Privacy Policy

This policy explains what personal data may be processed in the Clubday platform, why it is processed, how long it is kept and what rights a person has.

Clubday is a management platform for sports organisations. Clubs and other sports organisations use it to plan training, manage members and teams, receive applications, record attendance, book facilities and communicate with members and guardians.

The policy covers the Clubday platform and its related services. It does not cover an individual organisation’s internal processes outside Clubday.

There are two distinct roles in data protection, and in Clubday both exist side by side.

When an organisation enters and manages its athletes, children, guardians, coaches or members, it normally determines why and how those data are processed. For that activity the organisation acts as controller and Clubday processes the data on its behalf.

At the same time Clubday itself determines the purpose of processing for account administration, authentication, security, platform audit, service operation and compliance with legal obligations. For that part Clubday is the controller.

It is therefore not correct to say that Clubday is always the controller, or always the processor. The role depends on the specific processing activity.

Identification data: name, surname, date of birth, contact details.

Account data: the e-mail address used to sign in, account state, sign-in events and security records. Passwords are not stored in a readable form.

Membership data: the relationship with an organisation, roles, groups and teams, start and end of membership.

Family relationships: the link between a child and a guardian, to the extent the organisation has recorded it.

Activity data: the training and event schedule, bookings and waiting lists, attendance marks, the content of applications and forms, communication history.

Payment data: where that functionality is activated, invoice and payment status information. Clubday does not store payment card details.

Technical data: basic device and browser information, error and security logs needed to operate the service.

From the person, when they create an account, complete an application or contact Clubday.

From a parent or guardian, when they apply on behalf of a child or manage the child’s participation.

From the organisation, when it enters or imports its members’ data.

From the operation of the platform itself, for example when attendance is marked or a booking is made.

To provide the service: account creation, sign-in, membership management, scheduling, bookings, attendance, applications and communication.

To perform a contract, or to take steps before entering into one, between a person and an organisation or between an organisation and Clubday.

To keep the service secure: access control, prevention of fraud and misuse, audit records.

To comply with legal obligations, including accounting and data protection requirements.

For legitimate interests: operating the service, fixing defects and maintaining platform security, to an extent that does not override the rights and freedoms of the person concerned.

Clubday is used in youth sport, so children’s data is expected on the platform and receives heightened protection.

A child’s participation is normally applied for and managed by a parent or guardian. The platform holds an explicit link between a child and the adult responsible for them, and notices about a child are addressed to that adult rather than to the child.

Responsibility for the lawful basis of processing a child’s data rests with the organisation that admits the child. Clubday provides the technical means; it does not replace the organisation’s obligation to establish that basis.

Data does not become public merely because an organisation has a public page or a public calendar. What is published is a separate decision.

The organisation a person has joined — to the extent set by the roles and permissions granted. Access within an organisation is not uniform: a coach, an administrator and an owner see different amounts of information.

A parent or guardian — for the child they are responsible for.

Clubday personnel — only to the extent, and only when, it is necessary to provide the service, to support it or to keep it secure. Such access is recorded.

External service providers — only to the extent necessary to provide the relevant service. To operate Clubday we may use trusted external providers, for example for hosting, database, authentication, e-mail delivery, security and, where that functionality is activated, payment processing. Those providers may process personal data only in accordance with Clubday’s instructions and applicable data protection requirements.

Public authorities — where legislation requires it.

Data is not sold and is not transferred to third parties for marketing purposes.

Clubday is operated primarily within the European Economic Area.

Where data is processed outside the EEA in specific cases, this is done using the applicable legal mechanisms, such as standard contractual clauses approved by the European Commission or an adequacy decision.

Account and membership data is kept for as long as the relationship with the organisation or with Clubday exists, and afterwards for as long as is necessary to meet legal requirements.

Activity history such as attendance, bookings and communication is retained as the organisation’s operating record and is not deleted casually.

Security and audit records are kept for a limited period necessary for security purposes.

Accounting and payment data is kept for the periods set by legislation.

Access to data is separated by organisation. One organisation does not reach another organisation’s data.

Access within an organisation depends on the roles and permissions granted, and permissions are checked on the server rather than only in the interface.

Connections are encrypted. Passwords are not stored in a readable form and are visible neither to an organisation’s administrator nor to Clubday.

Material actions affecting access and data are recorded in an audit trail.

The right to access your data and to be informed about how it is processed.

The right to have inaccurate data corrected.

The right to erasure, to the extent permitted by legislation and by existing obligations.

The right to restrict processing and to object to it.

The right to data portability, where technically feasible and applicable.

The right to lodge a complaint with a supervisory authority. In Latvia this is the Data State Inspectorate.

Where a request concerns data managed by a particular organisation, Clubday may forward the request to that organisation, because it is the organisation that determines the purpose of that processing.

Requests may be sent to privacy@clubday.app or submitted through the Clubday contact form.

Clubday uses only those cookies and local storage that are necessary to operate the service: maintaining the sign-in session, security and remembering interface state.

Clubday does not use advertising or profiling cookies and does not track users across other websites.

This policy may be updated as the service or legal requirements change.

Material changes are announced in the platform or by e-mail. The version date is shown at the top of this page.

Privacy and personal data questions: privacy@clubday.app

General questions and support: support@clubday.app

Contact form: clubday.app/contact