GO SPORTZPlatform and app privacy notice
About this notice
This notice covers the GO SPORTZ platform: the admin portal used by coaching companies, and the mobile app used by coaches, parents and players. It explains what personal data we handle, why, who can see it, and the rights people have.
Because children use this platform and have data held on it, we have written this notice to be readable by a parent rather than a lawyer, in line with the ICO's Age Appropriate Design Code.
Who we are
GO SPORTZ Limited operates the platform. Company number: registration in progress · Registered office: to be confirmed · Contact email: to be confirmed.
Who is responsible for what
Two different organisations are responsible for data on this platform, and it matters which is which.
- Your coaching company is the data controller for the information about its members: players, parents, bookings, attendance, feedback and accident reports. They decide who to enrol, what to record and how long to keep it. If you are a parent, your contract for coaching is with them, and questions about your child's records go to them first.
- GO SPORTZ is the data processor for that information. We hold and process it on the coaching company's instructions, under a written agreement, and we do not use it for our own purposes.
- GO SPORTZ is the data controller for a narrower set of data of its own: the accounts of the club administrators we contract with, billing records, support correspondence, and security and system logs.
The precise controller and processor boundary will be confirmed by our solicitor and reflected in the club agreement.
Who can see what
Access on the platform is deliberately narrow, and it is enforced by the software rather than by policy alone.
- Parents see their own account and their own children's profiles. They cannot see other families, and they cannot see other clubs.
- Coaches see the parents and players linked to the club they belong to, and only what they need to run sessions: registers, feedback, badges and accident reporting. They cannot see families at other clubs.
- Club administrators see the members, bookings, payments and records of their own club only.
- GO SPORTZ staff do not browse club data. A small number of named engineers can access systems where necessary to fix faults, keep the service secure or comply with the law, and that access is limited and logged.
Children and their accounts
This is the part parents ask about most, so we have set it out plainly.
- A child does not get an app login automatically. A parent chooses whether to grant one, at their own discretion. Until they do, the parent manages everything on the child's behalf.
- A child cannot create their own account. Accounts for children are created and controlled by a parent, which is how we meet the requirement that a child under 13 in the UK cannot consent to an online service on their own.
- A parent can withdraw a child's access at any time.
- We do not profile children for marketing, we do not advertise to them, we do not sell their data, and we use no advertising or analytics tracking inside the app.
- Gamified features such as levels, badges, XP and homework challenges exist to encourage activity. They are not used to make decisions about a child, and there is no automated decision-making with legal or similarly significant effects.
What the platform holds
- Account details for club staff, coaches and parents: name, contact details and login credentials. Passwords are stored hashed, never in readable form.
- Player profiles managed by parents: the child's name, age group, club and team, development level, badges and XP across the four corners, homework challenge activity, exercise overview and coach feedback.
- Operational records kept by the club: bookings, attendance and registers, camps, accident reports, the communications log, and the media consent choices recorded for each session.
- Payment records for bookings: amount, date, method, status and the booking it relates to. Card numbers are handled by Stripe or PonchoPay and are never stored by GO SPORTZ.
- Technical data needed to run the service: device tokens for push notifications, and security and error logs. We exclude children's personal data from application logs.
Why we process it, and our lawful basis
- To deliver the coaching service the parent has booked: bookings, registers, session delivery and communication. For the club this is normally performance of their contract with the parent.
- To provide player development features: badges, levels, feedback, homework and exercise tracking, as part of the coaching service the parent signed up for.
- To meet safeguarding and legal duties: accident reports, audit trails and record keeping, which is a legal obligation and a matter of substantial public interest for safeguarding children.
- To take payment for sessions, as performance of a contract.
- To keep the platform secure and working, which is our legitimate interest and the club's.
Lawful bases, including the special-category and safeguarding conditions relied on for accident and medical information, to be confirmed on legal review.
Where data is stored
The platform, its database and its file storage are hosted in the AWS London region, so club, parent and player data is stored in the United Kingdom. During development the platform runs on Render; this will be updated to reflect the confirmed production infrastructure.
Who else processes data for us
We use a small number of service providers, each under a written data processing agreement. We do not sell personal data, and we do not share it with anyone for their own marketing.
- Amazon Web Services: hosting, database and file storage, in the UK. Photos and files are private and encrypted, and are reachable only through short-lived signed links.
- Google Firebase: sign-in (including Google Sign-In) and push notifications to the app.
- Stripe and PonchoPay: payment processing, including Tax-Free Childcare and childcare vouchers through PonchoPay. They act as controllers in their own right for payment data.
- Twilio SendGrid: sending service emails such as booking confirmations.
- Cloudflare: network delivery, firewall and protection against attacks.
Where a provider processes data outside the UK, that transfer is covered by safeguards recognised under UK data protection law, including the UK International Data Transfer Addendum. A current list of subprocessors is maintained in the club agreement and clubs are told before a new one is added.
How long we keep it
- Club member records are kept while the club is a customer and for a period afterwards set in the club agreement, then deleted or returned.
- A parent can ask their club to delete a player profile at any time, subject to records the club must keep by law.
- Accident reports are kept significantly longer. Claims relating to an injury to a child can be brought many years later, so these are retained on a separate schedule. Exact retention period to be set on legal advice.
- Security and system logs are kept on a short rotation.
- A full retention schedule per data category will be published here following legal review.
How we protect it
- All traffic is encrypted in transit using HTTPS and TLS.
- Passwords are hashed, never stored in readable form.
- Access is role-based and enforced in code, so the visibility limits described above cannot be bypassed in the interface.
- Files, including any session photos, are held in private storage reachable only through time-limited signed links.
- The platform is built following OWASP security guidance, and production sits behind a web application firewall with rate limiting and protection against denial-of-service attacks.
- Input is validated on the server, and children's personal data is excluded from application logs.
Photographs and media consent
Clubs record a media consent choice against each session. Where consent has not been given, images of that child should not be captured or uploaded. Consent is managed by the club, and a parent can change their choice with the club at any time.
Your rights
Anyone whose data is held has the right to ask for access, correction, erasure, restriction, portability, and to object to processing based on legitimate interests. A parent can exercise these on behalf of their child.
Because your coaching company is the controller for club records, please contact them first and they will ask us for whatever they need. If you contact us directly we will pass the request to the relevant club and support them in answering it. For data where GO SPORTZ is the controller, contact us at contact email to be confirmed.
You also have the right to complain to the Information Commissioner's Office: ico.org.uk, or by post at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Changes
We will update this notice as the platform develops and change the date at the top when we do. Significant changes will be flagged to clubs and, where they affect families, in the app.