Privacy policy
This policy explains how SortMyClub (SortMyClub) handles personal data. Questions or requests: [email protected].
Two different roles
- Club members' data: each club decides what it collects about its members and why. For that data the club is the controller and we are its processor. If you're a member of a club, the club is your first point of contact for questions about your data. We'll help them answer.
- Our own customers and visitors: for the people who sign a club up, the club's billing contacts, and visitors to sortmyclub.com, we are the controller.
What we collect
For clubs (as processor): whatever the club records, typically name, contact details, address, date of birth, emergency contact, membership type and history, event bookings, orders and payments, and anything else the club asks for in its own forms.
For our customers (as controller):
- the name, email address and club details given when signing up
- billing details handled by Stripe (we see the card type and last four digits, never the full number)
- messages you send us
For everyone using a site: technical information needed to run and protect the service, such as IP address, browser, pages requested and error logs.
Why we use it
- To provide each club's site and do what the club asks (contract with the club; the club's lawful basis for its members).
- To bill clubs and manage their account (contract).
- To keep the service secure, prevent abuse and fix problems (legitimate interests).
- To send service emails such as receipts, renewal reminders the club has switched on, and important notices (contract / legitimate interests).
We don't sell personal data, and we don't use it for advertising.
Who we share it with
We use these suppliers ("sub-processors") to run the service:
- Stripe: card payments for clubs' subscriptions, and for clubs that take payments online.
- Cloudflare Turnstile: checks that sign-up and registration forms are filled in by a person.
- Our email provider: sends the site's emails. A club can choose to use its own mail server instead.
- Google Fonts: serves the typefaces used on pages, which means your browser requests them from Google.
- Google Analytics: measures visits to our public website. If you accept analytics cookies, it collects how you use those pages (pages visited, device and approximate location) for us; if you don't, it only gets cookie-free signals that a page was visited. Club sites and member areas don't use it.
- Our hosting provider: stores the service and its databases.
We only share what each supplier needs, under contracts that protect the data. Some suppliers may process data outside the UK. When they do, we rely on UK adequacy regulations or the UK's approved contract clauses.
How long we keep it
Clubs control how long they keep their members' records.
- Archived members: when a club archives a member, a copy is held for up to 7 years and then deleted.
- Cancelled clubs: a club's data is deleted 30 days after it cancels.
- Backups: these expire on a rolling basis.
- Billing records: we keep these for as long as the law requires (usually 6 years).
Your rights
You have the right to:
- access your data, and correct it
- have it erased, or limit how it's used
- object to how it's used
- have it transferred to you or someone else
For a club's members' data, ask your club. We'll help them respond. For anything else, contact [email protected].
If you're unhappy with how your data has been handled, you can complain to the Information Commissioner's Office (ico.org.uk).
Security
Each club's data is held in its own separate database. Sensitive fields such as date of birth and phone number are encrypted. Connections use HTTPS. Access is limited by role, and we take regular backups.
Changes
We'll update this page when how we handle data changes, and tell club administrators about significant changes by email.