Data processing terms

1. Who this is between

These terms are between your club (the controller) and Agentu Ltd, trading as Clayside, registered in England and Wales, company number 16191406, registered office 10 Campbell Crescent, East Grinstead, West Sussex, RH19 1JR (the processor).

They set out the terms required by Article 28(3) of the UK GDPR. They form part of our Terms of Service and take effect when your club starts a league, so there is nothing to sign and nothing to send back. If your club has its own template it would rather use, email hello@clayside.app and a person will read it.

Where these terms and the Terms of Service disagree about the processing of your league's personal data, these ones win.

One boundary worth stating plainly, because it decides who you write to. For the names and results inside your league, your club is the controller and we are the processor, and that is what this page covers. For your organisers' own accounts, for the details given when somebody starts a league at /setup, for a report somebody sends us from inside the app, and for our own record that Clayside Support opened your club (clause 4), we are the controller and our Privacy Policy is the document that speaks to it.

2. What we process, and for how long

What your league holds about a player, in full, is listed on our safeguarding page. How long we keep what is in section 8 of the Privacy Policy, and that table is the one to read rather than a second copy of it here.

3. Your instructions

We process your league's personal data only on your club's documented instructions. Those instructions are: these terms, our Terms of Service, our Privacy Policy, and whatever your admins actually do in the app. Using a feature is an instruction to run it.

• We will not use your league's data for anything of our own. Not to train a model, not to build a product, not to profile anybody, and not to sell or share with anyone at any price.
• We never market anything to your members, and we write to them only about your club. Apart from the sign-in message and five statements about money, both below, nothing reaches a member's email address until they have proved it by answering a code sent to it, and a member under 18 never holds one. What a member may be sent falls into these categories and no others:
  • The sign-in message, when you press the button for it. It carries a link to your own page and nothing that signs anybody in, nobody gets it twice in a fortnight or more than three times ever, everybody who runs the club and everybody under 18 is left out, and every copy carries a line that stops it for good. When your club runs a renewal round, the copy sent to a member who has not signed in yet also says what they owe for the year, whether their Direct Debit is set up, and your club's bank transfer details, and still carries nothing that signs anybody in.
  • Their own membership and money: a confirmation, a bill or a renewal, a receipt, a failed Direct Debit, a lapse, a change to their details. Five of these say what has already happened and carry no way in (the confirmation, the receipt, the failed Direct Debit, the lapse, and a note that they are not renewing), and those five also go to an address your club recorded that nobody has proved. Every such copy carries a link that stops anything else reaching that address.
  • Their own play and their own record: a score waiting on them, a match being arranged, a box, draw or side they are in, an invitation to enter one of your competitions, a court or a lesson they have booked or asked for, a change to the address your club holds for them, and one morning email of unread notices for a member with no phone set up for notifications.
  • A message your club sends everybody, by email only where the member has asked for it.
  • The club's own jobs, to the people who run it: one morning email listing what is waiting on somebody with their role, such as two players who cannot agree a score. It is a switch on their own screen like the rest.
  • A copy of a report the member sent us from inside the app, and only when they send one.
  What is sent about a junior goes to their parent or guardian instead. Each kind of message about a member's play is a switch on their own screen, except a score waiting on them, and every one carries a one-click unsubscribe. There is no marketing category. Our own occasional note about Clayside goes to club owners and admins only, with a one-click unsubscribe on it.
• We take no share of the money your club collects. Subscriptions are collected through your club's own payment account, from your member to your club's bank, and we are not a party to that payment.
• If UK or EU law ever required us to process your data beyond your instructions, we would tell you before doing it, unless that law forbids telling you.
• If we think an instruction breaks data protection law, we will say so.

4. Confidentiality

Access to your club's data is limited to the people at Agentu who need it to run the service and fix it when it breaks. Everyone with access is under a duty of confidentiality that carries on after they stop working with us.

In practice that access is used for two things: investigating a fault you have reported, and keeping the platform running. We do not read club data out of curiosity.

When we need to see your club the way you see it, we open it as Clayside Support. That is a way in from our own dashboard, behind three separate checks, and it lasts an hour at a time. Support can see and change what your owner can, so a fault can be fixed rather than described to you. It cannot download your club's data, change your plan, your billing or your payment account, erase a member, or wipe a season's results or a championship. Every visit is recorded on our side, and anything Support changes appears in your club's own activity log as Clayside Support. It is never on your register and never counts as one of your members.

