Legal
Privacy notice
How Clubtab collects, uses and protects personal data, and your rights.
Last updated 7 October 2026 · Effective 7 October 2026
The short version
- We collect only what’s needed to run Clubtab and take payments. We never sell personal data.
- For player, parent and sponsor records, the club or team decides how they’re used, and we look after them on its behalf.
- Records about children are kept to a name, initials and year of birth, and are never public.
- You can see, correct, export or delete your data. Email [email protected], or complain to the ICO.
1. Who we are
Digital Antelope Ltd T/A Clubtab, trading as Clubtab, is the controller of the personal data described in this notice, except where section 2 says otherwise. Company number 11030846, registered office 5 Dol Y Ddraig, Abercanaid, Merthyr Tydfil, Wales, CF48 1DQ. We are registered with the Information Commissioner’s Office (ICO), registration number 00015469004.
For anything about your personal data, email [email protected] or write to us at our registered office. We have not appointed a Data Protection Officer because we are not required to, but the person above is responsible for data protection at Clubtab.
2. Two different roles
Where we decide (controller): your Clubtab account, our website, sign-ups, billing, support, security, and service emails.
Where your club or team decides (processor): the records team managers and club admins keep in Clubtab about players, parents, payers, sponsors and donors. For this data the club or team is the controller, and we process it on their behalf under the data processing terms in our Terms. If you’re a parent or player with a question about your records, please contact your team manager or club first. We’ll help them respond, and you can also contact us.
3. What we collect
| Type | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email, role, club and team, sign-in records | You, when you sign up and use Clubtab |
| Team records | Players’ first names, initials, surnames if the manager adds them, and year of birth; payers’ names and any contact details added; items, amounts, payment references; notes | Team managers and club admins |
| Online payments | Payer name and email, amount, what it was for, payment method type and last four digits, status | Stripe, when a payer pays through Clubtab |
| Bank statement uploads | Date, amount, name and reference of each bank line | Team managers who upload a statement |
| Receipts | Photos of receipts, supplier, amount, date | Team managers |
| Sponsors and donors | Name, and email or phone only if the manager chooses to save them | Team managers |
| Support | Messages, and a record of any support access you grant | You |
| Technical data | IP address, browser and device, pages visited, error logs | Your device, and cookies as set out in our Cookie policy |
We never receive full card numbers or bank login details. Card and bank details entered for a payment go to Stripe.
4. Children
Children don’t use Clubtab, but their teams do keep records about them. To keep this to a minimum, player records are designed to hold only a name, initials and year of birth. A surname is optional, and helps match bank transfers that only show it. Nothing about a child is ever public: statements are only visible through private links sent to their parent or carer, which expire at the end of the season. Team managers are asked not to record health or other sensitive information.
5. Why we use it, and our lawful basis
| Purpose | Lawful basis under UK GDPR |
|---|---|
| Providing Clubtab: accounts, statements, matching, reports | Contract (Article 6(1)(b)). For team records, we act on the club’s instructions as processor |
| Online payments and payouts through Stripe | Contract, and our legitimate interest in running a working payments service |
| Billing, invoices and accounting records | Legal obligation (Article 6(1)(c)) |
| Security, fraud prevention and preventing misuse | Legitimate interests (Article 6(1)(f)) |
| Support, including support access only when you grant it | Contract and legitimate interests |
| Service emails, such as sign-in links, receipts and renewal reminders | Contract and legal obligation |
| Counting visits to the website and app, without cookies or recognising you | Legitimate interests: knowing which pages are used, so we can improve them |
| Understanding how the website and app are used, with analytics cookies and session recordings | Consent, which you can withdraw at any time from Cookie settings |
| Legal claims and complying with the law | Legal obligation and legitimate interests |
6. Who we share it with
We don’t sell personal data. We share it only with:
- People in your club, according to the roles your club gives them, and parents through their own private statement links.
- Stripe, to process payments and payouts. Stripe also uses some data as an independent controller, for example for fraud prevention and to meet its legal obligations. See Stripe’s privacy policy.
- Our service providers (sub-processors), listed below, who only act on our instructions.
- Authorities, when the law requires it, and professional advisers such as our accountants and lawyers.
- A buyer, if Clubtab is sold or merged. We’d tell you first, and this notice would continue to apply.
| Provider | What they do | Where data is held |
|---|---|---|
| DigitalOcean, through Laravel Forge | Hosting and the database | UK (London) |
| Amazon Web Services | File storage, backups and reading receipt photos | UK (London) and Ireland (backups) |
| Mailgun | Sending service emails, such as sign-in links, invites and receipts | EU |
| Stripe | Payments and our own subscriptions | UK, EU and US |
| Laravel Nightwatch | Error and performance monitoring | US |
| PostHog | Product analytics: visits, and session recordings with all text hidden if you allow them | EU (Germany) |
7. Transfers outside the UK
Some of our providers process data outside the UK, including in the US. When they do, we make sure the data is protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or by the ICO’s International Data Transfer Agreement or Addendum. You can ask us for details.
8. How long we keep it
| Data | How long |
|---|---|
| Your account | While your account is open, then deleted within 30 days of closing it |
| Team and club records | While the club or team uses Clubtab. Deleted within 30 days of the club or team asking, or of closing their account |
| Contact details saved for a sponsor, donor or payer | Two years after their last payment, then removed from the record |
| Billing records and invoices | 6 years after the end of the financial year they relate to, as required for tax |
| Backups | Overwritten within 35 days |
| Security and access logs, including support access | Up to 2 years |
| Parent statement links | Expire at the end of the season |
| Unconfirmed sign-ups | Deleted after 7 days |
9. Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you;
- have it corrected if it’s wrong, or deleted in some circumstances;
- restrict or object to how we use it, including objecting to direct marketing at any time;
- receive it in a portable format (data portability);
- withdraw consent at any time, where we rely on consent;
- not be subject to decisions based solely on automated processing that significantly affect you. Clubtab suggests payment matches, but a person always confirms them.
To use any of these rights, email [email protected]. It’s free, and we’ll reply within one month. If your request is about team records, we may pass it to your club, as the controller, and help them reply.
10. Complaints
If you’re unhappy with how we’ve handled your personal data, please tell us first at [email protected]. We’ll acknowledge your complaint within 30 days and tell you the outcome without undue delay. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
11. How we keep it safe
- Data is encrypted in transit and at rest.
- Access is limited by role, and staff accounts use two-factor sign-in.
- Support can only see a team’s records when a manager grants access, for a set time, and every access is logged.
- We test our backups and review access regularly.
12. Changes to this notice
We’ll update this notice when we change how we use personal data, and tell you about significant changes by email or in the app before they take effect.