Privacy Notice
Version 2026-08-07
1. Who we are
Football For Fat Loss ("we", "us") is the data controller for the personal data described below. We are Football for Fat Loss Ltd (company number 16976557), 23 Horsebridge Road, Havant, PO9 2LH, registered with the Information Commissioner's Office under registration number ZC184508. For any privacy question or to exercise your rights, contact us at info@footballforfatloss.com.
2. What data we collect
- Account & contact: name, email address, phone number, postal address, and date of birth (used to confirm you are 18 or over — the league is adults-only).
- Health data (special category): your weight and height, the body-mass index (BMI) and weight-loss figures we calculate from them, any meals, water and calorie figures you choose to log in the food diary, and your answers to the seasonal health survey (diet, lifestyle, wellbeing and physical-activity questions) with the section ratings we calculate from them. We treat all of this as special-category health data, and we only process it with your explicit consent — the survey asks for its own consent, and you choose separately whether the coach may see your individual survey answers (they otherwise see only your section ratings).
- Membership payments: Direct Debit reference identifiers only. Your bank details are entered on GoCardless's secure page and are never seen or stored by us.
- Account security: a one-way encrypted (hashed) version of your password.
3. Why we use it and our lawful bases
We use different lawful bases for different purposes:
| What we do | Data used | Lawful basis (UK GDPR) |
|---|---|---|
| Running your membership: account admin, organising teams and fixtures, contacting you about sessions, keeping your account secure | Account & contact data, password hash | Article 6(1)(b) — necessary to perform our membership contract with you |
| Collecting membership payments by Direct Debit | Payment references | Article 6(1)(b) — necessary to perform our membership contract with you |
| Keeping financial and payment records | Payment records | Article 6(1)(c) — legal obligation (UK tax and accounting law) |
| Recording weigh-ins, calculating your BMI and weight-loss progress, running the food diary, contributing to team standings, and emailing you your stats | Health data | Article 9(2)(a) — your explicit consent, together with Article 6(1)(a) |
About your consent. When you join, we ask for your explicit consent to process your health data in a separate, clearly-worded step — it is not bundled into accepting our terms and conditions. You can withdraw it at any time by contacting us, and withdrawal does not affect the lawfulness of anything we did with your data before you withdrew. We will be honest about the consequence: weigh-ins are the heart of the league, so if you withdraw consent we can no longer record your weight or progress, which means you cannot continue as a playing member.
What you must provide. Your contact details and Direct Debit setup are needed to enter into the membership contract — without them we cannot offer you membership. The food diary is entirely optional.
4. Who we share it with
We do not sell your data. We share it only with the service providers (processors) that run the portal on our behalf. Where a provider is outside the UK, we list the safeguard that protects the transfer; you can ask us for more detail or a copy of the relevant safeguard at any time.
- Vercel (USA) — website and application hosting, plus cookieless usage analytics. Transfers are covered by the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), under which Vercel is certified.
- Neon, part of Databricks — the database storing your records. The database itself is hosted in London, UK, so your data is stored in the UK. Any residual access from the US (for example technical support) is covered by the UK-US data bridge, under which Databricks (including Neon) is certified, and by the safeguards in its data processing agreement.
- GoCardless (UK) — Direct Debit membership payments. GoCardless is a UK company and processes European payment data on servers in the UK/EEA.
- Resend (USA) — sending you membership and stats emails. Transfers are covered by the UK-US data bridge, under which Resend is certified.
5. How long we keep it
- Health data (weight, height, BMI, weight-loss figures, food diary): kept while you are a member and for 12 months after you leave — many members rejoin within a season, and this lets us restore your progress history and targets — then deleted or de-identified.
- Account and contact details: kept for 12 months after you leave (same reason — returning members get their account back), then deleted or anonymised.
- Direct Debit and payment records: kept for 6 years to meet UK tax and accounting obligations.
- League history: when your data is erased, your individual weekly weigh-in figures may be retained with your name and contact details removed, so past seasons' team standings stay accurate. League tables themselves only ever show team totals, not individual weights.
6. Your rights
Under UK GDPR you have the right to:
- access a copy of your data (you can download it yourself from your account);
- have inaccurate data corrected;
- have your data erased;
- restrict or object to processing;
- receive your data in a portable format;
- withdraw your consent to health-data processing at any time.
Some rights are not absolute — for example, we must keep payment records we are legally required to hold even if you ask for erasure, and withdrawing consent does not undo processing that happened while your consent was in place.
To exercise any of these, contact info@footballforfatloss.com — we will respond within one month. If you are unhappy with how we handle your data or your request, please raise it with us first so we can put it right; you also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
7. Automated decision-making
We do not make any automated decisions about you that have legal or similarly significant effects. Your BMI and progress figures are simple calculations shown to you and used for league standings; all membership decisions are made by people.
8. Photos and group messaging
We sometimes take photos at sessions for the club's social media. We will only publish a photo in which you are identifiable with your consent — asked when you join, and changeable at any time on your profile page (if you withdraw it, we will remove the photo from our accounts). Club communications may also run through a WhatsApp group; joining is optional, and members of the group can see each other's phone numbers. WhatsApp's own privacy policy applies to that service.
9. Cookies
We use a single strictly-necessary cookie to keep you signed in. Our website analytics (provided by Vercel) are privacy-friendly and cookieless — they set no cookies and don't identify you — so we use no advertising or tracking cookies, and no cookie banner is required.
10. Changes to this notice
If we make material changes we will update the version above and tell you. Any material change to how we use your health data will only take effect once we have asked for your explicit consent again.