Privacy Notice

1. Who we are

Football For Fat Loss ("we", "us") is the data controller for the personal data described below. We are Football for Fat Loss Ltd, 23 Horsebridge Road, Havant, PO9 2LH, registered with the Information Commissioner's Office under registration number ZC184508. For any privacy question or to exercise your rights, contact us at info@footballforfatloss.com.

2. What data we collect

• Account & contact: name, email address, phone number, postal address, date of birth.
• Health data (special category): your weight and height, and the body-mass index (BMI) and weight-loss figures we calculate from them.
• Food diary: any meals and calorie figures you choose to log in the portal.
• Membership payments: Direct Debit reference identifiers only. Your bank details are entered on GoCardless's secure page and are never seen or stored by us.
• Account security: a one-way encrypted (hashed) version of your password.

3. Why we use it and our lawful basis

We use your data to run the league: managing your membership, organising teams and fixtures, recording weigh-ins, calculating standings and progress, and contacting you about sessions and your stats.

Because weight and height are special-category health data, we rely on your explicit consent (UK GDPR Article 9(2)(a)) to process them, and on consent (Article 6(1)(a)) for the related contact details. You give this consent when you complete onboarding. You can withdraw it at any time (see your rights below); withdrawing it means we can no longer keep you in the league.

4. Who we share it with

We do not sell your data. We share it only with the service providers (processors) that run the portal on our behalf:

• Vercel — website and application hosting, plus cookieless usage analytics.
• Neon — the database storing your records.
• GoCardless — Direct Debit membership payments.
• Resend — sending you membership and stats emails.

Some providers may process data outside the UK/EEA. Where they do, the transfer is covered by an appropriate safeguard — the UK International Data Transfer Addendum to the EU Standard Contractual Clauses — under each provider's data processing agreement.

5. How long we keep it

We keep your data only for as long as you are a member and for 12 months after you leave, after which your contact details and health data are deleted or anonymised. Direct Debit and payment records are kept for up to 6 years to meet UK tax and accounting obligations. Your weigh-in history may be retained in de-identified form so historical league standings stay accurate.

6. Your rights

Under UK GDPR you have the right to:

• access a copy of your data;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to processing;
• receive your data in a portable format;
• withdraw your consent at any time.

To exercise any of these, contact info@footballforfatloss.com. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

7. Cookies

We use a single strictly-necessary cookie to keep you signed in. Our website analytics (provided by Vercel) are privacy-friendly and cookieless — they set no cookies and don't identify you — so we use no advertising or tracking cookies, and no cookie banner is required.

8. Changes to this notice

If we make material changes we will update the version above and may ask you to consent again.