{"eyebrow":"Privacy","title":"Privacy policy","intro":"This is how {our name} looks after the details you give us when you buy tickets and merch, get an athlete's ID card, create an account, fill in one of our forms, or get in touch: what we hold, why, who else handles it, how long we keep it, and what you can ask us to do with it.","updated":"2026-10-16","sections":[{"id":"who-we-are","heading":"Who we are","text":"{our name} runs this site and its events, and decides how your details are used, which makes us the \"controller\" of your personal data under UK data protection law.\n\nYou can reach us through [our contact page](/contact), or by emailing [{contact email}](mailto:{contact email}).\n\n{where we are}"},{"id":"what-we-hold","heading":"What we hold","text":"**Your account** — Your name and email address, when you agreed to our terms, and how you sign in: whether you have a password (kept only as a scrambled hash, never as you typed it), your passkeys' names, and whether two-factor authentication is on.\n**Your orders** — Your name and email address, what you bought and paid, how your merch gets to you, with the address if it's posted, your mobile number if you buy merch, for texts about it, and your card's brand and last 4 digits. Our payment provider gives us no more of your card than that. When our team gives you tickets, such as a guest's, the order has the name and email address they gave them to.\n**Your billing address** — Your browser sends it through our payment provider to your card's bank, which checks it's you (3D Secure). We keep it while you pay, and delete it within a week. It isn't kept with your order.\n**Your tickets** — The event and days each is for, its QR code, the name on it if one's given, which is optional, and when it was checked in at the door. So our door staff can check tickets without a signal, the phones they scan with keep the list of tickets for their door, with the names on them and the buyers' names, but never their QR codes or email addresses, for up to 24 hours.\n**Athletes** — Whether you're an athlete at a club, and which. For each athlete you get an ID card for, their club, and once their ID's been checked, their first names, last name and date of birth, the kind of document it was (such as a passport) and when. We never keep the document's number or a copy of it.\n**ID cards** — The name printed on each card, its club, where it's up to (such as paid, or posted to the club), when it was paid for and expires, how the athlete's ID check went: whether it was accepted, and if not, why in general terms, such as the document had expired, and the headshot you send for it, which is printed on the card, with the photo you framed it from, so our admins can adjust the framing without asking you again. Headshots are kept privately: only our admins and the card printer see them, and only our admins see the photo they were framed from. Each headshot you send is checked automatically on our own server for a clear, well-lit face, which finds where the face is, never who it is, and keeps nothing about it.\n**Coaches' DBS** — For a staff badge, the DBS certificate's number and its expiry, which one of our admins types from a photo of the certificate you send, with who checked it and when. We delete the photo of the certificate as soon as they've checked it.\n**Clubs' rosters** — Each club's roster for an event from Reg Champ, which our team imports: everyone on it, with their names, date of birth or age and role. That's its athletes, including those who never get a card from us, and its staff: its owners, directors, coaches and assistant coaches, with their names and roles only, to check who gets a staff badge. We use it only to check that an athlete getting an ID card is entered at the age they compete at. Once an athlete matches, we keep their club, event and season, not the rest of the roster.\n**IDs our team checks** — When our team checks an athlete's ID themselves, in person or from a copy you email to {ID cards email}, which of them checked it, whether they saw it in person or a copy, and their note. We don't keep the copy.\n**Where you're signed in** — The IP address and browser each sign-in came from, so you can see where you're signed in and spot one you don't recognise.\n**What happens on the site** — A record of sign-ins, security changes, orders and refunds, and what our staff do, with the IP address and browser each came from. This is our audit log.\n**Wallet passes** — When you add a ticket to Apple Wallet, Apple gives us a code for your device, so we can update the pass, such as when a ticket's refunded. It doesn't say who you are.\n**How the site's working** — When something goes wrong on a page, your browser tells us what went wrong, on which page, the last few pages you opened here, your screen's size and whether you were online, and we note your browser and device. If you're signed in, we note your account's number, never your name or email address. When you leave a page, it tells us how quickly it loaded, how much it moved about as it did, and how quickly it answered your taps and clicks, and for any that was slow, which part of which page, with nothing that says who you are. We keep counts of how quickly pages load, and a note of which parts were slow, and nothing is stored on your device for either.