Privacy notice
Draft, for lawyer review. Prepared 22 October 2026 for the invite-only private beta; updated the same day with Ted's decisions (individual lenders, retention periods, EU regions). Not yet in force. Square brackets mark facts still to be confirmed. The retention periods are drafts for the lawyer to review.
This notice explains what personal data Club Ledger (working name) holds, why, and your rights under the UK GDPR and the Data Protection Act 2018.
1. Who we are
- Controller: [legal name: sole trader or company, to confirm], [address], [company number, if a company].
- ICO registration number: [pending].
- Privacy questions and requests: privacy@clubledger.co.uk.
- Corrections to anything the service shows: corrections@clubledger.co.uk.
2. Who this notice is for
- People who ask for an invitation on the website (section 3a), and people we invite to the beta, who then use it (section 3).
- People named in the public records the service is built from: directors, secretaries and people with significant control of football club companies, people named as lenders on a club company's charges, and people named in filed accounts or Gazette notices (section 4).
- People who contact us, for example to report an error (section 5).
3. If you are invited to the beta
| What we hold | Why | Lawful basis |
|---|---|---|
| Your invitation: email address, the organisation and role it gives you, who invited you, and a note of why | Only invited people can sign in | Legitimate interests (running an invitation-only beta), then contract once you accept |
| Your account: email address, your name if you give it, when you first signed in | To provide the beta | Contract |
| If you sign in with Google: the name, email address and profile picture link Google sends, and the link between your Google account and your account here. We do not keep the sign-in tokens Google returns | To sign you in | Contract |
| Sign-in links we email you (single use, valid for 24 hours) and your sign-in sessions | To keep you signed in securely | Contract |
| For administrators only: an encrypted second-factor key, and when each session last passed the second factor | Security of the admin tools | Legitimate interests (security) |
| Emails we send you: sign-in links, and the alerts you choose to receive. For alerts: what you follow, which alerts were sent to you and when, and whether each email was delivered, bounced or marked as spam | To provide the beta, and to keep sending reliable | Contract |
| If you unsubscribe from alert emails, or emails to your address bounce or are marked as spam: your address on our list of addresses not to send alerts to | To respect your choice and protect deliverability | Legal obligation (PECR) and legitimate interests |
| Technical records: server logs (which may include your IP address and browser) and error reports | Security, preventing misuse, fixing faults | Legitimate interests |
Cookies. We use only the cookies sign-in needs: your session, a security token for sign-in forms, and where to return you after signing in. These are strictly necessary, so they need no consent. There are no analytics or advertising cookies. If that changes, we will ask first.
Marketing. We do not send marketing emails during the beta. If we ever do, we will ask for your consent first.
3a. If you ask for an invitation
| What we hold | Why | Lawful basis |
|---|---|---|
| Your email address, what you do (the option you choose), the club you named or searched for if any, and when you asked | To decide whether to invite you, and to invite you | Legitimate interests (running an invitation-only beta) |
| Whether you ticked the newsletter box, and when | To send the newsletter only to people who asked for it | Consent, which you can withdraw at any time |
| A keyed hash of your IP address (not the address itself), for 24 hours | To limit how many requests one connection can send, without a third-party CAPTCHA | Legitimate interests (preventing misuse) |
When email is live we send one confirmation that your request arrived. It is not marketing. We send the newsletter only if you ticked its box, which is unticked unless you tick it.
4. If you are named in the public records we use
Where it comes from. Companies House (the registers of officers and people with significant control, charges, insolvency records, and the accounts companies file), and The Gazette (insolvency notices). We do not collect anything about you from anywhere else.
What we hold:
- your name, your role and its dates (for example a director's appointment and resignation, or the natures of control as filed);
- month and year of birth, nationality and country of residence, as the register publishes them;
- your name as a person entitled to a charge, or as an insolvency practitioner;
- what the filed accounts and Gazette notices say, as published.
What we do not do:
- We do not use or show home or service addresses. We keep the register's responses as our audit record of what it returned, and those can include the service addresses it publishes. They are held in private storage and never published, and before the public launch we will remove the addresses from them, keeping only a fingerprint (hash) of the original to show where they came from.
- If you are named on a charge, as a lender or in any other role (for example as security trustee), we show you as "a private individual", with your role where you hold the charge in one ("a private individual, acting as security trustee"), and a link to the charge's entry on the Companies House register. We never show your name. Companies are named as the register records them.
