For chairs and safeguarding officers
Safeguarding and data protection
A box league is names and scores, and a player signs up to nothing, has no password and gives no email address. Your club's register holds more, on any plan, because a register has to. Both lists are set out below, field by field, with what closes for a child and why.
One page · Nothing to request · Nothing behind a form
The whole record
What your club's league holds about a player
This is the complete list for a player in your club's competitions, taken from the database your club runs on. Nothing is left out of it to make the page read better. Your club's register is a second list, on every plan, and that one is below.
- Their name
- Typed by whoever built the box. It is what the table, the fixture list and the results show, and for most players it is the whole record.
- Which boxes they are in
- This season and any earlier one, so the standings can be worked out and last season can still be read.
- Their results
- The score, the date, who entered it and who confirmed it. That last part is what makes a disputed score answerable.
- A ladder place, if your club runs one
- Their matches and the rating worked out from them. The rating is recomputed from the match list every time it is read, so correcting a score corrects everything downstream.
- A player record, once they tap a box link
- Their name again as a label, which box link they came in on, the day they first tapped it and the day they were last seen. There is no email address on it, no password, and nothing they filled in.
- A signed-in browser
- One cookie on their phone, and a one-way hash of it here. We store the fingerprint of a session, never anything that opens one.
- Their level
- One figure for how well they play, worked out from their results at your club and nowhere else, and kept for every player who has played. Other members can see it unless your club turns that off. Nobody outside the club sees it, and no download carries it.
- Their notices
- What the app has told them, such as a score waiting on them or a draw going up, and whether they have read it.
- What they have asked for
- A place in a competition, a partner for one, or a time for a match: who asked whom, the dates suggested, the one optional line, and whether it was taken up.
- Games they post or join
- When they are free, who the app asked, who took a place, and the name of any guest somebody brought along. A guest is a name typed by the member who brought them, and nothing else. A member may also describe their own game in a few words, which only Find a game reads and which never becomes a level.
There is no email address in that list, no phone number, no home address, no date of birth, no membership or LTA number, no password, no gender, no photograph and no rating brought in from anywhere else. None of them appears on a box, a ladder or a draw, on any plan.
One qualification, and it is the whole of it: every club can also keep its register here, and a register does hold contact details, dates of birth and a gender where your club records them, because that is what a register is. It is a separate table in the database, and it is set out in full in the next section rather than in a footnote. The league half is unchanged by it: a phone number recorded on the register never appears on a box sheet, on a ladder or in a draw.
Two places do hold free text an admin types: the reason given for deleting a score, and the club's own activity log, which records who changed what. Our Terms already say what those are not for. They are not the place for medical notes, safeguarding records or a comment about somebody you would not say to their face.
What this page does not claim is that there is no record. A player who taps a box link is given the player record listed above, because something has to remember which name on the screen is theirs. It carries no address and nothing they filled in, and it is deleted with the club.
The app can send a notification to a phone, and that is not a contact detail. If a player taps Allow, their own browser hands us an anonymous address for that device, so the app can say that a score is waiting on them or that a draw is up. It carries no name, no email and no phone number, we cannot use it to reach anybody who has not tapped Allow on their own device, and switching it off deletes it. Nothing about the league is emailed to a player until they have proved an address of their own by answering a code.
Two players can arrange a match without either of them learning how to reach the other. One suggests up to 6 times, the other taps one. It is dates and a tap, plus one optional line of up to 120 characters, and it goes by notification like everything else. Nothing about it is binding, nobody is penalised for saying no, and there is no reply channel: it is not a chat, and the one line is short on purpose. A club that would rather its players did not send each other free text at all can leave the feature alone, and everything else works exactly as before.
Juniors are never asked or offered a game. A member can post that they are free for a game, and the app asks other members on their behalf. A junior is left out of that list whoever is posting and however the list was chosen, picked by hand included, and a junior cannot be offered a game in the app at all. Nobody who is asked learns a phone number, a level, or who else was asked.
Your club's register
A register holds more, and it is behind its own doors
Any club can keep its register here, on any plan, and bring it in from the spreadsheet it already has. A register is more than names: a club has to be able to write to its members and know which age band they are in. What follows is what a register can hold, all of it optional, all of it your club's own. Each row says which plans it is on. The membership and subs are the club plans.
