1. Who is the controller?
[COMPANY LEGAL NAME] is the data controller for most personal data processed via the Platform, except where we explicitly act as a processor under contract.
- Registered address: [REGISTERED ADDRESS]
- Company number: [COMPANY NUMBER]
- Data protection queries: privacy@industrycup.com
The ICO distinguishes controller vs processor responsibilities and notes related guidance is under review following the Data (Use and Access) Act coming into force (19 June 2025).
2. What data we collect
Account data
Name, work email, phone, role, organisation.
Competition data
Team membership, fixtures, match reports, disciplinary records.
Operational data
Availability (refs), bookings (venues), invoices, payment status.
Technical data
IP address, device info, logs, cookie identifiers.
3. How we use data (purposes)
- Provide and secure the Platform (auth, access control, audit).
- Run Competitions (fixtures, results, standings, discipline).
- Operational delivery (venues, officials, comms, issue management).
- Billing and financial administration.
- Brand safety and integrity monitoring (misconduct, fraud prevention).
- Optional: marketing communications (where permitted).
4. Lawful bases
We rely on one or more lawful bases depending on the processing:
- Contract - to provide the Platform and Competition services.
- Legitimate interests - integrity, safety, fraud prevention, platform security.
- Legal obligation - accounting/tax requirements.
- Consent - certain marketing and non-essential cookies where required.
5. Special category data
We do not intentionally collect special category data. If a disciplinary report includes sensitive information, we restrict access and handle it with additional safeguards.
6. Sharing data
We may share data with:
- Competition admins and officials (as needed to run matches).
- Venue partners (fixture time, team names, organiser contact).
- Payment providers (transaction processing).
- IT suppliers (hosting, monitoring, email delivery).
We do not sell personal data.
7. International transfers
If suppliers transfer data outside the UK, we use appropriate safeguards (e.g., IDTA / addendum, supplier contracts).
8. Retention
- Core competition records: retained for 7 years for integrity, disputes, and reporting.
- Payment records: retained as required for accounting/tax (typically 7 years).
- Logs: retained for 90 days.
9. Your rights
You have rights including:
- Access - request a copy of your personal data.
- Rectification - correct inaccurate data.
- Erasure - request deletion ("right to be forgotten").
- Restriction - limit how we use your data.
- Objection - object to certain processing.
- Data portability - receive your data in a portable format (where applicable).
You can complain to the Information Commissioner's Office (ICO) at ico.org.uk.