Version 1.2: This policy was last updated on 24th September 2021. It may be updated in the future and we'll post the new version on our website.

What some words mean

So that we can be completely clear, here are some words we use which have specific meanings:

• "Account Holder" means a club which has a ClubManager account (generally this will be your business);
• "Subscriber" means the person who registers to use the Service, and, where the context permits, includes any entity on whose behalf that person registers to use the Service.
• "Invited User" means any person or entity, other than the Subscriber, that uses the Service with the authorisation of the Subscriber from time to time;
• "ClubManager account" and "ClubManager" means a current subscription to The Service;
• "The Service" means our ClubManager software which is accessed and used via our password protected websites;
• "us" "we" and "our" refers to Club Manager Limited, a company registered in England with registered number 6734233 and having its registered office at 195 St. Marys Lane, Upminster, England, RM14 3BU
• "you" means the Subscriber, and where the context permits, an Invited User who accesses and uses this website and/or The Service. "Your" has a corresponding meaning; and
• "your Data" means any data entered or uploaded by you while using The Service.

Creating and accessing a ClubManager account

How to apply: In order to access and use The Service, a ClubManager account must first be created. You can apply for a ClubManager account to be created by submitting your details on our "sign up" page.

Formation of a contract: If we accept an application for the creation of a ClubManager account, we will confirm this by email and at that point a legally binding contract will be created between the Account Holder and us. If you apply for a ClubManager account to be created, you must therefore ensure that you are authorised to enter into this contract for and on behalf of the Account Holder. The contract will be concluded in the English language and the provisions of these Terms of Service shall govern our agreement with the Account Holder and you.

Errors in information you gave us: If you made any mistakes in the details you gave to us when applying for a ClubManager account, these errors can be corrected by accessing The Service and using the "edit" function on the "Branch Details" or User" pages.

Use of Software: ClubManager grants You the right to access and use the Service via the Website with the particular user roles available to You according to Your subscription type. This right is non-exclusive, non-transferable, and limited by and subject to this Agreement. You acknowledge and agree that, subject to any applicable written agreement between the Subscriber and the Invited Users, or any other applicable laws:

1. the Subscriber determines who is an Invited User and what level of user role access to the relevant organisation and Service that Invited User has;
2. the Subscriber is responsible for all Invited Users' use of the Service;
3. the Subscriber controls each Invited User's level of access to the relevant organisation and Service at all times and can revoke or change an Invited User's access, or level of access, at any time and for any reason, in which case that person or entity will cease to be an Invited User or shall have that different level of access, as the case may be;
4. if there is any dispute between a Subscriber and an Invited User regarding access to any organisation or Service, the Subscriber shall decide what access or level of access to the relevant Data or Service that Invited User shall have, if any.

Refusal to create an account: We reserve the right, at our discretion, not to accept an application to create a ClubManager account. This may be due to technical constraints, because you or your business has been banned by us from using The Service or for any other reason. No charge will be made by us for declined applications.

How to access the account: You will not be able to access and use The Service without a username and password for a ClubManager account. There are two ways you can obtain these:

• Once a ClubManager account has been created, we will issue the Subscriber (whose details were provided to us when the account was applied for) with a username and password.
• Additional users (Invited Users) can obtain their own usernames and passwords if the Subscriber accesses The Service and uses the "New User" function on the "Users" page. (Some subscription packages may have limitations on the number of additional users which can be added - please check our Pricing Page for details.)

Your rights

Your rights: If the business you represent (or which you are advising) is an Account Holder and you are authorised by it to use The Service, we grant you a non-transferable, non-exclusive licence to use The Service in accordance with these Terms of Service.

Conditions: The above licence is strictly subject to compliance with these Terms of Service by you (and by the Account Holder whose ClubManager account you are accessing and by all other users of that ClubManager account.)

Your obligations

You must:

• only access an Account Holder's ClubManager account by using a password and username which that Account Holder authorises you to use; and
• only use The Service on behalf of the Account Holder whose ClubManager account you are accessing and solely for money management purposes relating to that Account Holder's own business which are legal.

