Privacy
Last updated September 2026.
OPERATOR_LEGAL_NAME, OPERATOR_ADDRESS and
OPERATOR_ICO_REGISTRATION are unset, so it does not say who the
controller is. Set them before taking real members' data.
Who holds your data, and who decides what happens to it
This distinction matters more here than the usual boilerplate, because there are two different answers depending on which data you mean.
Your club is the controller for its membership records. Your name, date of birth, emergency contact, any medical note, your availability and your selections belong to the club you are a member of. They decide what is collected and why. We hold it for them and act on their instructions — we are the processor.
We are the controller for your account. Your sign-in email, your password if you set one, your two-factor settings, your sign-in history, and — if you claimed a club — the name, address and role you gave us to do it.
In practice: to correct your membership details, ask your club. To get a copy of everything or close your account, use the links below and we will cover both.
What we collect, and why
| What | Why | How long |
|---|---|---|
| Your email address | To sign you in and to send you things you asked for | Until you close your account |
| Your name and role, if you claimed a club | To set the club up and make you its first administrator | Until you close your account |
| Sign-in history, including IP address | To show you what has happened on your account, and to spot attacks | Anonymised when you close your account |
| Membership records | Held for your club, under their instructions | Their policy; removed on request except where noted below |
| What appears on a club's public website | Only what somebody has consented to — see below | Until consent is withdrawn |
Nothing about a person is published without consent
A club's public website is built from its records, and the filter runs during the build rather than afterwards. A member with no consent recorded is not passed to the page at all, so a club cannot publish somebody by forgetting to check.
For anybody under 18, a guardian's consent is required and is recorded against the person who gave it. A photograph needs consent from everybody identifiable in it, not only whoever uploaded it.
Where it goes
Your data is stored in the United Kingdom and the European Economic Area. We use:
- A hosting provider, for the databases and the application.
- A content delivery network, to serve published club websites.
- An email provider, to send sign-in links and notifications.
We do not sell data, and there is no advertising or third-party analytics on a published club site.
Your rights
You can have a copy of everything we hold about you — and about any children you are guardian for — and you can have it removed. Both are self-service, and both cover every club you belong to rather than one at a time.
You can also ask us to correct something, to restrict what we do with it, or to object. Write to help@clubmast.com. We answer within one month and usually the same week.
What a club has to keep, even if you ask
Safeguarding records.
Clubs keep these to meet their safeguarding duty. A platform that let them be deleted on request would be a way to erase a safeguarding history.
Lines in a league's results, with your name removed.
They are a record that a match was played, not a record about you.
An anonymised sign-in history.
It is our own security log and carries nothing identifying once your account is gone.
Cookies
One cookie, to keep you signed in. There is no advertising, no tracking, and no third-party analytics — which is why you have not been asked to agree to anything.
Complaints
Tell us first at help@clubmast.com. If we do not put it right, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.