\n**Your visits** — When you open a page, your browser tells us which page, the name of the site you came from, if you followed a link here, and when you add something to your basket. We count your visit by a code made from your IP address and browser that changes every day and can't be turned back into either, so we can't tell it's you, or link one day's visit to another. We keep that day's count for 3 days, then only the day's totals, such as how many people visited and where from. Nothing is stored on your device, and the back office isn't counted.\n**Your enquiries** — What you send us through the flooring form or by email: your email address and what you tell us.\n**Clubs' contacts** — If you own or run a club that comes to our events, the name, email address and phone number you or your club give us, so we can reach the club about its athletes and events.\n**Your answers to our forms** — What you answer on one of our forms, such as the one for ordering tickets for your club: your name and email address, and what the form asks, such as your phone number, your club and the tickets you'd like. Some forms email us your answers, or email you a copy.\n\nTeams enter our events through [Reg Champ](https://regchamp.com), which has its own privacy policy. We only hold clubs' rosters from it to check athletes' ID cards, as above."},{"id":"why","heading":"Why we use it","text":"The law asks us to say why we use your details, and what allows us to, which it calls the lawful basis.\n\n**To run your account, sell you tickets and merch, get them to you, and refund you** — Because we need to, for our contract with you.\n**To check an athlete's age and make their ID card, when you ask us to** — Because we need to, for our contract with you, and because we have a legitimate interest in making sure every athlete competes in the right age group, which we've weighed against the athlete's privacy, taking particular care because most athletes are children. That's also why we match each athlete to their club's roster from Reg Champ.\n**To keep the records of orders and refunds** — Because the law says we must, for HMRC.\n**To keep the site and your account secure, with sign-in limits, emails about security changes, and the audit log** — Because we have a legitimate interest in keeping the site, your account and our records safe, which we've weighed against your privacy.\n**To count visits to the site, and see how quickly its pages load** — Because we have a legitimate interest in knowing how the site's used, so we can make it better, which we've weighed against your privacy: nothing we keep says who you are.\n**To answer your enquiries, such as for a flooring quote** — Because you've asked us to, before any booking, and we have a legitimate interest in answering.\n**To reach the clubs that come to our events** — Because we have a legitimate interest in contacting a club about its athletes, rosters and ID cards, which we've weighed against your privacy: we only keep what the club gives us, and only our team sees it.\n**To deal with your answers to our forms, such as ordering tickets for your club** — Because you've asked us to, before we agree anything, and we have a legitimate interest in answering.\n\nWe don't sell your details. Two things are decided automatically: our ID checking service's check of an athlete's ID, and matching the athlete to their club's roster from RegChamp. If it doesn't accept an ID, our team can check it by hand, and an athlete who can't be matched goes to our team, never refused."},{"id":"staff-applications","heading":"Working at our events","text":"When you apply to work at our events, we ask your name, email address, mobile number and date of birth, the events and days you can work, the roles you'd like, and the questions on the form, such as whether you have an Enhanced DBS check. We don't ask about your health, ethnicity, religion or anything like them.\n\nIf we accept you, we email you a private link to an agreement, where you confirm the days we've booked you for, give your home postcode (for travel expenses), your DBS Update Service number if you have one, your bank details, and sign with your finger or mouse. Your bank details are encrypted, so they can't be read from our database or its backups, and only our admins can show them, which we record. They're never emailed.\n\nWe use them to choose, contact and pay our event staff, because you've asked to work with us and, once accepted, for our agreement with you. Only our admins see them. We keep the IP address and browser your application and agreement came from in our audit log.\n\n**If we don't choose you, or you withdraw** — Deleted {staff not chosen months} months after we decide.\n**If we accept you** — Deleted {staff accepted months} months after the last event you're booked for, with your agreement and bank details.\n**If we never decide** — Deleted {staff undecided months} months after you apply.\n\nYou can ask us for a copy of your application, or to delete it sooner, as below. With an account at the same email address, your account's data download includes it, and deleting your account deletes it."},{"id":"who-else","heading":"Who else handles it","text":"These kinds of companies handle your details for us, only to do what we ask, under contracts that say so. To know which company does each, ask us through [our contact page](/contact), or by emailing [{contact email}](mailto:{contact email}):\n\n**Our payment provider** — Takes payments by card, Apple Pay and Google Pay. Your card's details go straight from your browser to it, never to us. It also keeps its own record of each payment, as the law asks of it, under its own privacy policy.