You must not:

• do anything which could reasonably be expected to damage, disable, overburden, or materially impair The Service or our website generally or which is likely to interfere with any other party's use or enjoyment of The Service;
• question or dispute our ownership of the intellectual property rights in The Service; nor
• use The Service if you are one of our competitors (or if you plan to become one) or otherwise for the purpose of conducting any benchmarking or comparison with any comparable or competing product.

Security: The Account Holder is ultimately responsible for administering and safeguarding any passwords created to control access to its ClubManager account: please keep any password issued to you secure.

Fair use: You agree to a fair use policy and agree to the following:

• Send no more than 25,000 emails, SMS, Push Notifications and WhatsApp messages per calendar month.
• Upload more than 1GB of files to your account.
• Request additional training (over and above the initial getting started training) more than once every three months.
• Add more than 50,000 contacts to your ClubManager account.
• Add more than 5,000 bookings to your ClubManager account within a calendar month.

Paying for The Service

Subscription fee amount: A subscription fee for use of The Service is payable monthly in advance by the Account Holder. The subscription rates are posted on our website and we may vary these from time to time: please see our Pricing Page for the rates in force for the current month. All prices on our website are quoted in UK pounds Sterling and exclude VAT, which is also payable. If you change your subscription package in the future, the change in the subscription payment amount will take effect at the next billing cycle.

Free trials and beta trials: No charge for use of The Service will be made during any ‘free trial' period or any ‘beta trial' period. The Account Holder is not however entitled to benefit from more than one ‘free trial' - if we discover that more than one ‘free trial' has been requested, the Account Holder will become liable for payment of the subscription fee for all use of The Service made after the first ‘free trial' period.

Automatic renewal: Once any ‘free trial' or ‘beta trial' period is over, we will automatically renew the Account Holder's subscription and bill them every month using the credit or debit card details provided to us, or via any alternative payment method until the ClubManager account is closed.

Third party commission: Some third parties may provide one-off or ongoing commission for using their services.

Non-payment: We shall be under no obligation to provide The Service if the subscription fee (plus VAT) is not paid to us on time. The Account Holder must ensure that we have complete and accurate billing and contact information throughout the subscription period, including the full name of the Account Holder, its business address, and a billing contact email address. If subscription fees become overdue, because for example the Account Holder's credit card has expired, we reserve the right to suspend your access to The Service until the balance is paid and we may close the Account Holder's ClubManager account permanently.

Our VAT number is: GB100003025

Authorised Resellers: If you have purchased access to the Service from one of our authorised resellers then, unless otherwise notified to you by us or our reseller:

• your subscription fee will be based on the reseller's subscription rates as varied from time to time; and
• shall be payable directly to the reseller.

These Terms of Service apply, subject to such changes as are necessary to reflect the above, to all access of The Service via a reseller and we reserve the right to take the actions specified under "Non-payment" above in the event of non-payment to a reseller.

You may also be required to accept terms and conditions by the reseller in order to purchase the Service from them, in which case:

• your subscription fee will be based on the reseller's subscription rates as varied from time to time;
• you must adhere fully to the reseller's terms and conditions relating to your use of the Service in addition to these Terms of Service; and
• breach by you of the reseller's terms shall be deemed a breach of these Terms of Service.

Errors and support

Errors:

We shall ensure that all faults in the Software shall be classified and handled as shown below. Failures shall be classified as to the severity that they have on The Service. The severity classification shall be used to determine the response time for returning the system to its fully operational state. The severity classification shall be:

1. Class A: Emergency. Any Software problem resulting in serious loss or degradation of service or serious loss of functionality;
2. Class B: Urgent. Any Software problem that reduces system security or data integrity, or which represents a serious threat to service
3. Class C: Non-urgent. Low level Software or procedural problems requiring resolution in defined time scales;
4. Class D: Low. Other low level Software or procedural problem.

