FC Citadel Legal Centre

Privacy Policy

Privacy Policy – FC Citadel

Version 1.0 · Last updated: 5 July 2026
Data Controller: Global Sport Professionals Ltd, United Kingdom · Contact: contact@globalsportprofessionals.co.uk

1. Introduction

This Privacy Policy explains how FC Citadel ("we", "us", "our") collects, uses, stores, and protects personal data when clubs, academies, their administrators, coaches, and vendors use the Platform.

Where a club enters member data into the Platform, the club is the data controller and Global Sport Professionals Ltd acts as the data processor. We process that data only on the club's instructions.

2. Who We Are

Global Sport Professionals Ltd
United Kingdom
Email: contact@globalsportprofessionals.co.uk
Phone: +44 7304 345225 · +44 20 3932 2232

3. What Data We Collect

A. Account & User Data

• Name, email address, and role
• Club / organisation affiliation
• Login and authentication data

B. Member & Player Data (entered by the club)

• Name, age/date of birth, and contact details
• Team, registration, and membership details
• Attendance and participation records
• Consent records

C. Financial Data

• Fees, invoices, and payment status
• Transaction references (payment card data is handled by our payment providers)

D. Technical Data

• Device type, IP address, and browser
• Platform usage logs and audit trails
• Cookies (where applicable)

E. Communication Data

• Messages and notifications sent through the Platform
• Support and feedback records

4. How We Use Personal Data

• Provide and operate the club management Platform
• Manage members, registrations, and scheduling
• Process fees and generate financial reports
• Enable communication between authorised users
• Maintain security, audit trails, and prevent misuse
• Improve the Platform and support users

5. Legal Basis for Processing

A. Contract (Article 6(1)(b))

To provide the Platform under the subscription or licence agreement.

B. Legitimate Interests (Article 6(1)(f))

For security, fraud prevention, and service improvement.

C. Legal Obligations (Article 6(1)(c))

For responding to lawful requests and safeguarding obligations.

D. Consent (Article 6(1)(a))

Where required, including parental consent for members who are minors — obtained by the club.

6. Sharing of Data

We share data only with authorised users within your tenant, approved technology providers (e.g., cloud hosting), and where legally required. All processors are bound by data processing agreements. We never sell personal data.

7. Multi-Tenancy & Isolation

Data is stored in logically isolated tenants. Access is restricted by role, and cross-tenant access is prevented by design and monitored through audit logs.

8. International Data Transfers

If data is transferred outside the UK, we ensure adequacy regulations apply or Standard Contractual Clauses (SCCs) are in place, using only providers that meet UK GDPR standards.

9. Data Retention

• Active tenant data: retained for the term of the subscription
• On termination: returned or deleted in line with the Data Processing Agreement
• Financial records: retained as legally required
• Audit logs: retained for security and compliance

10. Your Rights

Individuals have the right to access personal data, correct inaccurate data, request deletion, restrict or object to processing, request portability, and lodge a complaint with the ICO. Where the club is the controller, requests should be directed to the club; we will assist them.

11. Security Measures

We use encryption in transit and at rest, role-based access control, tenant isolation, audit logging, and regular security reviews. See the Security & Retention tab for more detail.

12. Cookies & Tracking

Where the Platform uses cookies or similar technologies, we provide a cookie notice and allow opt-in for non-essential cookies. See our site-wide Cookie Policy for details.

13. Changes to This Policy

We may update this Privacy Policy. Account administrators will be notified of significant changes.

Data Processing Agreement

Club / Vendor Data Processing Agreement

For use of FC Citadel – Club Management Platform · Version 1.0 · Date: 5 July 2026
Between Global Sport Professionals Ltd ("Processor") and the Club/Vendor ("Controller").

1. Purpose of This Agreement

This Agreement governs how Global Sport Professionals Ltd processes personal data on behalf of the Club/Vendor through the FC Citadel platform. The Club/Vendor acts as the Data Controller and the Provider acts as the Data Processor, in line with UK GDPR, the Data Protection Act 2018, and applicable safeguarding standards.

2. Definitions

• Provider, Global Sport Professionals Ltd, the operator of FC Citadel and Data Processor.
• Club/Vendor, the organisation using the Platform and Data Controller.
• Member, an individual whose data is processed via the Platform.
• Personal Data, any information relating to a Member or user.

3. Scope of Processing

The Provider processes personal data only to deliver the club management services: registration, member management, scheduling, communications, financial reporting, and support. Processing is carried out solely on the Club/Vendor's documented instructions.

4. Responsibilities of the Provider

• Process personal data only on the Club/Vendor's instructions.
• Ensure confidentiality of authorised personnel.
• Implement appropriate technical and organisational security measures.
• Assist the Club/Vendor with data subject requests.
• Notify the Club/Vendor of any personal data breach without undue delay.
• Delete or return data on termination, as instructed.

