Privacy Policy

1. Introduction

Arrow CRM Limited, a company registered in England and Wales and trading under the name "Cluboard" ("Company," "we," "us," or "our"), operates the software-as-a-service platform available at https://cluboard.online ("Platform"). We are committed to safeguarding the privacy of individuals who access or use our Platform, and we recognise the importance of handling personal data in a transparent, lawful, and secure manner.

The purpose of this Privacy Policy is to explain what personal data we collect, the reasons for which such data is processed, the legal grounds upon which our processing activities rely, and the rights available to you as a data subject. It applies to all Users of the Platform, whether located in the United Kingdom, the European Economic Area, or elsewhere.

Our processing of personal data is governed by the UK General Data Protection Regulation ("UK GDPR"), as retained and incorporated into UK law by the European Union (Withdrawal) Act 2018, the Data Protection Act 2018 ("DPA 2018"), and, where applicable, the EU General Data Protection Regulation ("EU GDPR"). References to "GDPR" in this Policy should be read as applicable to both the UK GDPR and EU GDPR where relevant.

By accessing or using our Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the terms set out herein, you should cease using the Platform immediately.

2. Identity and Contact Details of the Data Controller

The data controller responsible for your personal data is:

• Company name: Arrow CRM Limited
• Trading name: Cluboard
• Registered address: England and Wales (full registered address available upon request)
• Contact email: hello@cluboard.online

If you have any queries regarding this Policy or wish to exercise your data subject rights, please contact us using the details above.

3. Personal Data We Collect

We collect and process the following categories of personal data:

3.1 Account and Registration Data: When you register for an account or create an Organisation on the Platform, we collect your full name, email address, and any other details you voluntarily provide during onboarding, including your club or organisation name.

3.2 Content Data: Any data, text, images, videos, logos, fixture information, match results, news items, sponsor materials, and other content you upload or input into the Platform.

3.3 Billing and Payment Data: Subscription payment processing is handled by Stripe, Inc. We do not directly collect or store payment card details. However, we may receive and retain transaction identifiers, subscription status, and billing history from Stripe for account management purposes.

3.4 Usage and Technical Data: We automatically collect certain technical information when you access the Platform, including your IP address, browser type and version, device type, operating system, pages accessed, session duration, and referring URLs. This data is used for platform security, analytics, and service improvement.

3.5 Communications Data: If you contact us via email or through the Platform, we will retain records of that correspondence, including your email address and the content of your communications.

3.6 Sponsor and Public Submissions: If you submit a sponsor application or a public highlight submission through the Platform, we collect your business name, contact email, and any uploaded media or associated details.

4. Lawful Bases for Processing

We process your personal data on the following legal grounds under Article 6 of the UK GDPR / EU GDPR:

4.1 Performance of a Contract (Article 6(1)(b)): We process your account registration and billing data to fulfil our contractual obligations under the Terms and Conditions you have agreed to when subscribing to the Platform.

4.2 Legitimate Interests (Article 6(1)(f)): We process usage and technical data on the basis of our legitimate interests in maintaining the security and performance of the Platform, preventing fraud, and improving our service. We have conducted a balancing test and are satisfied that our legitimate interests are not overridden by your rights or freedoms.

4.3 Compliance with Legal Obligations (Article 6(1)(c)): We may process personal data where required to do so by applicable law, including tax and financial record-keeping obligations.

4.4 Consent (Article 6(1)(a)): Where we rely on consent (for example, in connection with certain cookies or marketing communications), you have the right to withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal.

5. How We Use Your Personal Data

We use your personal data for the following purposes:

• To create and manage your account and Organisation on the Platform
• To deliver and maintain the Platform's features and functionality
• To process subscription payments and manage billing through Stripe
• To send transactional communications, including account confirmations, password resets, and subscription notifications
• To respond to enquiries and provide customer support
• To monitor and analyse usage patterns and improve the Platform
• To detect and prevent fraud, abuse, and security incidents
• To comply with our legal and regulatory obligations

6. Sharing of Personal Data

We do not sell, rent, or trade your personal data. We may share your personal data with the following categories of third parties where necessary:

6.1 Stripe, Inc.: For payment processing and subscription management. Stripe acts as an independent data controller in respect of your payment information. Please refer to Stripe's own Privacy Policy for details of how it handles your data.

6.2 HubSpot, Inc.: For CRM and email communications, where you have provided your details for marketing or onboarding purposes.

6.3 Infrastructure and Hosting Providers: Our Platform is hosted on cloud infrastructure. These providers act as data processors under our instruction and are bound by appropriate data processing agreements.

6.4 Professional Advisers: Including lawyers, accountants, and auditors where necessary for legal compliance or corporate governance.

6.5 Law Enforcement and Regulatory Authorities: We may disclose personal data where required to do so by law, regulation, or court order, or where necessary to protect our legal rights.

Where we transfer personal data to third parties outside the United Kingdom or European Economic Area, we ensure that adequate safeguards are in place, including Standard Contractual Clauses or reliance on adequacy decisions.

7. Data Retention

We retain personal data only for as long as is necessary for the purposes set out in this Policy or as required by law:

• Account data is retained for the duration of your subscription and for a period of up to 12 months following account closure, after which it is securely deleted or anonymised, unless a longer retention period is required by law.
• Billing and transaction records may be retained for up to 7 years in accordance with UK financial and tax record-keeping obligations.
• Communications and support records are retained for up to 3 years from the date of correspondence.
• Usage and technical data is retained in aggregated or anonymised form for analytical purposes indefinitely.

8. Your Rights as a Data Subject

Subject to applicable law, you have the following rights in relation to your personal data:

• Right of Access: To request a copy of the personal data we hold about you.
• Right to Rectification: To request correction of inaccurate or incomplete personal data.
• Right to Erasure: To request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent.
• Right to Restrict Processing: To request that we limit the processing of your personal data in certain circumstances.
• Right to Data Portability: To receive your personal data in a structured, commonly used, and machine-readable format where processing is based on consent or contract.
• Right to Object: To object to processing based on legitimate interests or for direct marketing purposes.
• Rights Related to Automated Decision-Making: Not to be subject to decisions made solely by automated means that produce significant legal effects.

To exercise any of these rights, please contact us at hello@cluboard.online. We will respond to your request within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have processed your personal data unlawfully.

9. Cookies

We use cookies and similar tracking technologies on the Platform. For full details of the cookies we use, their purposes, and how to manage your preferences, please refer to our Cookie Policy.

10. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include encrypted data transmission via HTTPS, access controls, and regular security reviews. However, no transmission over the internet is entirely secure, and we cannot guarantee absolute security.

11. Children's Privacy

The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that personal data has been collected from a child, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Where changes are material, we will notify you by email or by displaying a prominent notice on the Platform. Your continued use of the Platform after any update constitutes your acceptance of the revised Policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing activities, please contact us at:

Arrow CRM Limited (trading as Cluboard)
Email: hello@cluboard.online