be forgotten”), subject to any legal retention.
• Object — object to our processing based on legitimate interests. Because our core processing relies on legitimate interests, you have a particularly important right to object here; if you do, we will stop unless we have compelling legitimate grounds.
• Restriction — ask us to limit how we use your data while a query is resolved.
• Portability — receive certain data you provided in a structured, machine-readable format.

To exercise any right, contact privacy@transparently.tech. We aim to respond within one month.

You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

To request deletion of your account and personal data, see our data deletion page.

9. Changes to this notice

We may update this notice. The current version and date are shown at the top of this page. Material changes will be notified in-app.