Privacy Notice

AcademyOne Platform Privacy Notice Pending final legal counsel review

Version: 2.0 LCR1 - Pending final legal counsel review Prepared: 8 October 2026 Effective date: On formal approval and issue Audience: Players, guardians, club staff, payers, visitors and business contacts

1 Who is responsible

Academy One Technologies Ltd, SC900576, 82 Rumblingwell, Dunfermline, KY12 9AS, operates AcademyOne. Contact our privacy team at Info@academyonetechnologies.co.uk or that postal address. We accept requests in ordinary language and provide accessibility help.

Your club normally decides why player, team, family, coaching and club-payment records are used. It is the controller for those purposes; AcademyOne processes them on its instructions. Your club must give you its own identity, privacy contact and lawful-basis information. AcademyOne separately controls its own account-security, platform-support, commercial billing, complaints and legal-compliance processing. Where purposes overlap, we explain and coordinate the responsibilities rather than treating all data as belonging to one organisation.

This notice covers the web application and AcademyOne's own business enquiries and marketing website. Child-friendly notices explain the player experience. A privacy notice provides information; accepting it is not consent to every activity described.

2 Information and sources

Account information includes name, email, account identifier, role, club and authorised assignments, invitation and claim state, authentication and security metadata. Your credentials are handled through the authentication service; do not send them to support.

Club records include player identity, verified age or date of birth where necessary, teams and training groups, guardian links, staff assignments and qualification details, schedules, venues and pitch allocations, availability, attendance, match reports, factual statistics and achievements, development feedback, training content, boards and gameplans. We also process authorised documents and message or announcement content with sender, recipient and read information.

Optional records include profile or team images, permitted physical-work entries and, where enabled, uploaded match video and associated access or playback metadata. Payment information includes payer and beneficiary links, amounts, charge and plan details, processor identifiers, status, refunds and disputes. Gift Aid records include donor identity and address, declaration wording and dates, and relevant payment links. AcademyOne is not intended to receive complete payment-card details, bank login credentials or Stripe verification documents; those are supplied directly to Stripe.

Social Studio processes draft graphics, selected football facts, approved media, publishing status and provider account identifiers and authorisation tokens. Club users connect their social accounts through the provider. We do not ask for their social-account passwords.

Sources are you, your club's authorised staff, your verified guardian or player link, validated club imports, service-generated records, Stripe and a connected social provider. A club may stage a roster before accounts exist. Creating a staged contact or relationship does not by itself create an account, send an invitation or grant access. Imported information remains personal data even before sign-up. The responsible controller provides privacy information at collection or, for information obtained from another source, within the applicable Article 14 timing: normally no later than one month and earlier at first communication or disclosure where required, unless a documented legal exception applies.

Technical and business information includes IP and device or browser data, session and audit events, errors, support correspondence, legal-acceptance evidence, business-contact details and marketing preferences. We minimise diagnostic content and do not require a sensitive screenshot where a record reference will do.

3 Purposes and lawful bases

For our independent controller activities, we use information on the following bases. Contract applies only where processing is objectively necessary for a contract with the individual concerned; it is not a universal basis for all child or club records.

• Account administration and requested platform support: performance of a relevant contract where applicable, or legitimate interests in providing a secure, usable service.
• Authentication, tenant isolation, fraud prevention, incident investigation and proportionate diagnostic records: legitimate interests in protecting users and operating the service, with particular weight given to children's rights.
• AcademyOne billing and business administration: contract, applicable accounting or tax obligations, and proportionate legitimate interests in maintaining business records.
• Data-rights responses, legally required incident handling and regulatory cooperation: the relevant legal obligation; limited claim evidence may also rely on legitimate interests or the legal-claims provisions applicable to the data concerned.
• Adult business enquiries: responding to a requested service or legitimate interests in handling business enquiries. Marketing has a separate electronic-communications assessment and consent where required, with an easy unsubscribe or objection route.
• Optional storage or tracking: consent unless a specific, documented legal exception applies. Operational service messages are not permission to send advertising.

For club-controlled records, the club chooses and explains a lawful basis for each purpose. Common purposes include football administration, family access, training, factual match history and collecting a legitimate club charge. An adult's membership contract is not automatically a contract with a child. The club must balance its legitimate interests against the child's interests where it relies on that basis.

Optional physical-work entries can reveal information about physical condition. Where they amount to special-category data, the club also needs an Article 9 condition. The suite's adopted route for that optional feature is separate, explicit consent, not agreement to general Terms. Where valid consent or another required condition cannot be established, that processing must not take place. Refusal or withdrawal must not remove the core football service.

4 Who can see information

Access depends on authenticated role and authorised club, team, group, relationship or recipient assignment. Coaches access their assigned teams and groups; group membership does not grant general access to other teams. Guardians access their linked player or players, not the entire squad's private profiles. Player accounts access the information authorised for them. Club administrators have wider club-level functions but must use them for a legitimate purpose.

Staff Coaching Rooms are distinct from player or guardian announcements. Restricted staff information is not made available merely because another user can see a shared gameplan. Family payment information is restricted to authorised family and finance roles.

AcademyOne personnel may access relevant information for an authorised support, security, legal or service-management purpose. Access must be proportionate, limited and recorded. We do not use this notice to claim that every support-control or authentication setting has independent certification.