The following targets shall be adopted for returning the system to its fully operational state:

1. Class A: within one working day of receipt of a report from the Account Holder;
2. Class B: within two working days of receipt of a report from the Account Holder;
3. Class C: within a timescale of our discretion from receipt of a report from the Account Holder.
4. Class D: within a timescale of our discretion from receipt of a report from the Account Holder.

We shall determine the severity of classification of faults as they arise.

Support: we will provide a ‘fair usage' help and support area for you whilst you are a Subscriber to The Service. Support may be by telephone, email or Internet noticeboard. Fair usage is defined as being up to one hour per month per Account Holder, these times are non-accumulative. We will endeavour to respond to your support request in a timely fashion but are not required to do so.

Force majeure: Neither party shall be liable to the other party for any delay or failure to perform any of its obligations under this agreement if the delay or failure results from events or circumstances outside its reasonable control, and the party shall be entitled to a reasonable extension of its obligations after notifying the other party in writing of the nature and extent of such events. If such circumstances continue for a continuous period of more than 28 days, either party may terminate this agreement by written notice to the other party.

Who owns what

Rights in your data: The Account Holder has sole responsibility for the accuracy and reliability of your Data. The Account Holder retains ownership of any copyright, trade marks, database rights and any other intellectual property rights it has in your Data (such as rights in its logo, for example.) Intellectual property rights in your Data will not be transferred to us. We reserve the right to disclose your Data to law enforcement officials in the investigation of fraud or other alleged unlawful activities but otherwise we will only use your Data to provide The Service.

Rights in our software and our website: All copyright, database rights, trade marks and other intellectual property rights in The Service (including any such rights in our website) are either owned by or licensed to us and nothing in these Terms of Service shall transfer any ownership rights to you or to the Account Holder.

Closing a ClubManager account

Cancellation by you: To close your ClubManager account we require one month's notice in writing from the Account Holder. After this period no further subscription fees will be billed and no refund will be made of any subscription fees already billed and paid.

Suspension and closure by us: If you (or any other user of the Account Holder's ClubManager account) fails to abide by these Terms of Service, or if payment of the subscription fees is not paid on time, we reserve the right to suspend your access to The Service or permanently cancel the Account Holder's ClubManager account. If we withdraw access to The Service because these Terms of Service have been breached, no refund will be payable by us. We also reserve the right to close any ClubManager account (including during any ‘free trial' or ‘beta trial' period) for any reason, by giving one months notice. In these circumstances we will delete all the personal data controlled by you in accordance with our own retention schedule.

Disclaimer

IMPORTANT: This section restricts the extent to which we are liable for any losses which may be suffered in connection with your use of The Service. It also requires the Account Holder to compensate us for any loss we suffer as a result of your failure to comply with these Terms of Service.

No guarantees: We make no guarantee that The Service will be suitable for your intended use, neither do we guarantee that it will be error-free, timely, reliable, entirely secure, virus-free or available, especially since we are dependent on the reliability of the Internet and your use of your own computer to access The Service. We will try to keep disruptions to a minimum but we may suspend The Service from time to time to carry out maintenance and support work and to investigate unauthorised use.

Exclusion of our liability: You use The Service entirely at your own risk. We do not restrict our liability (if any) for personal injury or death resulting from our negligence, for fraud committed by us or for any matter which it would be illegal to limit or to attempt to restrict. Personal injury includes harm to the rights and freedoms of the individual as defined in data protection legislation. We exclude all other liability and responsibility for any amount or kind of loss or damage arising in connection with The Service (even if we have been advised of their possibility.)

Limitation of our liability: Where we are not legally entitled to exclude our liability, our total liability for any loss or damage relating to The Service (or to our website generally) shall not exceed an amount equal to the subscription fees which the Account Holder has paid to us in the previous month. An exception to this is where loss or damage relating to The Service affects the rights and freedoms of the individual. In such circumstances we cannot limit our liability but reserve the right to negotiate with such an individual or their representative.

