GO SPORTZPlatform and app privacy notice
About this notice
This notice covers the GO SPORTZ platform: the admin portal used by coaching companies, and the mobile app used by coaches, parents and players. It explains what personal data we handle, why, who can see it, and the rights people have.
Because children use this platform and have data held on it, we have written this notice to be readable by a parent rather than a lawyer, in line with the ICO's Age Appropriate Design Code.
Who we are
GO SPORTZ Limited operates the platform. Company number: 17374436 · Registered office: Unit 8 Melford Road, Hazel Grove, Cheshire, SK7 6DD, United Kingdom · Contact email: team@gosportz.co.uk.
Who is responsible for what
Two different organisations are responsible for data on this platform, and it matters which is which.
- Your coaching company is the data controller for the information about its members: players, parents, bookings, attendance, feedback and accident reports. They decide who to enrol, what to record and how long to keep it. If you are a parent, your contract for coaching is with them, and questions about your child's records go to them first.
- GO SPORTZ is the data processor for that information. We hold and process it on the coaching company's instructions, under a written agreement, and we do not use it for our own purposes.
- GO SPORTZ is the data controller for a narrower set of data of its own: the accounts of the club administrators we contract with, billing records, support correspondence, and security and system logs.
The full split of controller and processor responsibilities is set out in the club agreement each coaching company signs.
Who can see what
Access on the platform is deliberately narrow, and it is enforced by the software rather than by policy alone.
- Parents see their own account and their own children's profiles. They cannot see other families, and they cannot see other clubs.
- Coaches at a club see the parents and players linked to that club, and the information they need to run sessions safely and keep children protected: registers, feedback, badges, and a child's safety and safeguarding information, such as medical details, the pick-up password and accident reports. They cannot see families at other clubs.
- Players (children), where a parent has chosen to grant them access, see only their own information: their diary, their activity and exercise overview, their XP, badges and rewards, their homework, and their own profile. They cannot see other children, other families or any club records, and they cannot message anyone.
- Club administrators see the members, bookings, payments and records of their own club only.
- GO SPORTZ staff do not browse club data. A small number of named engineers can access systems where necessary to fix faults, keep the service secure or comply with the law, and that access is limited and logged.
Children and their accounts
This is the part parents ask about most, so we have set it out plainly.
- A child cannot create their own account. A parent or guardian creates and controls the child's account, and if they choose to give the child app access they set the child's password themselves. This is how we meet the requirement that a child under 13 in the UK cannot consent to an online service on their own.
- A child does not get an app login automatically. A parent chooses whether to grant one, at their own discretion, and can withdraw it at any time. Until they do, the parent manages everything on the child's behalf.
- Every child's profile is private, and each child is linked to their parent or guardian's account.
- A child cannot message anyone through the app. There is no chat or messaging available to players, so a child cannot contact, or be contacted by, other users.
- When access is granted, a child sees only their own information: their diary, their activity and exercise overview, their XP, badges and rewards, their homework, and their own profile. They never see other children, other families or club records.
- We do not profile children for marketing, we do not advertise to them, we do not sell their data, and we use no advertising or analytics tracking inside the app.
- Gamified features such as levels, badges, XP and homework challenges exist to encourage activity. They are not used to make decisions about a child, and there is no automated decision-making with legal or similarly significant effects.
What the platform holds
- Account details for club staff, coaches and parents: name, contact details and login credentials. Passwords are stored hashed, never in readable form.
- Player profiles created and managed by a parent: the child's name, age and gender, age group, club and team, development level, badges and XP across the four corners, homework challenge activity, exercise overview and coach feedback.
- Safety and safeguarding information, held so a child can be kept safe at sessions: the parent or guardian's contact details and address, any medical information the parent provides, a pick-up password, and accident reports. This is held for the child's safety and is visible only to the child's parent and to the coaches at the child's own club.
