1. Roles and scope
The subscribing club is the controller and Coaching Classes is the processor for parent, child, coach, attendance, safeguarding, communication and booking information the club places in the service. Processing continues for the subscription term and any limited return, deletion, backup or legal-retention period that follows.
2. Processing instructions
Coaching Classes will process this information only to provide, secure, support and improve the contracted service, comply with the club's documented use of platform features, or meet a legal obligation. We will inform the club if an instruction appears to infringe applicable data protection law.
3. People and information covered
Data subjects can include club owners, administrators, coaches, parents, guardians, children, emergency contacts and authorised collectors. Information can include identity and contact details, account roles, booking and payment references, attendance, communications, consents, medical needs, allergies, accessibility information and safeguarding notes.
4. Confidentiality and security
People authorised to process the information are subject to confidentiality obligations. Coaching Classes maintains proportionate technical and organisational measures including authenticated access, role and tenant controls, encrypted transport, protected administrative credentials, logging, backups and supplier oversight.
5. Sub-processors
The club authorises the use of infrastructure and service providers needed to operate the platform, currently including Supabase, Vercel, Stripe and Resend. Coaching Classes remains responsible for imposing appropriate data protection obligations on sub-processors and will give reasonable notice of material changes where required.
6. Assistance
Taking account of the nature of processing, Coaching Classes will provide reasonable assistance with data-subject requests, security assessments, breach response, data protection impact assessments and regulator enquiries relating to the service. The club remains responsible for deciding and communicating its lawful bases, notices, retention periods and responses as controller.
7. Security incidents
Coaching Classes will notify the club without undue delay after becoming aware of a personal-data breach affecting information processed for that club and will provide available information reasonably needed for the club's assessment and notifications.
8. International transfers
Personal information will not be transferred outside the United Kingdom without a lawful transfer mechanism where one is required. This may include UK adequacy regulations, the UK International Data Transfer Agreement or an approved UK addendum to standard contractual clauses.
9. Return, deletion and audit information
At the end of the service, Coaching Classes will return or delete club-controlled information as agreed, unless law requires retention. Secure backup copies may remain for a limited cycle with access restricted. We will make available information reasonably necessary to demonstrate compliance and support proportionate audits, subject to confidentiality, security and reasonable notice.
10. Contact
Data protection and security enquiries should be sent to info@coachingclasses.co.uk.