Legal
Data processing agreement
1. Roles
The club is the controller. Oliver Triggs, trading as ScaleYourClub is the processor. We process personal data only on the club's documented instructions, which include these terms and the ordinary operation of the services the club has bought.
2. What we process on your behalf
| Item | Detail |
|---|---|
| Subject matter | Operating a club website, supporter newsletter and online shop |
| Duration | For as long as the club is a customer, plus up to 30 days for deletion |
| Nature and purpose | Storing supporter contact details, sending matchday and club emails, handling shop orders and enquiries |
| Categories of data | Name (where given), email address, subscription and consent records, opens and clicks where the email tool reports them, order and delivery details for shop purchases |
| Data subjects | Supporters, members, parents of junior members, sponsors and people who contact the club through its site |
| Special category data | None. Do not put health, and in particular injury or medical information, into any system we provide. |
3. Our obligations
- We process personal data only on your documented instructions, unless the law requires otherwise — in which case we tell you first, if we are allowed to.
- Everyone with access is bound by confidentiality.
- We keep appropriate technical and organisational security measures, described below.
- We help you respond to supporters exercising their rights, and with any data protection impact assessment or consultation with the ICO you need to carry out.
- We tell you without undue delay, and in any case within 24 hours, if we become aware of a personal data breach affecting your data — with what we know, what we are doing, and what we advise.
- At the end of the contract we return your data in a usable format and delete our copies within 30 days, except where the law requires us to keep something.
- We make available the information you need to demonstrate compliance, and allow audits on reasonable notice.
4. Security
Being straight about the scale of this operation: it is one person with a small, modern stack, not an enterprise security programme. What that means in practice:
- All traffic is served over HTTPS with certificates managed automatically.
- Data is held with reputable providers who maintain their own recognised security certifications.
- Access is limited to the smallest number of people who need it — currently one — using multi-factor authentication.
- Supporter lists are exportable by you at any time, so you are never dependent on us to hold the only copy.
- We do not store payment card details at any point. Payments run through established payment providers.
5. Sub-processors
You give general authorisation for the sub-processors below. We will tell you at least 30 days before adding or replacing one, and you may object on reasonable data protection grounds — in which case you can end the affected service without penalty.
| Sub-processor | Purpose | Location |
|---|---|---|
| Vercel | Website hosting and delivery | USA / EU |
| IONOS | Domain registration and DNS | UK / EU |
| Email service provider | Sending club newsletters | Named to you before the first send |
| Print-on-demand provider | Fulfilling club shop orders | Named to you before the shop goes live |
Where data is transferred outside the UK, we rely on adequacy regulations or the UK international data transfer addendum.
6. What we need from you
You are responsible for having a lawful basis for the supporter data you put into our systems. In practice that means people opted in, and you can show it. Please do not upload a list scraped from somewhere, bought from anyone, or lifted out of a members' spreadsheet where nobody agreed to receive marketing — we will ask, and we would rather lose the sale than send it.
7. Liability
The liability provisions in the terms of service apply to this agreement.