i-ClubOS — Privacy Policy
1. What this policy covers
This policy explains how we handle personal data when you:
- visit our website at www.i-ClubOS.com;
- use a i-ClubOS member app or member portal, including an app branded by your club; or
- otherwise contact us or provide us with personal data.
We refer to these together as our Services.
Read this together with our Terms of Service, .
2. The two roles we play
We are the controller for:
- personal data about the people who run a club and use our application — names, work email addresses, telephone numbers, job roles and login records;
- billing and account data;
- correspondence with our support and sales teams;
- data about visitors to our website.
This policy explains that processing.
We are the processor for:
- everything a club records in i-ClubOS about its own members, customers, patients or participants — Member data.
For Member data, the club is the controller and we act only on its instructions.
If you are a member of a club that uses i-ClubOS and you want to know what is held about you, or want it corrected or deleted, contact your club, not us. We will help your club respond, but we cannot act on your data without its instruction.
3. What we collect, and why
Information you give us. When you sign up, subscribe to our emails, complete a form, answer a survey, fill in your account profile or contact support: your name, email address, telephone number, organisation name and type, your role, and the content of your correspondence.
Information we collect automatically. Usage data such as login dates and features used; technical data such as IP address, device and browser information, used to operate and secure the Services; and whether our emails were opened and which links were clicked.
Information from others. From a third party you have authorised — for example a payment provider you have connected, or a reseller through whom you purchased. We may also validate information against public sources such as Companies House.
Special category data
We do not require special category personal data about the people who run a club, and we do not seek it.
A club may choose to record it about its members — for example an injury, a medical condition or an accessibility need. Where it does, we hold that data as processor on the club's instructions, and the club is responsible for satisfying the Article 9 UK GDPR condition.
Children
Our application is a business tool and is not directed at children. We do not knowingly collect personal data directly from a child in our own right, as controller.
However, clubs using i-ClubOS routinely record data about children — junior members of gymnastics clubs, dance schools, martial arts clubs and similar — and children may use a club's member app. That is Member data. The club is the controller, and is responsible for the lawful basis and for parental consent where required.
We do not track members and we do not advertise to members, of any age, in any territory.
If you believe we hold personal data that a child provided directly to us as controller, contact us and we will delete it.
4. Our lawful bases
| What we do | Why | Lawful basis |
|---|---|---|
| Create and administer your account; provide the Services | To perform our contract | Contract |
| Take payment and chase overdue amounts | To perform our contract; to recover sums due | Contract; legitimate interests |
| Provide support and training | To perform our contract | Contract |
| Keep the Services secure; investigate misuse | To protect our systems, our customers and their members | Legitimate interests |
| Understand how the application is used, to improve it | To develop the product | Legitimate interests |
| Send you service messages about your account | To perform our contract | Contract |
| Send you marketing about our products | To promote our business to business customers | Legitimate interests, or consent where required |
| Comply with accounting, tax and other legal obligations | Because the law requires it | Legal obligation |
Where we rely on legitimate interests, we have assessed that our interest is not overridden by your rights and freedoms. You can ask us for that assessment.
If you do not provide the information we need, we will not be able to provide the Services.
5. Marketing
We may contact you by email, post, telephone, SMS, WhatsApp or social media about our products, where you have consented or we are otherwise entitled to do so.
You can opt out at any time — use the unsubscribe link in any marketing email. Opting out may take up to one working day to take effect.
Opting out of marketing does not stop service messages about your account. If you no longer want those, close your account.
We do not use Member data to market to your members. Your members are your contacts, not ours.
6. Aggregated and anonymised insights
We may produce aggregated, anonymised statistics from data across our customer base, and publish or share them. These outputs are irreversibly anonymised: they will not identify any club, member or individual, and cannot be used to re-identify anyone.
7. Who we share information with
Our sub-processors. We use a small number of suppliers to help deliver the Services — hosting, email and SMS delivery, customer support tooling, and content delivery and security. They process personal data only on our instructions, under written contracts imposing obligations equivalent to our own.
Services you choose to connect. You may connect third party services to your account, including payment providers. Those providers are chosen by you and handle data under their own terms. We are not responsible for their privacy practices. The same applies where you enable API access for a third party.
