Privacy Policy

1. Who we are

OTB Connect (the “App”, available at www.otbconnect.app and as a mobile app) is operated by On The Ball Academy Glasgow, a Scottish Charitable Incorporated Organisation registered in Scotland (charity number SC051357) (“we”, “us”, “the Academy”). We are the data controller for the personal information processed through the App.

Contact for all data protection matters: opsmanager@ontheballacademy.co.uk

2. Information we collect

Account information

• Name, email address and phone number
• Password (stored only as a secure cryptographic hash — we never see or store your actual password)

Player (child) information — provided by a parent or guardian

• Child’s name and date of birth (used to place them in the correct age group)
• Medical details submitted through the Medical Certificate form (for trips and tournaments)

Content you create

• Posts, comments, reactions and shared photos or videos
• Messages sent to coaches and club staff
• Feedback form submissions (player, match and 1-2-1 reflections)
• Event RSVPs and booking records

Technical information

• Device push notification token (so we can send you notifications you have opted in to)
• Standard server logs (IP address, request time) generated when you use the App

We do not collect precise location data, contacts, browsing history, or any data for advertising purposes.

3. How we use your information

• To provide the App’s features: schedules, event invitations and RSVPs, bookings, the club feed, messaging and coach feedback
• To send notifications you have opted in to (for example new events, messages or announcements)
• To meet our safeguarding and child-welfare responsibilities
• To administer membership and meet our legal obligations as a charity

We do not sell personal data, we do not share it with advertisers, and we do not use it for marketing to third parties.

4. Legal bases (UK GDPR)

• Contract — providing the App and managing your membership
• Consent — optional information such as medical details, photos and push notifications; consent can be withdrawn at any time
• Legal obligation — safeguarding, charity and accounting requirements
• Legitimate interests — running, securing and improving the App

5. How long we keep your data (data retention)

We keep personal data only as long as it is needed for the purposes above:

• Account and profile data (name, email, phone) — kept while your account is active. Deleted within 30 days of your account being deleted or a verified deletion request.
• Player (child) details (name, date of birth) — kept while the player is an active member; deleted within 30 days of the associated account being deleted.
• Medical information — kept only while the player is an active member and deleted within 90 days of membership ending.
• Posts, messages and feedback — kept while your account is active; deleted or anonymised when your account is deleted.
• Push notification tokens — deleted when you log out, disable notifications or uninstall the App; stale tokens are purged automatically.
• Server logs — retained for up to 90 days for security and troubleshooting, then deleted automatically.
• Backups — encrypted database backups rotate automatically; deleted data leaves the backup cycle within 90 days.
• Safeguarding records — where we hold a safeguarding record we are required to retain it in line with Scottish statutory guidance and legal obligations, which may extend beyond the end of membership. These records are held securely with access restricted to authorised safeguarding personnel.

6. Who we share data with

We use a small number of service providers (data processors) to run the App. They process data only on our instructions and are bound by data protection agreements:

• Vercel — application hosting
• MongoDB Atlas — encrypted database hosting
• Google Firebase Cloud Messaging and Apple Push Notification service — delivery of push notifications
• Ably — real-time message delivery
• Our email delivery provider — account and notification emails

We may also share information where the law requires it or where it is necessary to protect a child: with statutory agencies, emergency services, sport governing bodies, or in response to a safeguarding concern.

7. Children’s privacy

OTB Connect accounts are held by parents, guardians and club staff — not by children. Information about a child (name, date of birth, medical details) is provided and controlled by their parent or guardian. The App is invite-only: only vetted members of the Academy community can join, and communication features are moderated by club staff in line with our safeguarding policies.

8. Security

• All traffic between your device and the App is encrypted (HTTPS/TLS)
• Passwords are stored using strong one-way hashing (bcrypt)
• Database access is restricted, authenticated and encrypted at rest
• Access to personal data is limited to authorised club personnel who need it

9. Your rights

Under UK GDPR you have the right to:

• Access a copy of the personal data we hold about you or your child
• Ask us to correct inaccurate data
• Ask us to delete your data (see section 10)
• Object to or restrict processing
• Withdraw consent at any time (for example for medical details or notifications)
• Complain to the Information Commissioner’s Office (ICO) at ico.org.uk

10. Deleting your account and data

You can request deletion of your account and associated personal data at any time by emailing opsmanager@ontheballacademy.co.uk from your registered email address. We will action verified requests within 30 days, in line with the retention schedule in section 5. Safeguarding records that we are legally required to keep are the only exception.

11. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows the current version, and significant changes will be announced in the App.