\n**Our ID checking service** — Checks athletes' IDs. You photograph the document on its own page, and it reads the athlete's names and date of birth and checks the document is genuine. It doesn't compare anyone's face with the document, and it isn't allowed to use the checks to train its systems. When it isn't sure about a document, one of our admins looks at its photos of it in our back office, which shows them without keeping a copy, and their decision and note go back to it, with the check.\n**Our card printer** — Prints the ID cards. We email it each order: for each card, the name on it, the athlete's date of birth and club, a coach's role and DBS expiry, and a link to the headshot that works for a limited time. It posts the cards to us, to send on to each club.\n**Our email service** — Sends our emails.\n**Our delivery company** — Delivers the merch we post, to your address or a locker you choose. We give them your name, email address, mobile number and your address or locker, so they can deliver it and text you about it. While you choose a locker on their map at checkout, your browser talks to them directly, so they see your IP address and what you search for.\n**Our address finder** — Finds your address from Royal Mail's address file as you type it at checkout. It gets what you type and your IP address, through our server.\n**Our database host** — Hosts our database, where your account, orders, tickets and athletes are kept, and its backups.\n**Our file storage** — Keeps the site's pictures and files, and each night's backup of our database.\n**Our hosting provider** — Runs the server the site runs on.\n**Phone wallets** — Keep the tickets you add to Apple Wallet or Google Wallet, and deliver updates to them.\n**Our font and map services** — Our emails load their font from a font service, which gets your IP address when you open one, and an event's map comes from a map service, once you choose to show it.\n\nSome of them are based in the United States, or handle details there, so your details may leave the UK. When they do, they're protected as UK law asks: by the UK-US data bridge, or by the international data transfer agreement the ICO approves.\n\nWe'd also share your details if the law required it, such as with the police or HMRC."},{"id":"how-long","heading":"How long we keep it","text":"**Your account** — Until you delete it.\n**Each sign-in** — Until it ends: 30 days after you last used the site with Remember me ticked, or a day, or when you close your browser, without it. Then it's deleted.\n**Your orders and tickets** — {order years} years after the end of the tax year (6 April to 5 April) they were in, as HMRC asks. Then we remove everything that could name you: your name, email address, addresses and mobile number, the names on your tickets, your card's details, our payment provider's references for the payment and our staff's notes. We keep what was bought and paid, for our accounts. A guest's name and addresses are kept with their order for the same time.\n**What you give us at checkout** — Deleted a week after you pay or leave, with your billing address.\n**ID cards, and the athlete's checked details** — Until {ID card years} year after the athlete's last card expires, so renewing it doesn't need their ID checked again. Then they're deleted.\n**An ID card whose ID check was never finished** — Deleted {not started card days} days after it last changed, unless the athlete's still partway through their ID check.\n**Any other ID card that's never paid for** — Deleted {unpaid card days} days after it last changed, with the athlete's checked details unless another of their cards needs them. Cancelling it, or saying the details read from the ID aren't the athlete's, deletes those details straight away.\n**Clubs' rosters from Reg Champ** — Deleted {roster days} days after their event's last day. Which club, event and season an athlete matched is kept with their checked details.\n**The ID checking service's checks** — It deletes each check once we've kept the athlete's names and date of birth, or once you delete your account, and within a month whatever happens.\n**A copy of an ID you email us** — Deleted from our mailbox once we've checked it.\n**Headshots** — Each with the photo it was framed from, kept until the card expires, so a lost card can be reprinted without a new photo, then deleted the day after. Deleted straight away if the card's cancelled, or when you delete your account.\n**A photo of a DBS certificate** — Deleted as soon as our admin's checked it. The number and expiry they typed are kept with the card.\n**What we send our card printer** — Our card printer keeps it under its agreement with us. When you delete your account, we have it delete what we sent it.\n**The audit log** — {activity years} years, or {order years} years for orders and refunds. When you delete your account, your name, email address and IP addresses are removed from it straight away.\n**Links we email you** — Each works for between 15 minutes and 24 hours, and is deleted once it has run out.\n**Apple Wallet devices** — Until a week after the ticket's pass has run out.\n**Staff and admins' browsers** — For staff and admins only, the browsers they've signed in from, until 400 days after each was last used.\n**Your visits** — Each day's count of your visit for 3 days, by when it's in the day's totals, which say nothing about you. What each day's codes are made with is deleted when the day ends, so no one can make the same code again.\n**Your enquiries** — Up to 2 years after we last hear from you.\n**Clubs' contacts** — While the club's on our club list, or until the club asks us to remove them.