5. Responsibilities of the Club/Vendor

A. Lawful Basis & Consent

The Club/Vendor is responsible for having a lawful basis for processing and for obtaining all necessary consents, including parental consent for members who are minors.

B. Accuracy & Minimisation

The Club/Vendor must ensure data entered is accurate, relevant, and limited to what is necessary.

C. Access Management

The Club/Vendor must manage user accounts, assign appropriate roles, and remove access promptly when users change roles or leave.

6. Sub-Processors

The Club/Vendor authorises the use of approved sub-processors (such as cloud hosting and payment providers). The Provider will impose equivalent data protection obligations on all sub-processors and notify the Club/Vendor of material changes.

7. Security Measures

The Provider maintains encryption in transit and at rest, tenant isolation, role-based access control, audit logging, secure hosting, and regular security testing.

8. International Transfers

Data is hosted in the UK/EU where possible. Any transfers outside the UK are covered by adequacy regulations or ICO-approved Standard Contractual Clauses (SCCs).

9. Data Breach Reporting

The Provider will notify the Club/Vendor of any personal data breach without undue delay, provide relevant information, and assist with any required notifications to the ICO or data subjects.

10. Audit & Monitoring

The Provider maintains audit logs of access and changes. The Club/Vendor may request information necessary to demonstrate compliance, subject to confidentiality and security requirements.

11. Termination

On termination, the Provider will, at the Club/Vendor's choice, return or securely delete personal data, except where retention is required by law. Data export is available during the notice period.

12. Liability

Each party is responsible for its own compliance with data protection law and for any breaches caused by its own acts or omissions, as set out in the subscription agreement.

13. Governing Law

This Agreement is governed by the laws of England and Wales.

Acceptable Use

Acceptable Use Policy – FC Citadel

Version 1.0 · Date: 5 July 2026 · Organisation: Global Sport Professionals Ltd
Applies to: All clubs, vendors, administrators, coaches, staff, and users of the Platform

1. Purpose

This Acceptable Use Policy sets out the rules for using FC Citadel. It protects the Platform, the data it holds, and every tenant that relies on it.

2. Expected Behaviour

• Use the Platform only for legitimate club management purposes.
• Access only the data you are authorised to view.
• Keep your credentials secure and enable multi-factor authentication where available.
• Treat members, colleagues, and vendors with respect in all communications.
• Report suspected misuse, security issues, or data breaches promptly.

3. Prohibited Behaviour

• Attempting to access another tenant's or user's data.
• Sharing login credentials or circumventing access controls.
• Uploading malware, unlawful content, or infringing material.
• Using the Platform to send spam or unsolicited communications.
• Scraping, harvesting, or exporting data for unauthorised purposes.
• Using the Platform to harass, discriminate, or endanger any person.

4. Data Handling Rules

• Enter only accurate, relevant, and necessary data.
• Do not upload special category data without a lawful basis and appropriate configuration.
• Do not store Platform data on personal devices unless encrypted and authorised.
• Delete or return data when it is no longer needed, in line with our retention policy.

5. Safeguarding

Where the Platform is used to manage members who are minors, users must follow applicable safeguarding standards, communicate only through approved channels, and never use the Platform to contact a child privately.

6. Consequences of Misuse

Breaches of this policy may result in access being suspended or revoked, and may be reported to the relevant organisation or authorities. Serious misuse may also lead to termination of the subscription.

7. Reporting

Report any suspected misuse, security concern, or data breach to the club administrator and to Global Sport Professionals Ltd without delay.

Security & Retention

Security & Data Retention – FC Citadel

Version 1.0 · Date: 5 July 2026 · Organisation: Global Sport Professionals Ltd

1. Security Overview

FC Citadel is built on a multi-tenancy architecture with isolation between tenants, role-based access control, and comprehensive audit logging. We apply technical and organisational measures appropriate to the risk of processing club, member, and financial data.

2. Technical Measures

• Encryption in transit (TLS) and at rest
• Tenant-level data isolation
• Role-based access control (RBAC)
• Multi-factor authentication for administrators
• Encrypted backups
• Regular security testing and reviews
• Audit logs for access and changes

3. Organisational Measures

• Staff confidentiality obligations
• Data minimisation practices
• Access provisioning and de-provisioning controls
• Data processing agreements with all sub-processors
• Incident response plan
• Regular policy and security reviews

4. Access & Authentication

Access is granted according to role and least privilege. Administrators are responsible for managing users within their tenant and removing access promptly when it is no longer required.

5. Data Retention

6. Data Deletion

On termination, and at the Club/Vendor's instruction, personal data is returned or securely deleted, except where the law requires retention. Data exports are available during the notice period.

7. Breach Response

We maintain an incident response plan. In the event of a personal data breach, we notify the affected Club/Vendor without undue delay and assist with any regulatory or data subject notifications.

8. Business Continuity

Encrypted backups and resilient hosting support recovery in the event of disruption. We review continuity arrangements as part of our regular security programme.