- Their name
- Every plan. The register itself: who is on it, whether they are current, and the day they joined or left if the club records it. A club can stop there, and the rest of this list stays empty.
- Contact details, where the club records them
- Every plan. An email address, a phone number and a postal address. None is required. They live behind a permission of their own, so keeping the register and reading the club's contact list are two different jobs. On a competition plan only your club's owner can read them.
- A date of birth, where the club records one
- Every plan. Because a membership category or a competition is often an age band. Behind the same permission as the contact details, and for a child it does a second job: it is what closes the doors below.
- A parent's or guardian's details, for a junior
- Every plan. A name, a phone number and an email address, behind the same permission, so the club writes to the adult rather than the child. A guardian your club adds becomes a person on the register.
- A gender, tags and a note, where the club records them
- Every plan. Your club's own labels, such as "Junior" or "Team captain", and a short line about the person. Anybody your club lets read the register can see them. There is no medical field anywhere, and an import will not take a medical column, so keep the note free of anything medical or about safeguarding.
- A request to join through your club link
- Every plan. The name, date of birth and proved email address somebody gave when they asked to join, and a parent's name if a child asked. It is deleted on its own clock, set out below.
- A membership category for each year
- Club plans. Which band they are in, and the joining form they filled in if they joined that way.
- A household, and who pays for it
- Club plans. Which people are on a family rate together and which adult the club named as paying. That name is checked as an adult where the club knows a date of birth.
- What they owe and what they have paid
- Club plans. The subscription for each membership year, what was collected, and what the club recorded when somebody sent a transfer or handed over a cheque. The club's own account of its own money.
- A Direct Debit reference, if they set one up
- Club plans. An identifier for the instruction at GoCardless and whether it is live. No account number and no sort code: those are typed on GoCardless's own page and never reach us.
- Their own sign-in address, once they have proved it
- Every plan. Only where the member has answered a code sent to that address. An address the club recorded signs nobody in by itself. A junior never holds one.
- Whether the club has sent them their way in, and what came back
- Every plan. The day the message went, how many times, and whether it bounced or they said they are not a member. Never for a junior, because a junior is never sent one.
Contact details and the date of birth sit behind a permission of their own. Somebody can keep the register, add people and merge duplicates without being able to read the club's contact list, and a committee member reading the membership numbers sees how many juniors there are rather than which members they are. It is a separate table in the database, not a column on the one the league reads, which is what makes that a wall rather than a setting. On a competition plan the permission is your club's owner's alone.
The date of birth is the switch that closes doors for a child, and that is why it is held. A junior never holds a sign-in address: the route that would add one refuses a date of birth under your club's adult age, refuses it again when the code is answered, and if a birthday is filled in a month later the address and any live code are taken off the record on the spot. The consequence worth saying out loud is the one that catches people: no recorded date of birth means the software treats somebody as an adult. Leaving it blank does not protect a child, it quietly switches the protection off.
What a member is sent is about their own club, and they hold the switches. Your club can send an adult on its register one message saying that the address the club holds is how they sign in. It carries a link to your club's own page, there is no code in it, nothing in it signs anybody in, and a line on every copy stops anything else reaching that address for good. After somebody has answered a code, what reaches them is about their own play and their own membership: a score waiting on them, a draw going up, a competition your club would like them to enter, a court they have booked, a receipt or a renewal, and one morning email of what is waiting for somebody who never turned notifications on. Each kind about their play is a switch on their own screen, apart from a score waiting on them, and every one of those messages carries a one-click unsubscribe. A few messages about money, such as a receipt, also go to an address your club typed in, with a link on every copy that stops anything else reaching it. None of it is marketing.
A junior is never written to. Their parent is. A junior holds no address of their own, so what is sent about a junior goes to the parent or guardian on the child's record instead, and money about a child names the child. The sign-in message asks the same question the sign-in door asks, from the same rule in the same file: anybody under your club's adult age is left out, and so is anybody who runs the club, and a parent's address on a child's record never becomes a way in. Which brings back the sentence above about a blank date of birth, because it applies here too: no recorded date of birth means the software treats somebody as an adult, and your club is told how many of those there are before it presses anything.