5. Security

The measures we take, as required by Article 32. These are the real ones, not a list copied off another policy:

• Your club's league is a separate database. Not a shared table with a club column in it. One club cannot query another's data because there is no query that reaches it, and there is no identifier to guess.
• There are no passwords. Signing in is a link or a six-digit code sent by email, valid for 15 minutes. We cannot leak a password we never asked for.
• Sign-in secrets are stored as one-way hashes, never in plain text, and a code guessed wrong five times invalidates itself.
• Encrypted in transit and at rest. HTTPS everywhere, with encryption at rest by our hosting provider.
• No third-party scripts or fonts on the pages your members use, so a visit to your league is not announced to anybody else. The one check that runs there is our hosting provider's own bot check, set out in clause 6.
• A photo loses what is hidden inside it. Every photo put on your website is re-made on the way in: its location, the camera it came from and everything else stored inside the file are dropped, and the file that was uploaded is never kept.
• Backups and restoration are handled by our hosting provider's point-in-time recovery for the database service, which is what would be used to restore a club after an incident. It covers your club's database. It does not cover the photos and documents on your website.
• Testing. Changes go through an automated test suite before they ship, and the security-relevant parts of the system are reviewed when they change.

One limit we would rather write down than bury: the shareable link a club posts to its box's group chat is a key. Anyone holding it can enter scores as anyone in that box. It is built that way deliberately, because the alternative is forty accounts and forty forgotten passwords, but it is your club's to look after.

6. Sub-processors

Your club gives general authorisation for the sub-processors below. Each is under a written contract with terms no weaker than these, and we stay liable to you for what they do.

The GoCardless row is a boundary rather than an ordinary sub-processor. Your club opens its own GoCardless account and agrees its own terms with them. We instruct collections on your club's behalf through that account; the money never passes through us, and the relationship for that payment is between your club, your member and GoCardless. There is a second, separate GoCardless relationship, which is ours: the Direct Debit your club sets up to pay us for the plan. The two share no credential and no code path, and neither can see the other's data.

One more service is named in section 7 of our Privacy Policy and is not a row of its own here, because it is Cloudflare's, under the row above: Cloudflare Turnstile, and Cloudflare's bot check. It sees a visitor's IP address on the signup page and on the app and the API at your club's address, to tell a person from a script collecting names in bulk. It does not run on your club's own website pages, and it stores nothing of ours or yours.

And the push services, for a different reason. If a member turns on notifications, the message reaches their phone through the push service their browser uses, such as Apple's, Google's, Mozilla's or Microsoft's. They are not in the table because they cannot read a word of it. Every notification is encrypted end to end before it leaves us, and only that member's own device holds the key. What they carry is a sealed envelope and an address for it, and the address is one their own browser generated: it names a device, never a person, and it carries no name, no email and nothing about your club. Nobody can be sent one who has not tapped Allow on their own phone, and turning notifications off deletes the address.

Changing the list. If we add or replace a sub-processor we will email club owners at least 30 days beforehand. If your club objects on reasonable data protection grounds, tell us within those 30 days and we will either find another way or let you leave, with your export in hand and no charge for the unused part of anything you have paid.

7. Helping with a player's request

If a player asks us directly for their data, or to correct or delete it, we will not answer for your club. We will tell them to ask you, tell you it happened, and help you answer.

Most of the help is already built, which is faster than any process we could promise:

• Access and portability: open the person on your register and download what is held about them, as one file: their record, every match with their name on it, and anything else your club keeps for them. A club owner can also download the entire league, every player, every result and every season. No request form, no waiting, no charge.
• Correction: your club can edit a player's name and any detail on your register directly, and a member can correct their own contact details from their own screen.
• Erasure: an admin can remove a player from a roster. Removing somebody does not erase results already played, for the reason set out in section 10 of the Privacy Policy. If a name has to go entirely, your club's owner can erase it in one press: everything that says who the person was goes, the results stay with nobody's name on them, and it cannot be undone.

Where you need more than the app gives you, we will provide it, and we will not charge for it.

