Privacy Policy

Performance Football League runs 7-a-side football leagues in Bristol and is affiliated to the Gloucestershire Football Association. For the purposes of UK data protection law we are the data controller for the personal data described in this policy.

Our legal entity is [REGISTERED COMPANY NAME AND NUMBER], registered at [REGISTERED OFFICE ADDRESS]. We are registered with the Information Commissioner's Office under registration number [ICO REGISTRATION NUMBER].

If you have any question about this policy or about your data, contact us at [email protected] or on 07799 424597.

When you register as a player we ask for the following. Everything is used to run your membership — we do not sell any of it.

Information about your health is special category data under UK GDPR, and the law requires us to protect it more strictly than ordinary personal data. We ask for it for one reason only: so that our staff, referees and first aiders can look after you properly if you are hurt or become unwell at a match.

We rely on your explicit consent to hold this information, and on protecting your vital interests in a genuine medical emergency. You can withdraw that consent at any time by contacting us — though please note that without it we may not be able to let you play, because we could not keep you safe on the pitch.

Health information is visible only to the small number of league staff who need it to run match nights safely. It is never shared with other players, never used for marketing, and never used to make decisions about your team or your standing in the league.

We ask for the name, address and phone number of someone we can call on your behalf. Because that is another person's personal data, please make sure you have told them you are giving us their details and why. We use those details only to contact them in an emergency involving you.

Matches in our leagues are filmed and analysed — that is a core part of what membership provides. This means that when you play, you will appear in video footage and in the performance data we generate from it.

Footage and statistics are available to you through your account, and may be visible to other players in your league — for example in league tables, leaderboards and team pages. We may also use short clips or images to promote the league. If you would rather we did not use your image in promotional material, tell us and we will honour that.

Membership is collected by Direct Debit through GoCardless, and pay-as-you-go fees are arranged directly with us. We never see or store your bank details. You give those to GoCardless, who act as their own data controller for them under their own privacy policy.

What we receive back from GoCardless is your name, the email address you used, and confirmation of whether your Direct Debit was set up and whether each payment succeeded. We use that to activate your membership and keep our accounting records.

We use a small number of cookies and similar technologies.

You can block or delete cookies through your browser settings. Blocking the session cookie will mean you cannot stay logged in.

We do not sell your personal data, and we do not share it for anyone else's marketing. We do use the following service providers and partners:

• Google (Firebase)Account authentication and database hosting for your account and league records.
• VercelWebsite hosting and file storage for match media.
• GoCardlessDirect Debit collection. GoCardless collects and holds your bank details directly — we never receive or store them. We receive only your name, email address and whether your payment succeeded.
• BrevoSending transactional email, such as verification emails and form notifications.
• PostHogWebsite analytics, hosted in the European Union.
• VEOMatch recording, hosting and processing of video footage.
• Gloucestershire FAWhere we are required to report a disciplinary matter, or to maintain our affiliation, we may share your name and the details of the incident with the county association.

We may also disclose your data where we are legally required to — for example to a regulator, or to a governing body investigating a disciplinary matter.

Some of our providers process data outside the UK. Where that happens, we rely on the safeguards required by UK data protection law — such as UK adequacy regulations or the International Data Transfer Agreement — so that your data keeps an equivalent level of protection. Our analytics are hosted within the European Union.

We keep your data only as long as we need it:

• Account and membership recordsFor as long as you are a member, and then for 2 years after your last season, in case you come back.
• Health and emergency contact informationDeleted when you stop being a member, or sooner if you withdraw your consent.
• Match footage and performance dataKept for 3 years so that historic seasons, records and your own stats remain available.
• Payment and accounting records6 years, as required by UK tax law.
• Contact and free session enquiriesDeleted within 12 months if you do not go on to join.

Your data is held in access-controlled systems, transmitted over encrypted connections, and reachable only by the league staff who need it to do their job. Your password is stored in hashed form by Firebase Authentication and is not visible to us. No system is perfectly secure, but if a breach ever put your rights at risk we will tell you and the ICO as the law requires.

Under UK data protection law you have the following rights. They are free to exercise, and we will respond within one month.

• AccessAsk for a copy of the personal data we hold about you.
• RectificationAsk us to correct anything inaccurate or incomplete.
• ErasureAsk us to delete your data where we have no continuing reason to keep it.
• RestrictionAsk us to pause our use of your data while a concern is resolved.
• PortabilityAsk for your data in a portable, machine-readable format.
• ObjectionObject to processing we carry out on the basis of legitimate interests, including profiling.
• Withdraw consentWithdraw consent at any time, including for marketing and for our use of your health information. This does not affect anything we did before you withdrew it.

To exercise any of these, email [email protected].

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first so we can put it right.

Our leagues are for players aged 18 and over, and we do not knowingly collect data from anyone under 18. If we learn that we have, we will delete it. Should our junior league launch, we will publish a separate policy covering how we handle young players' data and parental consent before taking any registrations.

If we change how we use your data we will update this page and change the date at the top. Where a change is significant, we will tell you by email.