Bank details never touch us. On a club plan, a member paying by Direct Debit types them on GoCardless's own page, into your club's own account. What comes back to your club's database is a reference and whether the instruction is live. The money goes from your member to your club's bank and we are not in the middle of it.
What people you have not met give you is the one thing here on a clock. Your club link, on every plan, and your joining form, on a club plan, are both public, so both collect details from people your club has not met and may turn down: a name and a date of birth either way, and a membership application also carries what they are asking to pay for. Both are deleted 90 days after your club decides them either way, and an application somebody started and never finished goes 90 days after they started it. Anything still waiting on your committee is left alone: emptying a committee's in-tray on a clock would be us making the decision. Everything else on the register is held until your club removes it, and removal takes effect at once.
All of this is in the Privacy Policy, field by field, with the lawful basis and the retention beside each one.
Juniors
The trade your club is making
A club box league with juniors in it is normal, and every tool that runs one asks for something different in return. The LTA's own Box League Manager is the fair comparison, because it is free to a registered venue and it is the tool a club is most likely to be choosing between.
Neither answer is wrong. The LTA's tool exists partly so that organisers can arrange matches on players' behalf, and it cannot do that without contact details. We do not do it, so we do not ask. A club with juniors in its boxes should know which trade it is making.
| What | Clayside | LTA Box League Manager |
|---|---|---|
| What a player needs | A link. No account, no password, nothing to install | An LTA account, signed in at competitions.lta.org.uk [5] |
| What the club holds about a player | A name, to run the leagues. On the club plans the register holds whatever your club puts in it, and no player ever sees another player's details | Contact and membership details, ranking information, standings and their matches, found by name or LTA number [4] |
| What opponents see about each other | Nothing. There is nothing to see | Each other's contact details, taken from LTA Advantage membership, emailed when matches are generated [5] |
Checked on . Where every fact about the LTA tool came from.
For the folder
What a committee needs on file
Who is responsible for what. Your club decides who goes in its league, so your club is the controller for those names and we are the processor. We do not decide who is on your register or what goes in a box, and we open your club only to fix something, as clause 4 of the data processing terms sets out. For your organisers' own accounts, and for the details given when somebody starts a league, we are the controller. That split is set out in section 2 of our Privacy Policy.
And what that leaves your club to do. Being the controller comes with four jobs, none of them hard: the ICO fee, a privacy notice your members can read, keeping only what you use, and answering people who ask. The guide walks through all four and gives you a starter privacy notice to adapt, filled in from what the register actually holds.
The processor terms. Written out on one page, covering the Article 28(3) list: subject matter and duration, the nature and purpose, the kinds of data and the people it is about, your instructions, confidentiality, security, sub-processors, help with a request from a player, what happens at the end, and audit. Nothing to request and nobody to email first.
Where the data lives. Your club's league is a database of its own, not a shared table with a club column in it, and it is pinned to the EU when it is made. That constraint is set once and cannot be loosened afterwards, by us or by anyone at Cloudflare. Our sub-processors are named in full, with what each one gets and what for.
What we never do. No analytics of any kind, no ad network, no profiling, no third-party fonts or scripts on the pages your members read, and nothing sold or shared with anybody. There is one cookie and it signs an organiser in. You have not seen a cookie banner here because there is nothing to ask you about.
The one sponsor slot. Every league page has one, at the top of the page and at the foot of the pictures the club shares: one name and, if there is one, a link to their website. A paid plan makes that name the club's own. On a free league, during a trial and on the demos it carries one sponsor of ours, who pays us for it, which is what a league that costs a club nothing is paid for by. Either way it is a name in the club's own type: nothing loads from the sponsor, no script of theirs runs, nobody is tracked and no click is counted. The same content rule binds ours as binds yours. Our Terms rule out a gambling brand, an alcohol brand and anything political, on the grounds that juniors and their parents read the league, and we can require a sponsor to be taken down. There is never a second name, and nothing else is sold into your league.
Getting it back, and getting rid of it. A club owner can export the whole league as one file at any time, and ask us to delete the lot by email from the owner's address. How long we keep what, and what happens if a breach ever puts somebody at risk, is in the Privacy Policy. We report to the ICO within 72 hours.
Age. You have to be 18 to run a club here. A club putting junior members' names in a box league is doing so as controller, under its own safeguarding and consent arrangements, which is the same footing as the fixture list on the noticeboard.
