This Privacy Policy explains how Local League (“we”, “us”, “our”) collects, uses, shares and protects your personal data when you use our marketing website and our league management app (together, the “Service”). It applies to everyone who uses the Service — visitors, players, team captains and league administrators.
We are committed to protecting your privacy and handling your data in line with the UK GDPR, the Data Protection Act 2018 and, where it applies, the EU GDPR.
Who we are
The data controller for the Service is [LEGAL ENTITY NAME], [registered address]. If you have any questions about this policy or how we handle your data, contact us at privacy@[DOMAIN]. We are registered with the UK Information Commissioner’s Office (ICO) under registration number [ICO REG NO.].
The personal data we collect
Depending on how you use the Service, we may collect:
- Account data — your email address, password (stored securely, in hashed form), display name and, if you add one, a profile photo.
- Player data — your name, the leagues and teams you play in, your role (e.g. captain), your match results, statistics, streaks and any awards you earn.
- Approximate location — if you choose to appear on local leaderboards, the outward part of your postcode and its area only (for example “CV12” and “Bedworth”). We do not store your full postcode or precise address.
- Content you submit — comments on news posts, messages you send to other captains through the Service, and enquiries you make via our contact, feature-request or bug-report forms.
- Enquiry data — if you register interest in running a league, we collect your name, email, contact number and details about your league.
- Technical data — your IP address, browser and device information, and (where you consent) analytics data about how you use the Service.
How and why we use your data
We only use your personal data where we have a lawful basis to do so:
- To provide the Service (lawful basis: performance of a contract) — creating and managing your account, running leagues, recording results and showing you fixtures, standings and stats.
- To operate features and improve the Service (lawful basis: our legitimate interests) — showing player profiles and leaderboards, linking your identity across the leagues you play in, preventing abuse and fraud (for example, keeping a short-lived record of captain-to-captain messages), and understanding how the Service is used. We have balanced these interests against your rights.
- To communicate with you (lawful bases: contract / legitimate interests) — sending you service emails such as sign-up invitations, password resets and notifications about your account.
- Marketing and non-essential cookies (lawful basis: consent) — we only send marketing emails or use analytics cookies where you have given consent, which you can withdraw at any time.
- To meet our legal obligations (lawful basis: legal obligation) — for example keeping records we are required by law to keep.
Information that is visible to others
Local League is designed to publish league information. By taking part you should be aware that the following is public and may be seen by anyone: player profiles (your display name, photo, stats, streaks and awards), league tables and leaderboards, fixtures and results, and any comments you post. When you message another team’s captain through the Service, your name and the email you provide are shared with that captain so they can reply. Your email address is never shown on your public profile.
Who we share your data with
We do not sell your personal data. We share it only with trusted service providers who help us run the Service, under contracts that require them to protect it:
- Supabase — database, authentication and file storage.
- SendGrid (Twilio) — sending our emails.
- Vercel — hosting the Service.
- Google (Google Analytics) — website analytics, only where you consent.
- Google Calendar — if you book a demo with us.
We may also disclose data where required by law, to establish or defend legal claims, or in connection with a business sale or reorganisation.
Where your data is stored (international transfers)
We aim to store your data on servers in the UK or European Economic Area (EEA) [confirm your Supabase / Vercel regions]. Some of our providers (such as Google) may process data outside the UK/EEA. Where that happens, the transfer is protected by an approved safeguard — for example the provider’s certification under the UK Extension to the EU–US Data Privacy Framework or Standard Contractual Clauses.
Cookies and analytics
We use essential cookies to keep you signed in, and — only with your consent — analytics cookies to understand how the Service is used. You can accept or reject non-essential cookies using our cookie banner and change your choice at any time. See our Cookie Policy for full details.
How long we keep your data
- Account and player data — for as long as your account is active. If you delete your account, we delete or anonymise your personal data, though league results in which you took part may be retained in anonymised form for the integrity of historical records.
- Captain-to-captain messages — kept for up to 90 days for abuse prevention, then automatically deleted.
- Enquiries and form submissions — kept only as long as needed to deal with your request and for a reasonable period afterwards.
Your rights
Under data protection law you have the right to:
- Access the personal data we hold about you.
- Have inaccurate data corrected.
- Have your data erased (the “right to be forgotten”).
- Restrict or object to our processing of your data.
- Data portability — receive your data in a portable format.
- Withdraw consent at any time, where we rely on consent.
To exercise any of these rights, email privacy@[DOMAIN]. We will respond within one month. If you are unhappy with how we handle your data, you can complain to the ICO at ico.org.uk, though we’d appreciate the chance to put things right first.
Children
The Service is intended for users aged 16 and over. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.
How we protect your data
We use appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, row-level access controls, and restricting access to those who need it. No system is completely secure, but we take our responsibilities seriously and will notify you and the ICO of any breach where we are legally required to do so.
Changes to this policy
We may update this policy from time to time. When we make material changes we will update the “Last updated” date and, where appropriate, ask you to review and accept the updated policy.
Contact us
Questions about your privacy? Email privacy@[DOMAIN] or write to us at [registered address].