- Operational records kept by the club: bookings, attendance and registers, camps, the communications log, and the media consent choices recorded for each session.
- Payment records for bookings: amount, date, method, status and the booking it relates to. Card numbers are handled by Stripe or PonchoPay and are never stored by GO SPORTZ.
- Technical data needed to run the service: device tokens for push notifications, and security and error logs. We exclude children's personal data from application logs.
Why we process it, and our lawful basis
- To deliver the coaching service the parent has booked: bookings, registers, session delivery and communication. For the club this is normally performance of their contract with the parent.
- To provide player development features: badges, levels, feedback, homework and exercise tracking, as part of the coaching service the parent signed up for.
- To meet safeguarding and legal duties: accident reports, audit trails and record keeping, which is a legal obligation and a matter of substantial public interest for safeguarding children.
- To take payment for sessions, as performance of a contract.
- To keep the platform secure and working, which is our legitimate interest and the club's.
Accident and medical information is special-category data. We handle it under the safeguarding and substantial-public-interest conditions recognised in UK data protection law, and only for the safeguarding and record-keeping purposes set out above.
Where data is stored
The platform, its database and its file storage are hosted in the AWS London (eu-west-2) region, so club, parent and player data is stored in the United Kingdom.
Who else processes data for us
We use a small number of service providers, each under a written data processing agreement. We do not sell personal data, and we do not share it with anyone for their own marketing.
- Amazon Web Services: hosting, database and file storage, in the UK. Photos and files are private and encrypted, and are reachable only through short-lived signed links.
- Google Firebase: sign-in (including Google Sign-In) and push notifications to the app.
- Stripe and PonchoPay: payment processing, including Tax-Free Childcare and childcare vouchers through PonchoPay. They act as controllers in their own right for payment data.
- Twilio SendGrid: sending service emails such as booking confirmations.
- Cloudflare: network delivery, firewall and protection against attacks.
Where a provider processes data outside the UK, that transfer is covered by safeguards recognised under UK data protection law, including the UK International Data Transfer Addendum. A current list of subprocessors is maintained in the club agreement and clubs are told before a new one is added.
How long we keep it
- Club member records are kept while the club is a customer and for a period afterwards set in the club agreement, then deleted or returned.
- A parent can ask their club to delete a player profile at any time, subject to records the club must keep by law.
- Accident reports are kept significantly longer. Claims relating to an injury to a child can be brought many years later, so these are retained on a separate, longer schedule set out in the club agreement.
- Security and system logs are kept on a short rotation.
- Full retention periods for each category of data are set out in the club agreement between GO SPORTZ and the coaching company.
How we protect it
- All traffic is encrypted in transit using HTTPS and TLS.
- Passwords are hashed, never stored in readable form.
- Access is role-based and enforced in code, so the visibility limits described above cannot be bypassed in the interface.
- Files, including any session photos, are held in private storage reachable only through time-limited signed links.
- The platform is built following OWASP security guidance, and production sits behind a web application firewall with rate limiting and protection against denial-of-service attacks.
- Input is validated on the server, and children's personal data is excluded from application logs.
Photographs and media consent
Clubs record a media consent choice against each session. Where consent has not been given, images of that child should not be captured or uploaded. Consent is managed by the club, and a parent can change their choice with the club at any time.
Your rights
Anyone whose data is held has the right to ask for access, correction, erasure, restriction, portability, and to object to processing based on legitimate interests. A parent can exercise these on behalf of their child.
Because your coaching company is the controller for club records, please contact them first and they will ask us for whatever they need. If you contact us directly we will pass the request to the relevant club and support them in answering it. For data where GO SPORTZ is the controller, contact us at team@gosportz.co.uk.
You also have the right to complain to the Information Commissioner's Office: ico.org.uk, or by post at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Changes
We will update this notice as the platform develops and change the date at the top when we do. Significant changes will be flagged to clubs and, where they affect families, in the app.