Questions
What a safeguarding officer asks
Does a junior need an account?
No. There is nothing for a player to sign up to. Your organiser puts a name in a box and shares one link with the box, and a player taps the link and taps their name. No email address, no password, no app to install, and no age check to fail, because there is no account being created.
A parent in the same household on your register signs in as themselves and acts for their children from their own screen: arranging matches, editing details, reading notices. Your club's activity log names the parent, not the child, for everything they do.
A player who has tapped the link does get a record in your club's database: their name again as a label, which link they came in on, and when they were last seen. That is the whole of it, and it is listed in full above. We would rather write that down than claim there is no record at all.
Can players see each other's contact details?
No. A box sheet, a ladder and a draw carry names and scores, and nothing about how to reach anybody.
Your club's register does hold contact details, on any plan, where your club chooses to record them. On a competition plan only your club's owner can read them, and on a club plan only the officers your club gives that permission. They never appear on a box sheet, a ladder or a draw, and no player has ever been able to see another player's. Arranging a match is still dates and a tap.
Players can suggest times for a match in the app: up to 6 of them, which the other player taps one of to accept. It travels as a notification, so nobody learns how to contact anybody. There is one optional line of text with it, capped at 120 characters, and it is not a message thread.
Anything longer happens the way it already does, in the group chat or at the club. That is a real limitation and it is worth knowing before you choose: if your organisers arrange matches on players' behalf and need contact details to do it, you want a tool that holds them.
Who can see our league?
Anyone who has your club's Clayside address can read this season: the names in each box and the scores. It is the table you would otherwise pin to a noticeboard. Earlier seasons need somebody to be signed in, so a passer-by cannot walk back through every roster your club has ever entered.
A club that has not published a website is not offered to search engines at all: every path answers a crawler with "do not index", before anything else happens. A club that HAS published one is offered those pages and nothing else. The boxes, the ladder, the draws, the courts and the register stay out of every index either way, and no page we render carries a member's name unless your club put it on a contact card.
The one thing to treat carefully is the box link itself. Anyone holding it can enter scores as anyone in that box, which is the trade that makes the whole thing work without forty passwords. Post it in the box's group chat, not on a public page.
Can we take a player's name off?
Yes, and your club can do it without asking us. An organiser can correct a name or remove a player from a roster in seconds, which is faster than any request to us could ever be.
One honest caveat, the same one our privacy policy makes: removing somebody from a current roster does not erase results they have already played. A finished season with a hole in it is not a record any more, and the rest of the box has its own interest in an accurate one. If a name has to go entirely, your club's owner can erase it in one press: the name and everything else that says who they were goes, the scores stay with nobody's name on them, and it cannot be undone.
Where are your Article 28 processor terms?
On one page, written out clause by clause: what we process, for how long, on whose instructions, who our sub-processors are, what happens at the end, and what we do if something goes wrong. Print it and file it.
Your club is the controller for the names in its league and we are the processor. That split is set out in our Terms and our Privacy Policy, and the processor terms are the annex a committee actually needs to keep.
What happens to the data if we stop using Clayside?
A club owner can download the whole league, every player, every result and every season, as one file, at any time, from inside the app. No request form and no charge. It works on your last day as well as your first.
Ask us to delete the club and the database goes within 30 days, and no backup survives it. Asking means an email to hello@clayside.app from the owner's address, and the days run from the day you asked. There is no delete button, on purpose: it would take every member's record in one tap, with nothing to undo it. Export first, because that is final.
Sources
Where this came from
Everything above about LTA Box League Manager was read on , on these pages:
- LTA: what is Box League Manager?
- LTA: who can use Box League Manager and Results Manager?
- LTA: how can I apply for access?
- LTA: Box League Manager Tool User Manual (PDF, November 2022)
- LTA: Box League Manager, how to enter a box league (PDF, December 2022)
Everything above about Clayside is checkable on the live demo, in the guide, and in our Privacy Policy.
Product and company names on this page belong to their owners. Clayside is not affiliated with, endorsed by or connected to any of them. We check these pages three times a year. If we have got something wrong about your product, tell us and we will fix it.
If it is approved
One box is free for good, with no card
Start with a single box and see what your members are actually asked for, which is a link and their own name. Nothing here needs a decision from the committee first.