Data processing agreement

What is processed

• Purpose: providing ClubFuse to the club (its website, Studio, Programmes, Sponsors, Bookings & Enquiries and the Boardroom), for as long as the club uses it and then until deletion as below.
• People: the club’s staff and volunteers; players, coaches and officials (including children); sponsors and their contacts; supporters and others who make enquiries or bookings with the club.
• Data: names, roles, squad numbers and positions, photos and cut-outs, consent records, contact details, enquiry and booking details, sponsorship deals, news and match content, and sign-in records for staff accounts.
• Special care: data about children. ClubFuse shows under-18s by first name only and uses photos only where the club has recorded consent; the club must have a parent’s or guardian’s agreement.

Footy Fits’ commitments

• Process the data only on the club’s documented instructions (using ClubFuse as designed, and the club’s requests to us), unless the law requires otherwise, in which case we will tell the club first if we may.
• Make sure everyone with access is bound to confidentiality.
• Keep the data secure: each club’s data separated by rules in the database itself; encryption in transit and at rest; two-step sign-in for Footy Fits’ own access; support access to a club only for a stated reason, time-limited and logged; backups.
• Help the club answer requests from individuals (copies, corrections, deletion) and with data protection impact assessments where needed.
• Tell the club without undue delay, and within 48 hours of becoming aware, of any personal data breach affecting its data, with what we know and what we are doing.
• Make available the information needed to show we meet this agreement, and allow reasonable audits, by arrangement and at the club’s cost.

Sub-processors

The club agrees to Footy Fits using these sub-processors, each under a written agreement with the same protections:

• Supabase: database, file storage and sign-in (London, UK).
• Vercel: hosting (worldwide network).
• Resend: email sending (Ireland, EU).
• Cloudflare: Turnstile spam check on public forms and sign-in.
• Stripe: clubs’ payments to Footy Fits (it doesn’t handle the club’s own players’, sponsors’ or bookers’ data).
• We will give at least 30 days’ notice by email before adding or replacing a sub-processor; the club may object, and if we can’t resolve it, end the agreement without penalty.
• Transfers outside the UK are protected by UK-approved safeguards (the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Addendum).

The club’s commitments

• Have a lawful basis for the data it puts into ClubFuse, including consent for photos where needed and a parent’s or guardian’s agreement for anyone under 18.
• Give its own privacy information to the people whose data it holds.
• Keep its logins private and remove access for volunteers who leave.

At the end

When the club stops using ClubFuse, it can have a free export of its content and photos. Footy Fits keeps the data for 90 days, then deletes it, unless the law requires us to keep something (for example invoices). Backups age out on their normal cycle.

General

• If this agreement and the terms of service differ about personal data, this agreement wins.
• Version 2026-10-25.