Liability to us: If you access The Service using a password created to control access to the Account Holder's ClubManager account, then the Account Holder shall be held liable for any reasonable costs and expenses incurred by us as a result of breach of these Terms of Service by you. Otherwise, you shall be personally be held liable for any reasonable costs and expenses incurred by us as a result of breach of these Terms of Service by you.

General legal matters

Entire agreement: These Terms of Service and our Privacy Policy describe the entire agreement between you, the Account Holder and us regarding The Service, and supersede any prior understandings or agreements. The headings are for convenience only and shall not affect the construction or interpretation of these Terms of Service.

Changes to this contract: We reserve the right to change these Terms of Service from time to time and therefore we may impose new or different terms and conditions on your use of The Service. These additional terms will be posted here on our website and will be effective from the Account Holder's next monthly subscription renewal. Your continued use of The Service will be deemed to constitute acceptance by the Account Holder of all of the new terms. These Terms of Service may not otherwise be changed without our written consent.

Transfer of rights & obligations: We shall be entitled to transfer our rights and/or obligations under these Terms of Service to another party. Neither you nor the Account Holder may transfer any of your rights or obligations under these Terms of Service without our written consent.

Waiver and severability: If either you or we ignore any breach of these Terms of Service, it doesn't mean that any further breach cannot be enforced. Similarly, if any part of these Terms turn out to be invalid or unenforceable for some reason, then it will be replaced with a provision which, as far as possible, achieves the same purpose as the original, and the remainder of the agreement will still be binding.

Resolving disputes: These Terms of Service shall be governed by and interpreted in accordance with English law. If any party wants to take court proceedings in relation to The Service, it must do so in England. You are responsible for compliance with any applicable laws of the country from which you use or otherwise access The Service.

Categories of Data Subject

The personal data transferred to ClubManager is determined and controlled by the Customer and the Users, as such we have no control over the volume and sensitivity of the personal data transferred.

ClubManager does not intentionally collect or process any special categories of data in the provision of ClubManager.

Obligations and Rights of the Data Controller

The obligations and rights of the Data Controller are set out in the main Terms and Conditions.

Data Security

Your data is sent using HTTPS, and encrypted at rest.

When your data is moving between you and us, everything is encrypted and sent securely using HTTPS. We also encrypt your data at rest using Transparent Data Encryption.

Website hosting

For customers outside of India

ClubManager is hosted on the Hetzner infrastructure. This places your data in their European data centres. At the time of writing we use their Nuremberg data center in Germany.

Using Hetzner means we take advantage of their rigorous security standards and reliance, servers and firewalls are always up to date. You can read more about their specific standards and procedures here: https://www.hetzner.de/pdf/en/Sicherheit_en.pdf

For customers within India

ClubManager is hosted on OVHCloud. This places your data in their Indian data centres.

Using OVH means we take advantage of their rigorous security standards and reliance, servers and firewalls are always up to date. You can read more about their specific standards and procedures here: https://www.ovhcloud.com/en-gb/about-us/

We don't store debit/credit card information.

All our payments are processed through recognised service providers that are a PCI Service Provider Level 1 organisation - the most stringent certification level available in the payment industry.

Using these providers means we don't need to store payment card details, they are sent encrypted direct to the provider, we don't store them anywhere.

Your passwords are hashed

We hash your passwords using a PBKDF2-based function, but that's no reason not to create a strong password in the first instance.

We encourage you to understand, and educate your employees on what makes a strong password, and use them accordingly, maybe test score a password on here https://lowe.github.io/tryzxcvbn/

Keeping your data secure

Keeping customer data safe is a huge responsibility and our top priority. We work hard to protect our customers data from the latest threats. This is not a one time effort, it's a continual process that we monitor and work on.

Security issues come to light through different means and activities, from articles in technical press, discovery during routine work, and through our internal reviews and vulnerability scans.

How we deal with security issues

If we discover a security threat we will follow this process:

1. Understand the nature of the threat.
2. Assess the risk of the threat to our customers data - bearing in mind the likelihood of breach and the impact of a possible breach.
3. Scope the work required to mitigate or eliminate the risk.
4. Prioritise any work according to the results of this risk assessment.

