Privacy notice

Two roles: ours and the clubs’

For this marketing website, enquiries to us, our customer relationship with clubs and the security of ClubFuse accounts, Footy Fits decides how data is used: we are the controller.

For what a club puts into ClubFuse (its website, players and staff, sponsors, bookings and enquiries made to the club), the club is the controller and Footy Fits processes that data for it under our data processing agreement. If your question is about a club’s data, contact the club first; we will help it answer.

What we collect, and why

• Enquiries (Get a site in your colours, Try the media tool): your name, email, phone if you give it, your role, the club’s name and website, your league link and team, what you need, and any crest or photos you upload. We use them to reply, prepare your quote, homepage concept or trial, and set up your club. Basis: steps you asked us to take before a contract, and your consent on the form.
• Club customers: the contact details of the club’s admins, what the club has bought, quotes, payments and invoices. Basis: our contract with the club, and our legal duty to keep financial records.
• Sign-in and security for ClubFuse accounts: your email address, when you sign in and how (email link, password, two-step code), a fingerprint of your device, your browser type and an approximate place worked out from your connection (for example a town). We use them to keep accounts safe and to warn you about sign-ins from a new device. Basis: legitimate interests in keeping ClubFuse secure.
• How your club uses ClubFuse: when you sign in, open the Boardroom, make or download a graphic, or make a programme or PDF, we keep a simple record of who did what and when. The ClubFuse team uses it to see how a trial or subscription is going and to offer help, and is told by email when someone from a club signs in. Only your club’s staff and the ClubFuse team can see it, and it’s never used for advertising. Basis: legitimate interests in supporting clubs and running ClubFuse.
• Emails we send (sign-in links, receipts, reminders): a record of what was sent to whom, and whether it was delivered. Basis: our contract with the club and legitimate interests.
• Visitor numbers on our marketing website (clubfuse.co.uk, not club websites or the Boardroom): we use Vercel Web Analytics to count page visits, where visitors come from (such as a search engine or a social media post), the type of device and browser, and the country. It uses no cookies and doesn’t identify you or follow you to other websites; visits are only counted in total. Basis: legitimate interests in understanding how our website is used.
• Spam protection: our forms and sign-in use Cloudflare Turnstile to check a real person is using them. Repeated attempts are counted against a one-way fingerprint of your connection or email address (never the address itself), and the counts are deleted after a day. Basis: legitimate interests in stopping abuse.

What we don’t do

• No advertising, tracking or analytics cookies, and no selling or renting of personal data.
• No third-party adverts on club websites.
• Demo videos on our website are served by us, so watching one doesn’t share anything with YouTube or anyone else.

Cookies

ClubFuse only uses cookies that are strictly necessary: the ones that keep staff signed in to the Boardroom and the Owner Hub. The marketing website sets no cookies of its own. Because these cookies are essential, we don’t ask for consent to them.

Young players

Clubs decide what goes on their websites, graphics and programmes. ClubFuse is built to protect young players: a photo is only used where the club has recorded consent, and anyone under 18 appears by first name only. Clubs must have a parent’s or guardian’s agreement before using a photo of anyone under 18.

Who else handles the data

We use these providers to run ClubFuse. Each only handles data to provide its service to us, under a written agreement:

• Supabase: the database, file storage and sign-in (servers in London, UK).
• Vercel: hosting of the website and app (a worldwide network, so data may pass through other countries), and visitor numbers for our marketing website.
• Resend: sending ClubFuse’s emails (servers in Ireland, EU).
• Cloudflare: the Turnstile spam check.
• Stripe: card payments to Footy Fits. We never see or store card numbers.
• Where a provider is based outside the UK (Vercel, Resend, Cloudflare and Stripe are US companies), the transfer is protected by UK-approved safeguards, such as the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum.

How long we keep it

• Enquiries that don’t become customers: uploaded crests and photos are deleted after 6 months, and the enquiry itself is anonymised after 24 months.
• Enquiries made to a club through its website: anonymised 24 months after the club closes them (the club can delete them sooner).
• Sign-in records: 180 days.
• Spam-check counts: 1 day.
• When a club stops using ClubFuse: its data is kept for 90 days so it can take a free export, then deleted. We can’t recover it after that.
• Invoices and payment records: as long as the law requires us to keep financial records (usually 6 years).

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable form. Email info@footyfits.co.uk and we will reply within one month. If your data is a club’s (for example you are a player or sponsor), we will pass your request to the club and help it respond.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).

Keeping data safe

• Each club’s data is kept apart by rules inside the database itself, not only by the app.
• Everything travels over encrypted connections, and the database and files are encrypted where they are stored.
• Footy Fits’ own access needs two-step sign-in, and support access to a club is time-limited and logged.

Changes

We will update this notice when ClubFuse changes, and tell clubs about anything important. Version 2026-10-25. ICO registration number: ZC257896.