Other circumstances. We may share personal data with our group companies; with professional advisers, auditors and insurers under duties of confidentiality; where a legal obligation requires it, or to cooperate with law enforcement or a regulator; to establish, exercise or defend legal claims or enforce our agreement; for fraud prevention and credit risk reduction; and if our business or substantially all of its assets are acquired, in which case personal data may be a transferred asset — we will tell you if that happens.
We do not sell personal data.
8. Where your data is held, and international transfers
Hosting.
- All data is hosted on infrastructure located within Europe, provided by cloud services companies.
Processing that takes place elsewhere. Hosting location is not the whole picture, and we say so plainly. Our support team in Europe accesses the infrastructure to provide support and onboarding, including for customers all over the world. Emails, SMS and WhatsApp messages are delivered through our messaging providers, and support correspondence is held in our support system.
9. How long we keep it
While you are a customer, what you keep in your account is yours to manage. You can delete records at any time, and data you delete is erased from our systems six months after deletion.
When your subscription ends, we keep your data for six months and then delete it. That period covers live data, backups and previously deleted records — after it, no copy remains in our systems. You can ask us to delete it sooner, or to return it, instead.
| Data | Retention |
|---|---|
| Account and profile data | Six months from the end of the subscription |
| Member data held as processor | Six months from the end of the subscription, or sooner on the club's instruction |
| Records you delete during your subscription | Six months from deletion |
| Backups | Taken hourly; no backup is retained beyond six months |
| Billing, invoices and payment records | As long as tax and accounting law requires, which is longer than six months |
| Support tickets and correspondence | While needed to support your account and to handle any related query or claim |
| Marketing contact data | Until you opt out, or until you have not engaged with us for a sustained period |
Closing your account does not automatically remove you from our marketing list. To be removed, use the unsubscribe link or contact us.
10. Your rights
These rights apply to personal data we hold about you as controller. For Member data, contact your club.
- Access — ask whether we process your data and receive a copy.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure — ask us to delete your data, in certain circumstances.
- Portability — receive certain data in a structured, machine-readable format. You can also export your data from the application at any time.
- Object — to processing based on legitimate interests, and at any time to direct marketing.
- Restriction — ask us to restrict processing in certain circumstances.
- Withdraw consent — where we rely on consent. This does not affect processing carried out before you withdrew it.
To exercise any of these, contact admin@i-clubos.com. We will respond within one month. That period can be extended by up to two further months for complex requests, and we will tell you if we extend it. We may ask you to clarify your request or verify your identity.
11. Cookies
We only use cookies that are strictly necessary to make our websites and application work and to keep them secure — maintaining your session, keeping you signed in, and the security challenge applied at login.
We do not use analytics cookies. We do not use advertising or tracking cookies. We do not serve advertising.
Where you make a payment to a club that uses Stripe, Stripe's payment components load on that page and may set cookies. They load only where a payment is being taken.
Because we use only strictly necessary cookies, there is nothing to opt out of.
12. Optional Google connection
A club administrator may connect a Google account to send club emails through Gmail. This is optional and set per club. When connected:
- i-ClubOS requests only the
openid,emailandgmail.sendscopes. It does not request access to read your inbox. - The connected account's email address and an encrypted refresh token are stored for that club.
- When the club sends a message, the recipients and message content are sent to Google so Google can deliver it.
- Disconnecting in Settings removes the stored authorization from i-ClubOS. You can also revoke access from your Google Account settings. Disconnecting does not automatically delete messages already sent or related logs.
i-ClubOS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to send the club's emails; it is not sold, not used for advertising, and not used to train AI models.
13. Security
We maintain technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls, multi-factor authentication, a security challenge at login, and staff confidentiality obligations. Encrypted backups are taken hourly.
We do not store payment card details. Card payments are handled by providers certified to PCI DSS Level 1. Where card information passes through our systems, it is transmitted directly to the provider and is not retained.
You are responsible for keeping your password confidential. No transmission over the internet can be guaranteed completely secure, and any transmission is at your own risk.
14. Changes to this policy
We may update this policy. When we make a material change we will publish the new version here, update the version number and effective date, and notify Account Holders by email at least 30 days before it takes effect.