Reporting security problems

Send all security concerns directly to us via our support email address.
We'll get back to you as soon as we can, usually this will be in 2 hours during week days, but we do check in at weekends too. Feel free to tweet us too https://twitter.com/ClubManagerMRM

Data Protection Statement

What is the GDPR and why is it relevant?

The General Data Protection Regulation 2016/679 is a regulation in EU law on data protection and privacy in the European Union and the European Economic Area. It was introduced in May 2018. It also addresses the transfer of personal data outside the EU and EEA areas. It requires that those who engage in the processing of personal data comply with its provisions and confers important rights to individuals whose personal data are being processed. The regulation is also applicable to those who have an establishment in the EU and are involved in the processing of personal data. The GDPR was retained in domestic law at the end of the transition period when the UK left the EU and was renamed the UK GDPR. The UK GDPR sits alongside an amended version of the Data Protection Act 2018 (DPA). The key principles, rights and obligations remain the same. However, there are implications for the rules on transfers of personal data between the UK and the EEA. The UK GDPR also applies to controllers and processors based outside the UK if their processing activities relate to: offering goods or services to individuals in the UK or monitoring the behaviour of individuals taking place in the UK. There are also implications for UK controllers who have an establishment in the EEA, have customers in the EEA, or monitor individuals in the EEA. The EU GDPR still applies to this processing, but the way we interact with European data protection authorities has changed.

ClubManager's Commitment: What are we doing to protect you?

At ClubManager, we value our customers' success, and understand the importance of knowing that personal data is being protected. That's why we, despite already having a top level of security and data protection, work continually to provide an even greater level of protection to our customers.

The information given to you by ClubManager concerning technical, legal or professional aspects of UK GDPR is for guidance only and does not constitute legal or professional advice. Always consult legal counsel on any specific legal problem or matter.

As part of our contract with you we are a "data processor". This means amongst other things that the Subscriber controls each Invited User's level of access to the relevant organisation and Service at all times and can revoke or change an Invited User's access, or level of access, at any time and for any reason (see also Creating and accessing a ClubManager account, Categories of Data Subject and Who Owns What sections). Where we are a data processor, we process personal data in accordance with the appendix to this document: the Data Processing Agreement.

POPIA

For clients/prospective clients resident in the Republic of South Africa subject to the Protection of Personal Information Act 2013 (POPIA), we are happy to enter into a contract on the understanding that you meet the minimum requirements as laid down in the POPIA including your obligations regarding transborder information flows. We give the assurance that ClubManager is compliant with UK domestic legislation relating to personal information: the United Kingdom General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA) and The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).

Privacy Policy

Maintaining your privacy is really, really important to us. You entrust us with sensitive financial information, and we take that responsibility seriously.

1. General Information

Club Manager Limited ("we", "us", "our") take security and privacy seriously. This Privacy Policy explains how we collect, store and use personal data when you browse www.clubmanagercentral.com (the "ClubManager website"), use the ClubManager application ("ClubManager") or otherwise provide your personal data to us. Please read this Privacy Policy carefully to understand how we will treat your personal data.

This Privacy Policy should be read together with our Terms and Conditions, which together apply to your use of the ClubManager website and ClubManager.

2. What information do we collect?

Your personal data

When we say your "personal data", we mean any information that identifies any person, that you provide to us during your trial period, after you subscribe, or that is contained in any other information that you provide to us (or that you authorise a third party to give to us on your behalf).

Your "personal data" may also be contained in information that we collect about you in connection with your use of the ClubManager website and/or ClubManager. The membership data that you enter into ClubManager, or that is provided to ClubManager from a third party, isn't part of the "personal data" discussed here, unless it identifies a person – for more information about your membership data, jump ahead to the next section. When it comes to your personal data, we comply with our obligations under the General Data Protection Regulation and any other applicable data protection legislation from time to time.