\n**Your answers to our forms** — Up to 2 years after you send them, or after the event they ask for tickets to, if that's later. Each form keeps them for 6 months, a year or 2 years. Then they're deleted.\n**Emails waiting to be sent** — Until they've gone, then a week. One that still can't be sent after several tries is kept until our developers send it or delete it.\n**The server's logs** — They name accounts only by a number, never a name or email address, and are deleted after {log days} days. The record of how the server handled each request, which holds no more, is deleted after {trace days} days.\n**Problems on the site** — {error days} days after the same problem last happened. When you delete your account, its number is removed from them straight away.\n**Our record of what's sent to our payment provider** — Each payment, refund and other message between us and our payment provider, without your name, email address, address or card's details, but with your account's number if you were signed in: {payment log days} days. When you delete your account, its number is removed from it straight away.\n**Our backups** — They run out after {backup days} days, so anything deleted is gone from them within {backup days} days."},{"id":"your-rights","heading":"Your rights","text":"You have the right to:\n\n- know how we use your details, which is what this page is for\n- get a copy of the details we hold about you\n- have anything that's wrong corrected\n- have your details deleted, unless the law says we must keep them, such as orders for HMRC\n- have us stop using them, or limit what we do with them, while a concern is looked into\n- object to what we do because of our legitimate interests\n- have your details in a file you can take elsewhere\n\nWith an account, you can do most of this yourself. [Your profile](/account/profile) changes your name and email address. [Your account's privacy page](/account/privacy) downloads everything we hold about your account as a file: your details, how you sign in, where you're signed in, your orders and tickets, with why any refund was made and our staff's notes on it, your athletes and their ID cards, your answers to our forms at the same email address, and the record of what's happened on your account. It also deletes your account, straight away.\n\nDeleting your account removes your details, how you sign in, where you're signed in, your athletes and their ID cards, your answers to our forms, and emails still waiting to be sent to you. It keeps:\n\n{what deleting keeps}\n\nWithout an account, or for anything else, get in touch through [our contact page](/contact), or by emailing [{contact email}](mailto:{contact email}). We'll answer within a month, and may first ask you to show the details are yours, such as by writing from the email address you used."},{"id":"complaints","heading":"Complaints","text":"If you're unhappy with how we've used your details, please tell us first, through [our contact page](/contact), or by emailing [{privacy email}](mailto:{privacy email}). We'll let you know we've received your complaint within 30 days, look into it, and tell you what we found and what we've done about it.\n\nIf you're still unhappy, you can complain to the Information Commissioner's Office (ICO), which looks after data protection in the UK, at [ico.org.uk/make-a-complaint](https://ico.org.uk/make-a-complaint/) or on 0303 123 1113."},{"id":"children","heading":"Children","text":"You must be 16 or over to create an account, and 18 or over to place an order. A name on a ticket is optional, so a parent or carer can buy tickets for the family without naming anyone.\n\nMost of the athletes we make ID cards for are children, so we take particular care with their details:\n\n- A child's ID card is got by their parent or carer, from their own account, who says they're the child's parent or carer before the ID's checked. Athletes who are 16 or over can get their own.\n- We keep only what the card needs: the athlete's names, date of birth and club, the kind of document checked, which club's roster they matched, for which event, and their headshot, kept privately until the card expires. Never the document's number or a copy of it.\n- Clubs' rosters from Reg Champ are only used to check athletes' ages for their cards, seen only by our admins, and deleted {roster days} days after their event's last day.\n- Nobody's face is compared with their document. If the ID check can't accept a document, you can try again, or our team can check it by hand.\n- We don't use athletes' details for anything but their ID cards, and never for marketing.\n\nChildren have the same rights over their details as adults. A parent or carer can use them for a younger child, and an athlete can ask us themselves, through [our contact page](/contact), or by emailing [{privacy email}](mailto:{privacy email})."},{"id":"cookies","heading":"Cookies","text":"We use the cookies and storage the site needs to work, such as to keep you signed in and hold your basket, and, only if you accept it, a little optional storage that remembers a few of your choices on this device. None are for advertising or tracking. We count visits without cookies or anything kept on your device, as [What we hold](/privacy#what-we-hold) says.\n\n[Our cookies page](/cookies) lists each one, what it's for and how long it's kept, and turns the optional storage on or off at any time."},{"id":"changes","heading":"Changes to this policy","text":"When this policy changes, we'll change it here, with the date at the top. If a change affects details you've already given us, we'll email you about it first."}]}