Privacy Policy

Last updated: 31 August 2026 · Version 1.0

1. Who we are

Half-Time FC ("we", "us", "our") provides an app and website (app.half-time-fc.com) that help grassroots youth football clubs manage registration, availability, match planning, live match stats, training and communication. For further details, and for any questions about your privacy or this policy, contact us at privacy@half-time-fc.com.

Who is legally responsible for a given piece of personal data depends on who decides why and how it is used — and that is not the same for everything in Half-Time FC. So this policy explains it activity by activity, in the next section. Whether someone is a "controller" or a "processor" is decided by what actually happens with the data, not by any label in a contract.

2. Who is responsible for your data — the club and Half-Time FC

UK GDPR uses two roles. A controller decides why and how personal data is used. A processor only acts on a controller's documented instructions. The same organisation can be a controller for some activities and a processor for others, so we set out both below.

The club is the controller for the data in its account

When a club uses Half-Time FC, the club is the controller for the personal data held in its account, and Half-Time FC is the processor — we process that data only on the club's instructions, to provide the service. This covers:

• player records — name, date of birth, photo, positions, availability, attendance, minutes played, match and training events, and reports;
• medical conditions and allergy notes, and emergency-contact details, held for a player (see section 4);
• parent/guardian records held in connection with a player;
• the club's own club admin, coach and assistant-coach records held in its account — contact details, role assignments, team allocations and qualifications.

The club is the controller for this data because the club decides to collect it, what to collect, what it is used for, who it is shared with, how long it is kept, and how requests from individuals are answered. People who hold a club admin, coach or assistant-coach role are data subjects whose data the club controls; they act under the club's authority and are not themselves controllers of players' data.

We do not use a club's account data for our own purposes. We do not combine or compare it across clubs, produce cross-club analytics or benchmarking, use it to choose or target sponsor placements, or use it to train or improve models or the product. We act only on the club's instructions and to keep the service running and secure.

Half-Time FC is the controller for running the service

Separately, and in our own right, Half-Time FC is the controller for the data we need to operate as a business:

• platform account and sign-in data — email address, credentials, sign-in records and device/session information — for the people who hold an account;
• billing and subscription data;
• support correspondence;
• product telemetry, error logs and usage analytics;
• marketing communications to prospective and existing club customers;
• our own employees and contractors.

We are registered with the UK Information Commissioner's Office (ICO) and pay the data protection fee for this activity.

When the same person appears in both

The same person's details can appear in both roles, as separate activities. For example, a coach's email address sits in the club's account (where the club is the controller and we are the processor) and also on that coach's own platform account used to sign in (where we are the controller). These are different processing activities with different responsibilities — not one record with two labels. We cannot be both controller and processor for the same activity.

Half-Time FC is an online service likely to be accessed by children, so the ICO's Age Appropriate Design Code (the "Children's code") is relevant to how we design and run it. We keep it in mind in our design choices; we do not claim full conformance with the code.

3. Our approach to children's data

Half-Time FC is used to organise football for children. We take that responsibility seriously and have designed the product around data minimisation, strong access controls and safeguarding:

• A child never registers themselves. A parent or guardian creates and manages the child's profile.
• We collect only what a club needs to run football safely — not to profile or advertise to children.
• We do not use third-party advertising networks, and we never sell personal data.
• There is no private messaging between adults and children in the app. Guardians can see coach communications.
• Sensitive details — medical notes, allergies and emergency contacts — receive additional field-level encryption.

4. Information we collect

Depending on your role, the following may be processed. For most of the categories below the club is the controller and we are the processor; for account, technical, billing and marketing data we are the controller (see section 2).

Medical conditions and allergy notes are "special category" data under Article 9 of UK GDPR and get extra protection, including additional field-level encryption. They are collected and used on the basis of the guardian's explicit consent (see section 5), only to help keep the child safe.

Emergency-contact details are personal data about another person — the named contact, who is often not an app user. They are held only so the club can reach someone in an emergency, and whoever enters them should make sure that person is content for their details to be used in this way.