Information you provide – Your personal data includes the information you provide, or that you authorise someone else to provide, when you sign up for an account or sign up to receive our emails, or when you answer questionnaires, surveys, enter competitions or provide information in your account profile, on the ClubManager website, or during a support enquiry about you and/or your organisation. It also includes information you provide when you complete any forms which you submit to us (e.g. to authorise us to receive the transaction information from your a third party). It also includes information you upload to your ClubManager account.

Examples of this personal data include your name, your email address, contact and/or employee names; and any correspondence when you contact us.

We do not collect or process special categories of personal data, as defined under GDPR. Also, we do not knowingly collect or solicit any personal data from anyone under the age of sixteen or knowingly allow such persons to register for ClubManager. ClubManager is not directed at children under the age of sixteen. In the event that we learn that we have collected personal data from a child under age sixteen without verification of parental consent, we will delete that information as quickly as possible.

Information we collect - We collect information about your website usage, to improve our service and to understand trends to enhance and customise content and advertisements. Some of this data may be "personal data", where it identifies a person. Here's the information that we collect and how we use it:

• We monitor patterns of usage, such as login dates and volumes of data, so we can understand how people are using ClubManager to develop and improve our products.
• We also monitor patterns of usage so that we can tailor any communications we may send you or advertising you may receive. For example, we may tailor your newsletter with information about product features that you haven't tried yet, instead of features that you use frequently.
• For security reasons and to aid in monitoring patterns of usage, we log your IP address when you use the website. This is your computer's individual identification number that is assigned to your computer when connected to the Internet.
• We monitor traffic information when you visit our site or read our emails, including things like page visits, email clicks, purchases, referring sites, and video viewings. We use this information to improve our website, advertising, promotions, and to understand customer purchasing behaviour. Please see Section 11: Use of Cookies below regarding Cookies.

Information Others Provide to Us - We may receive information from others (e.g. your bank) that you have authorised that third party to provide to us. This could include the initial information to enable us to create your account (e.g. your full name, your email address and your business type) and also your bank transaction data.

Financial Data

In addition to your personal data, we will also hold financial data that you enter into ClubManager. Examples of your financial data include your members's membership payments and purchases.

3. What do we use your data for?

Providing ClubManager - We use your personal data to enable us to register you and provide you with access to ClubManager and the ClubManager website. It will also enable us to contact you by email, fax, post, SMS, social media or telephone where necessary concerning ClubManager; to record your personal preferences; to personalise our services to you (such as by pre-populating fields to make it easier for you to provide information when you return to ClubManager or the ClubManager website). It will also enable us to produce reports you request as part of the services we provide, including regulatory reports and/or other reports. We may also validate your information (and, in some cases, match it against information that has been collected by a third party, for example Companies House) to check that the data we hold about our customers/users is accurate, consistent and current.

We may use third parties to assist us in providing ClubManager from time to time, and in those cases may pass on your personal and/or membership data to them. In such cases we will only share your data with third parties that we trust, and where there are assurances in place as to how they will protect the data.

Improving ClubManager - We will also use and analyse your personal data and financial data so that we can administer, support, improve and develop our business, customer service and the features of the ClubManager website and ClubManager generally.

Providing Insights - We monitor anonymous, aggregated information about account and membership data so that we can produce insights about small businesses finance. For example, based on an anonymous, aggregate data analysis, we may produce a white paper that reports how clubs run manage membership renewals. We may share these insights with customers, on our blog or other promotional material, use them internally to improve our product and communications, or share with other interested third parties. Just to be clear - we will never identify you or your business in such communications or white papers and will never report data in such a way that your business could be identified.

Contacting you for Marketing Purposes - We may use your personal data to contact you by email, fax, post, SMS, social media and/or telephone to let you know about our other ClubManager and/or third party services, content, offers or product ranges which may be of interest to you. We may also use your membership data to enable us to tailor these notifications (in order to make sure what we are sending you is relevant). We will only use your data in this way where you have provided consent, we have legitimate business reasons for doing so, or where we are otherwise entitled by law to do so. If you would like us to stop providing you with such notifications, just contact us using the details below. Please note, this may take up to one working day to take effect. To stop receiving emails from ClubManager itself (for example, a reminder that your subscription is expiring), you should cancel your ClubManager account.