8. Breaches, and helping you assess risk

If there is a personal data breach affecting your league, we will tell you without undue delay and in any case within 24 hours of becoming aware of it. Your club is the controller, so the 72-hour clock for telling the ICO is yours, and telling you inside 24 hours is what makes it possible to keep.

We will tell you what happened, which data and roughly how many people are affected, what we think the consequences are, and what we are doing about it. If we do not know all of that yet we will say what we know and follow up rather than wait.

We will also help you with a data protection impact assessment or a consultation with the ICO, if the scale of your processing ever means you need one. For a club box league it almost certainly does not, and we would say so rather than sell you a document.

9. International transfers

Your club's database is pinned to the EU when it is created, and so is the store your website's photos and documents sit in. That is a constraint our hosting provider enforces rather than a preference we express, it binds the main copy and every replica, and it cannot be loosened afterwards, by us or by them.

The honest exceptions, the same ones the Privacy Policy makes. Email leaves: sign-in codes and invites go through Resend, and mail in transit is not covered by the constraint above. A notification leaves, sealed so that only the member's own phone can open it, through the push service their browser uses. A photo is resized before it is stored, by Cloudflare, and that one step is not covered by the pin; only the resized copy is kept, inside it. And the one line we write per request does not take the pin either, which is why there is nothing about a person in it. Nor do our own error and performance lines, which Cloudflare keeps for 7 days so we can fix faults; they name a club and never a person.

Cloudflare and Resend are both US-headquartered, so where data does travel it is covered by the safeguards UK law requires: the UK Addendum to the EU Standard Contractual Clauses, under each supplier's own data processing agreement, and both are certified under the UK–US Data Bridge. The main push services are run from the US too. What they carry is sealed and addressed to a device rather than a person, which is why they are not in the table in clause 6.

10. Deletion and return

Return first. Your export works on your last day exactly as it does on your first: one file, one click, every player, every result and every season, from inside the app. Take it before you go, because the next part is final.

Then deletion. When your club closes its league, or asks us to delete it, we delete the whole database and every file your club stored with us within 30 days, and no backup survives it. We keep nothing back except where UK law requires it, which in practice means accounting records for a club that has paid us, and those hold no player data.

How to ask. An email to hello@clayside.app from your club's owner address. There is no self-serve delete button and there will not be one: what it destroys is every one of your members' records, with no undo. We record the date you asked on the day it arrives, and the 30 days run from that date rather than from when we get to it. When it is done we keep one line saying that this club asked on that day and was deleted on this one, which is the only thing that survives, and is there so that you can hold us to this clause afterwards.

Nothing else deletes a league. There is no timetable, no expiry and no automatic collection: a league is deleted when your club asks us to, and at no other time. A signup that never confirms its email is a different thing entirely, because no league was created for it; what was typed is deleted within the hour, as set out in section 8 of the Privacy Policy.

What your public forms collect has a clock of its own, and nothing else does. An application submitted through your club's joining form is deleted 90 days after your club decides it, accepted or declined, and one somebody started and never finished goes 90 days after they started it. Somebody who asks to join through your club link is deleted on the same clock, 90 days after you decide. Both run automatically. Anything still waiting on your committee is not touched, because deciding it is your club's job and not a clock's. Everything else on your register is held until your club removes it, and your club can remove any of it at any time.

11. Audit

We will give you the information you reasonably need to show that we are meeting these terms. In the first instance that is this page, our Privacy Policy, our safeguarding page and an honest answer to an email, which for a club box league is normally the whole of it.

If your club needs more than that, write to us through our contact page and we will agree something proportionate: a written answer to a questionnaire, or an audit at reasonable notice, in working hours, no more than once a year unless a breach or a regulator says otherwise, and on terms that keep other clubs' data out of it. We are a small company and we will not pretend to a certification we do not hold.

12. The legal bits

• Governing law: England and Wales, as in our Terms.
• Changes: the date at the top moves. Anything material gets 30 days' notice by email to club owners, and sub-processor changes get the notice in clause 6.
• Order of precedence: these terms, then the Terms of Service, then the Privacy Policy, for anything about processing your league's personal data.
• Survival: clauses 4, 5, 8, 10 and 11 carry on after your club stops using Clayside, for as long as we still hold anything.
• Questions: our contact page. A real person reads it.