5. Why we process it and our lawful basis

For data in a club's account, the club (as controller) is responsible for the lawful basis; the bases relied on within Half-Time FC are:

• Consent — for optional items such as photos, and for special category data (medical/allergy information), given and managed by the child's guardian and revocable at any time.
• Legitimate interests — to run core team administration (availability, line-ups, stats, reports), balanced against the rights of the people involved.
• Legal obligation — where information must be retained or disclosed to meet legal or safeguarding duties.

For the data we control ourselves (section 2), our bases are contract (to provide accounts and billing), legitimate interests (to run, secure and improve the service, and to reach club customers), and consent where required (for example some marketing).

6. Who can see what

Access is controlled by role and enforced on our servers, not merely hidden in the app:

• Coaches and assistant coaches see their own team's players, plans and permission-gated contact/medical details.
• Parents/guardians see and manage their own child, and view that child's team information — view-only.
• Club admins manage teams and safeguarding oversight for their club.
• Opposition visitors see a temporary logistics-only page with no child personal data.

7. Sharing and processors

We do not sell personal data, and we never share it for advertising. To run Half-Time FC we rely on a small number of trusted service providers ("sub-processors"). For data in a club's account these act as the club's sub-processors, engaged on the club's instructions; for the data we control ourselves they act as our processors. Each is bound by a data-processing agreement.

Our database, where personal data is stored, is hosted in the UK/EU (London region). Where a provider above processes limited data (such as an email address or a device push token) outside the UK, we rely on UK GDPR transfer safeguards — an adequacy decision, or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses. This list may change as the service grows, and we will keep this policy up to date.

8. How long we keep it

Data is retained for 12 months following the last login for the club or team, unless a deletion request is received earlier. Deletion requests are actioned as soon as practicable, after which data is deleted or anonymised. For the data in a club's account, the club, as controller, can ask us to apply a shorter retention period. Shareable opposition match pages auto-expire (around one month after the match). Some data we control ourselves — for example billing records — may be kept longer where the law requires it. When a guardian asks their club to erase a child's data, we help the club remove what it is not legally required to keep.

9. How we protect it

• Encryption in transit (TLS) and at rest (AES-256), with additional field-level encryption for medical and emergency-contact data.
• Role-based access enforced on every request; least-privilege access for our team.
• Multi-factor authentication for admin and coach accounts.
• An immutable audit log for safeguarding-relevant actions, plus monitoring and a breach-response process.

10. Your rights

You (or a guardian on a child's behalf) have rights under UK GDPR: access, rectification, erasure, restriction, objection, portability, and the right to withdraw consent. Where to send a request depends on who controls the data:

• Data in a club's account — player records, guardian and coach/admin details held by the club, medical and emergency-contact details, and match and training data. The club is the controller, so these requests go to the club. Half-Time FC helps the club respond and provides in-app export and erasure tools, but we will not action requests on a club's data ourselves.
• Data Half-Time FC controls — your platform account and sign-in data, billing, support correspondence, analytics and marketing. Send these requests to us at privacy@half-time-fc.com.

Not sure which applies? If your request is about a child's football record or team information, it is almost certainly the club's to answer; if it is about your login, a payment or our emails, it is ours. Contact us either way and we will point you to the right route. You can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

11. Player portability between clubs

If a child moves to another club that also uses Half-Time FC, their guardian can ask for the child's information to be copied to the new club. Each club holds its own separate record for the child and sees only the history built at that club. Any such transfer is started by the guardian and approved by the club before it happens; Half-Time FC does not move a child's record on its own initiative and does not keep a player identity that exists independently of a club.

12. Cookies and analytics

Our website uses only essential cookies (for example, to keep you signed in). We do not use advertising networks or cross-site tracking, and we do not track children across the web.

13. Changes to this policy

We may update this policy and will change the "last updated" date above. Significant changes will be communicated in-app or by email.

14. Contact

Questions about this policy or your data? For data held in your club's account, contact your club in the first instance. For data Half-Time FC controls — or if you're not sure — contact us at privacy@half-time-fc.com or via the contact page.

Get in touch

Coaching a team, running a club, or just want to know if Half-Time FC fits? We'd love to hear from you.