5 Suppliers and other recipients

We use Base44 for the managed application, database, functions and authentication; Cloudflare for enabled infrastructure, private R2 media and server-side scheduling; Stripe for payments and connected accounts; and Microsoft 365 for restricted business, support and compliance administration. Transactional email and any background-image processing, maps or other enabled integrations use their relevant provider or approved supplier chain. The current Processor and Subprocessor Register identifies the contracted entities, functions and transfer arrangements; request a copy from our privacy contact.

Stripe has its own responsibilities for regulated, security and payment processing. Meta processes information under its own terms when a club authorises Instagram or Facebook access or publishes content. Connecting an account grants the scopes shown by the provider, not unlimited access to the club's social account. Tokens may expire or be revoked and reconnection can be required.

We disclose information where necessary to an authorised adviser, regulator or lawful recipient, and investigate the basis and scope of a legal demand. A business transfer may involve limited information under appropriate protections and notice. We do not sell children's personal information or use it for behavioural advertising.

6 Public publishing and private media

Private profile images or match-video access are not public publishing permissions. Match-video access is limited to authorised recipients and time-limited delivery links. Such links must not be forwarded; access can end or expire. The club must inform people who appear in its footage and resolve filming restrictions.

The club decides whether approved Social Studio content is published publicly and must carry out its permissions and safeguarding checks. Once published on a social service, content is available under that service's audience settings and may be copied. Withdrawal can stop future use and require removal of controlled copies, but cannot guarantee recall of every independent copy. AcademyOne does not use a private-media upload as implicit consent to public distribution.

7 Children and guardian access

Under-13 profiles are guardian-managed without direct player login. From 13, an eligible player can claim the existing profile. A linked adult's visibility is explained to the player and remains subject to authorised permissions, review and safeguarding considerations. Guardian visibility is not unlimited editing power. On adulthood, any continued link requires the adult player's authority.

The 13-year login rule is a product rule, not a general statement of who can exercise privacy rights. We consider a child's understanding and applicable law. In Scotland, age 12 or over generally carries a presumption of sufficient maturity for those rights unless shown otherwise. A guardian request may require checking authority and the child's wishes.

8 International processing

Suppliers can process information outside the UK, including in the EEA and United States, or provide support from another country. An EU-jurisdiction R2 bucket does not mean that every account, log, backup or supplier service is confined to the EU. We do not describe the entire platform as UK-only or EU-only storage.

For a restricted transfer, the relevant controller and processor must establish an applicable UK adequacy route or appropriate safeguard, such as an executed UK IDTA or UK Addendum, with the required assessment and supplementary measures. US adequacy applies only within its valid certified scope, not simply because a supplier is American. You can request information about the safeguards and a copy of relevant terms, subject to proportionate redaction. Specific supplier destinations and mechanisms are maintained in the current register available through our privacy contact.

9 Retention

We distinguish immediate access removal from restricted retention and final deletion. Our adopted defaults are active player membership plus a 90-day departure handling period; availability through the relevant season plus 12 months; attendance and selection for two seasons followed by review; development entries on a 24-month rolling review; and optional physical entries through the relevant season plus 12 months or earlier following withdrawal. Profile images are removed when replaced, valid permission is withdrawn or their purpose ends, with a 30-day operational completion target. Private match video has a 90-day default review and deletion period unless the club records a justified shorter or longer period before upload.

Account closure has a 30-day operational cleanup target. Support correspondence normally lasts 24 months after closure; rights and privacy-complaint accountability records three years; ordinary security logs 12 months, with a longer period only for a documented need. Financial and tax evidence follows the applicable statutory period, commonly six years for relevant records, rather than being deleted with a login. The Retention Standard gives the purpose, trigger, exception and owner for each category.

These periods describe the approved retention rules, not a warranty that all deletion is automatic. Secure manual handling remains available where needed. A documented legal hold may extend limited, restricted retention. Backups can remain until the supplier's verified expiry cycle; they must not be used routinely and later deletions must be reapplied on restore. We explain a material exception when handling a request.

10 Security and your choices

We use access controls, authentication, limited sharing and appropriate technical and organisational safeguards. No system is risk-free. Report an incorrect link, unexpected access, lost credential or exposed file promptly. Do not send us access keys, passwords, full payment details or signed media links as evidence.

You can ask for access, correction, erasure, restriction and, where applicable, portability. You can object to legitimate-interests processing and direct marketing, withdraw consent without affecting earlier lawful processing and ask about an automated decision. AcademyOne's factual badge calculations do not decide selection or an equivalent significant opportunity by themselves. Rights depend on the applicable legal conditions, not on a club subscription being paid.

Contact us or the club. We route requests correctly and normally respond to rights requests without undue delay and within one month, subject to lawful identity checks, clarification rules or an explained extension. You need not use legal terminology or identify the controller yourself.

11 Complaints and updates

We provide an electronic complaints route through the privacy email and the available Privacy and Help service. Data-protection complaints are acknowledged within 30 days, investigated appropriately and answered without undue delay. You may complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or exercise another legal remedy.

Changes identify a new version and date. Material changes are explained before they affect you where practicable. A new consent-based purpose requires its own choice. For cookies and similar storage, see the Cookie and Storage Notice; for club-specific football processing, see the club's notice.