Safeguarding and data protection

This is the complete list for a league, taken from the database your club's league runs on. Nothing is left out of it to make the page read better. A club that also keeps its membership register here holds a second list, and that one is below.

There is no email address for a player, no phone number, no home address, no date of birth, no membership or LTA number, no password, no gender, no photograph and no rating brought in from anywhere else. There is no field for any of them in a league, so there is no way for a well-meaning organiser to put one in.

One qualification, and it is the whole of it: a club can also run its membership register here, and a register does hold contact details and dates of birth, because that is what a register is. It is a separate part of the product, off unless your club buys it, and it is set out in full in the next section rather than in a footnote. The league half is unchanged by it: a phone number recorded on the register never appears on a box sheet, on a ladder or in a draw.

Two places do hold free text an admin types: the reason given for deleting a score, and the club's own activity log, which records who changed what. Our Terms already say what those are not for. They are not the place for medical notes, safeguarding records or a comment about somebody you would not say to their face.

What this page does not claim is that there is no record. A player who taps a box link is given the player record listed above, because something has to remember which name on the screen is theirs. It carries no address and nothing they filled in, and it is deleted with the club.

The app can send a notification to a phone, and that is not a contact detail. If a player taps Allow, their own browser hands us an anonymous address for that device, so the app can say that a score is waiting on them or that a draw is up. It carries no name, no email and no phone number, we cannot use it to reach anybody who has not tapped Allow on their own device, and switching it off deletes it. It is also the only way anything in Clayside reaches a player at all: there is still nothing here a club, an organiser or we could use to write to one.

Two players can arrange a match without either of them learning how to reach the other. One suggests up to 6 times, the other taps one. It is dates and a tap, plus one optional line of up to 120 characters, and it goes by notification like everything else. Nothing about it is binding, nobody is penalised for saying no, and there is no reply channel: it is not a chat, and the one line is short on purpose. A club that would rather its players did not send each other free text at all can leave the feature alone, and everything else works exactly as before.

Membership and subs are the club plans, and they are off unless your club is on one. On one, your club keeps a register, and a register is more than names: a club has to be able to write to its members and know which age band they are in. What follows is what a register can hold, all of it optional, all of it your club's own.

Contact details and the date of birth sit behind a permission of their own. Somebody can keep the register, add people and merge duplicates without being able to read the club's contact list, and a committee member reading the membership numbers sees how many juniors there are rather than which members they are. It is a separate table in the database, not a column on the one the league reads, which is what makes that a wall rather than a setting.

The date of birth is the switch that closes doors for a child, and that is why it is held. A junior never holds a sign-in address: the route that would add one refuses a date of birth under your club's adult age, refuses it again when the code is answered, and if a birthday is filled in a month later the address and any live code are taken off the record on the spot. The consequence worth saying out loud is the one that catches people: no recorded date of birth means the software treats somebody as an adult. Leaving it blank does not protect a child, it quietly switches the protection off.

An adult member is written to twice at most, and a junior is never written to at all. Your club can send an adult on its register one message saying that the address the club holds is how they sign in. It carries a link to your club's own page, there is no code in it, nothing in it signs anybody in, and a line on every copy stops anything else reaching that address for good. After somebody has answered a code, what we send is about their own membership or their own booking: a receipt, a failed Direct Debit, a renewal link, a court they have booked. There is no marketing, there is nothing about Clayside, and there is no category of message a club can use to reach a junior at all.

The junior wall is the same wall in both places. The message above asks the same question the sign-in door asks, from the same rule in the same file: anybody under your club's adult age is left out, a parent's address on a child's record is never written to, and so is anybody who runs the club. Which brings back the sentence above about a blank date of birth, because it applies here too: no recorded date of birth means the software treats somebody as an adult, and your club is told how many of those there are before it presses anything.

Bank details never touch us. A member paying by Direct Debit types them on GoCardless's own page, into your club's own account. What comes back to your club's database is a reference and whether the instruction is live. The money goes from your member to your club's bank and we are not in the middle of it.

What people you have not met give you is the one thing here on a clock. Your joining form and your club link are both public, so both collect details from people your club has not met and may turn down: a name and a date of birth either way, and a membership application also carries what they are asking to pay for. Both are deleted 90 days after your club decides them either way, and an application somebody started and never finished goes 90 days after they started it. Anything still waiting on your committee is left alone: emptying a committee's in-tray on a clock would be us making the decision. Everything else on the register is held until your club removes it, and removal takes effect at once.

All of this is in the Privacy Policy, field by field, with the lawful basis and the retention beside each one.

Who is responsible for what. Your club decides who goes in its league, so your club is the controller for those names and we are the processor. We never see a membership list and we do not decide what goes in a box. For your organisers' own accounts, and for the details given when somebody starts a league, we are the controller. That split is set out in section 2 of our Privacy Policy.

The processor terms. Written out on one page, covering the Article 28(3) list: subject matter and duration, the nature and purpose, the kinds of data and the people it is about, your instructions, confidentiality, security, sub-processors, help with a request from a player, what happens at the end, and audit. Nothing to request and nobody to email first.

Where the data lives. Your club's league is a database of its own, not a shared table with a club column in it, and it is pinned to the EU when it is made. That constraint is set once and cannot be loosened afterwards, by us or by anyone at Cloudflare. Our sub-processors are named in full, with what each one gets and what for.

What we never do. No analytics of any kind, no ad network, no profiling, no third-party fonts or scripts on the pages your members read, and nothing sold or shared with anybody. There is one cookie and it signs an organiser in. You have not seen a cookie banner here because there is nothing to ask you about.

The one sponsor slot. Every league page has one, at the top of the page and at the foot of the pictures the club shares: one name and, if there is one, a link to their website. A paid plan makes that name the club's own. On a free league, during a trial and on the demos it carries one sponsor of ours, who pays us for it, which is what a league that costs a club nothing is paid for by. Either way it is a name in the club's own type: nothing loads from the sponsor, no script of theirs runs, nobody is tracked and no click is counted. The same content rule binds ours as binds yours. Our Terms rule out a gambling brand, an alcohol brand and anything political, on the grounds that juniors and their parents read the league, and we can require a sponsor to be taken down. There is never a second name, and nothing else is sold into your league.

Getting it back, and getting rid of it. A club owner can export the whole league as one file at any time, and ask us to delete the lot. How long we keep what, and what happens if a breach ever puts somebody at risk, is in the Privacy Policy. We report to the ICO within 72 hours.

Age. You have to be 18 to run a club here. A club putting junior members' names in a box league is doing so as controller, under its own safeguarding and consent arrangements, which is the same footing as the fixture list on the noticeboard.