SeasonSet Privacy Policy
Who we are
SeasonSet (“we”, “us”) is a club-management platform for sports and activity clubs: teams, schedules, attendance, communications and an optional club shop and subscriptions.
SeasonSet is operated by SeasonSet Ltd (company number 17163812), registered office Unit C, Blackett Street, Manchester, England, M12 6AE. Contact: info@seasonset.co.uk. ICO registration: 00015811488.
We comply with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
Your club and SeasonSet: who is responsible for what
SeasonSet is used by clubs. For the member, parent, coach and participant data that a club puts into SeasonSet:
- The club is the data controller. It decides who is on its teams, what it asks you for and why.
- SeasonSet is the data processor. We store and process that data on the club’s behalf and only on its instructions.
For the data we need to run the service itself (your login, security logs, billing contact for the club account), SeasonSet is the controller.
If you want to see, correct or delete your data, ask your club first. We will help the club respond.
What we do not do
- We do not show advertising and do not use advertising or marketing-tracking technologies.
- We do not sell, rent, syndicate or otherwise provide personal data to third parties for their own purposes. This includes governing bodies, media organisations, data brokers, social networks and advertisers.
- We do not build advertising profiles.
The only third parties that receive data are service providers acting on our behalf, listed in section 6.
Information we hold
| Category | Examples | Source |
|---|---|---|
| Account details | Name, username, email, phone/mobile, postal address, role (club admin, coach, parent, participant) | You, or your club |
| Participant details | Date of birth, team memberships, attendance, absence requests | Your club, or a parent/guardian |
| Family links | Which guardians are linked to which participants | Your club |
| Club activity | Events, sessions, notifications and actions sent to you, attachments and club media | Your club and its coaches |
| Shop and payments | Orders, order items and amounts, subscription plans, charges, payment status and Stripe references | You and your club |
| Security data | Hashed password, MFA settings (the TOTP secret is encrypted), login and logout events with IP address, audit records of changes | Generated by the service |
| Email records | Which service emails were sent to which address, and whether they bounced | Generated by the service |
| Calendar feed | A hashed token if you turn on calendar subscriptions | You |
| Support recordings | Screen-session recordings of how the app is used, only when you switch them on (see section 5) | Your browser |
We do not collect GPS location, video, or performance tracking data, and we do not store your payment card number. Card payments are taken by Stripe (section 6).
Children
Participants may be under 18. Children’s data is entered by the club or by a parent/guardian. Within a club, other guardians and participants see only names, not contact details or dates of birth. We do not share children’s data with anyone outside the service providers in section 6.
How and why we use it
| Purpose | Lawful basis |
|---|---|
| Provide the service your club has set up (teams, schedules, attendance, messages) | Contract; the club’s instructions as processor |
| Take and record shop payments and subscription charges | Contract |
| Send service emails (invitations, password resets, reminders, action requests) | Contract / legitimate interests |
| Keep accounts secure: login, MFA, lockout, audit trail | Legitimate interests; legal obligation |
| Investigate misuse and breaches of our terms | Legitimate interests |
| Investigate a problem you are having by recording your session | Consent. You switch it on yourself and can withdraw it at any time |
We send only service messages. We do not send marketing email.
Cookies, local storage and session recording
Strictly necessary (no consent needed):
- An
HttpOnlycookie holding your refresh token, so you stay signed in. - A short-lived access token in your browser’s local storage.
- Account preferences held on our servers, for example which onboarding tours you have completed.
Session recording for support. Recording is off unless you turn it on. If you have a problem and support asks, an adult user (club admin, coach or parent) can switch it on. We only record how the app behaves (the pages you visit, where you click and the layout of each page) so we can see and fix the problem.
- What is hidden: names, email addresses, phone numbers and addresses, and everything shown on the page itself (tables, forms, dialogs, menus), anything you type, passwords, and the data exchanged between the app and our servers. Only the sidebar menu and the page layout remain visible.
- How long: it switches itself off 24 hours after you turn it on, and you can switch it off sooner. Switching it off stops recording immediately. Switching it on again asks for your choice again.
- Who sees it: SeasonSet support only, through our service provider OpenReplay (section 6). Recordings are deleted after 30 days.
- Identification: a recording is tied to a random session ID shown to you on that page, which you can quote to support. It is not tagged with your name or username.
- Children: participant-only accounts have no switch and are never recorded.
- Withdrawing consent is as easy as giving it: switch it off. We keep a record of when you switched it on or off for our audit trail.
- Internal accounts: the SeasonSet company administrator account, used only by our own staff, is always recorded. No club or member account is.
We do not use advertising, social-media or cross-site tracking cookies.
Who we share data with
These providers process data for us, under contract, and may not use it for their own purposes:
| Provider | What they receive | Why |
|---|---|---|
| Zoho (email, EU data centre) | Recipient email address, email content and attachments | Sends service emails and receives bounce notices |
| Stripe | Order line items (product name, quantity, price), order and club identifiers, the club’s business name; the payer enters their own payment details directly with Stripe | Takes shop payments for clubs through Stripe Connect. Stripe is also an independent controller of payment data under its own privacy policy |
| OpenReplay | Masked session recordings, only while you have switched recording on (section 5) | Helping us investigate a problem you report |
| Google (Places API) | Address text you type into the address search box, sent from our server without your identity | Address autocomplete when entering a venue or home address |
| Google (Fonts) | Your IP address and browser details when your browser loads the app’s typeface | Page styling |
We may also disclose data where required by law or to protect people’s safety and our legal rights.
Calendar feeds. If you choose to subscribe Google, Apple or Outlook Calendar to your private feed, that provider fetches and stores the schedule under its own policy. The feed contains team names and schedule details only, no participant, parent or coach information. You can switch it off or reset the link at any time.
International transfers
Our hosting is in the United Kingdom. Where a provider processes data outside the UK, we rely on an adequacy decision or the UK International Data Transfer Addendum / Standard Contractual Clauses.
How long we keep data
| Data | Retention |
|---|---|
| Account and club data | While the club’s account is active, or until the club tells us to delete it [confirm] |
| Deactivated accounts | Email, phone and address are cleared on deactivation. Name and username are kept so historic records and audit trails stay intact |
| Audit and login records | 60 days by default, then automatically purged |
| Session recordings | Only while switched on (24 hours at most per opt-in), then deleted after 30 days |
| Backups | 30 days; encrypted at rest |
Security
- Passwords are hashed; MFA via authenticator app is supported and its secrets are encrypted.
- Each club’s data is isolated from every other club at both the application and the database level.
- Backups are encrypted and integrity-checked.
- Traffic is encrypted in transit; sensitive values are masked in logs.
- Access is limited by role.
No system is perfectly secure. If a breach affects your data we will notify the club, and the ICO and affected individuals where the law requires.
Your rights
You can ask to access, correct or delete your data, to restrict or object to its processing, to receive a copy in a portable format, and to withdraw consent where we rely on it. Contact your club, or info@seasonset.co.uk. We aim to respond within one month.
If you are unhappy with our response, you can complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113.
Changes
We will update this page when our practices change and will change the date at the top. We will tell club administrators about material changes.