- We do not show full dates of birth (the register does not publish them).
- We add nothing from other sources, build no profiles of people, and give people no scores or ratings.
- We never claim that two register entries are the same person because their names match.
Why. To show, with sources, who runs, owns, controls and lends to English football clubs, and what their filed accounts say. The service is about the clubs: we hold data about people only through their roles in the club companies we cover.
Lawful basis. Legitimate interests (UK GDPR Article 6(1)(f)): ours, our users' and the public's interest in the finances and ownership of football clubs. We have weighed these against your interests in a legitimate interests assessment, which you can ask to see. Everything we show states its source and date, and wording that characterises people is blocked.
Why we did not write to you. Writing to everyone named in these registers would involve disproportionate effort, so we publish this notice instead (Article 14(5)(b)) [lawyer: confirm].
If something is wrong. Write to corrections@clubledger.co.uk. We acknowledge within 1 working day and fix or reply within 5 working days. A flag shown in error is removed while we look into it. If the error is in the register itself, we will point you to Companies House: only Companies House can change its register.
5. If you contact us
We keep your message, our reply and what we changed, so that corrections can be checked later. Lawful basis: legitimate interests (dealing with your request and keeping an accurate record).
6. Who we share personal data with
We do not sell personal data. We use these service providers, which act on our instructions:
| Provider | What for | Where the data is held |
|---|---|---|
| Render | Hosting the website and the background worker | Frankfurt (EU) |
| Neon | The database | Frankfurt (EU) |
| Cloudflare | File storage (copies of filed documents and register responses), and our domain | Western Europe (EU) |
| Resend | Sending emails (sign-in links, alerts) | EU region |
| Sign-in with Google, only if you choose it | [Google's terms] | |
| Sentry | Error reports, set not to send personal information such as IP addresses by default [confirm at set-up] | EU region |
| Anthropic | Reading the accounts companies file, to extract their figures. It receives filed documents, not user data, and under its commercial terms does not train on them [confirm] | United States |
We may also disclose information where the law requires it.
Transfers outside the UK. Data held in the EU is covered by the UK's adequacy regulations for the EEA. Where a provider is in the United States, or can access data from there, the transfer relies on the UK-US data bridge for certified companies, or on the international data transfer agreement or addendum [confirm for each provider].
7. How long we keep it
| Data | Kept for |
|---|---|
| An invitation request | Until we invite you or decline, plus 30 days; 12 months if we have not answered [draft: to confirm] |
| The hashed IP address used for the rate limit | 24 hours |
| Your account and invitation | Until your access ends (the invitation is withdrawn or expires) or the account is deleted, plus 30 days |
| The content of alert emails we sent you | 30 days after sending [draft: to confirm] |
| The record of alert emails (which alert, when, whether delivered) and your unsubscribe or bounce status | While your account exists |
| Sign-in sessions | Until you sign out, or 30 days without use |
| Sign-in links | 24 hours, or until first used |
| An administrator's second-factor key | While the administrator's account exists |
| Server logs | 30 days |
| Error reports | 90 days |
| Correspondence about corrections | 2 years after the matter is closed |
| Public-register data | While the register shows it. Past roles (a former director, a satisfied charge) are kept as part of the club's history; this is reviewed [yearly] |
| Unaltered copies of register responses | [to set] |
| Backups | 30 days |
8. Your rights
You have the right to:
- access the personal data we hold about you;
- rectification of anything inaccurate;
- erasure, where there is no overriding reason to keep it;
- restriction of its use while a question is resolved;
- object to processing based on legitimate interests. We will stop unless we have compelling legitimate grounds that override your interests;
- portability of the data you gave us as a user.
To exercise any of these, write to privacy@clubledger.co.uk. We may need to confirm who you are. We reply within one month; complex requests can take up to two months more, and we will tell you if so. There is normally no charge.
We make no decisions about people by automated means that have legal or similarly significant effects.
9. Complaints
Please tell us first, so that we can put it right. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
10. Security
Access is by invitation only. Sign-in uses single-use email links or Google, and sessions are stored on our server so they can be ended at once. Administrators need a second factor. Data is held in private, access-controlled storage, and secrets are never kept in our code.
11. Changes
We will post any change here with its date, and email users about changes that matter.
Last updated: [date it comes into force].