We may contact you if the specific arrangement we have in place with a third party which impacts you is changing and / or coming to an end and to let you know what will take place next.

Cookies - We may further use, or permit selected third parties to use, your personal data to enable us to track and analyse ClubManager website traffic and visitor trends, improve your browsing experience and to personalise and enhance the content and advertising we display. For further details, please see Section 11: Use of Cookies below.

Legal Requirements – We may use your personal data to comply with any legal obligations to which we are subject.

We shall periodically check that the personal data we store for you is accurate. If you would like to update the personal data we hold about you, please login to your ClubManager account or contact us at [email protected] with your request.

4. Why do we use your personal data?

We collect and use your personal data for a variety of reasons. We need some data to enter into and perform our contract with you and provide you with access to ClubManager – for example your contact details and other information requested during the ClubManager setup process. If you fail to provide such data we will be unable to provide our service to you.

Other information we collect because we have legitimate business interests, for example, in:

• Ensuring that we can onboard you as a customer and manage your account;
• Understanding how our customers use our products, services and websites;
• Understanding and responding to customer feedback;
• Researching and analysing the services our customers want;
• Improving our product and better understanding how our customers use it.

In some circumstances we may process your personal data because it is required for compliance with a legal or regulatory obligation.

5. Who do we share your information with?

We will not share your membership data with a third party unless you authorise it (by choosing to do so within ClubManager, or as detailed in this policy).

We will share your personal and financial data with third parties in certain circumstances:

• We may disclose your data to any member of our group (which means our subsidiaries, our ultimate holding company and its subsidiaries) and other companies which may be added to our group from time to time;
• We may pass aggregate information on the usage of the ClubManager website and ClubManager, where relevant, to maintain, improve and manage the ClubManager website and ClubManager, but this will not include your personal data.

We may also share your personal and membership data with third parties:

• in the event that we, our business, or substantially all of its assets are acquired by a third party (in which case personal information about customers will be one of the transferred assets);
• if we are under a duty to disclose or share your personal or membership data in order to comply with any legal obligation; to cooperate with law enforcement officials in the investigation of unlawful activities of ClubManager website users or relating to ClubManager users; or in order to enforce or apply any contract with you; or to protect our rights, property, or safety of our employees, customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

We also utilise a number of carefully selected third parties to help provide our services to you. Examples of these functions include email, providing marketing assistance and data analysis, data management, handling credit card transactions and providing customer service. In choosing to work with any such third parties, we will always ensure that the security policies and confidentiality arrangements of those third parties adhere to the same requirements we ourselves impose and expect, as a minimum. No ownership rights to the data will be transferred to any third party.

The data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA"). It may also be processed by staff operating outside the EEA who work for us, one of our group companies or for one of our suppliers. Such staff maybe engaged in, among other things, the processing of your payment details and the provision of support services. By submitting your data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.

For a full list of subprocessors and details of the adequate safeguards in place in respect of data transfers outside the EEA, please see here.

Additionally, you may grant third party access to your personal or membership data by enabling the ClubManager API for that third party. At all times, this access is controlled by you. ClubManager is not responsible for the privacy practices employed by any third party given access by you to your personal or membership data by the ClubManager API.

6. How long do we store your data for?

We only store your data for as long as necessary for the purposes of processing set out in this policy. When you cancel your account with ClubManager, you can either delete your data immediately, or we will automatically delete your data within 180 days.

If you are signed up to marketing communications, cancelling your ClubManager account will not cancel your marketing preference. If you would like to unsubscribe, please email [email protected].

To ensure the integrity of our systems and your data, we utilise various technologies to continually take secure, encrypted backups. Data remains archived within these backups and these are maintained according to our defined two-year data retention policy, after which they are removed.

7. You can export your data at any time

You can export a copy of your data whenever you like - this will include your personal data and that of your members, your financial transactions, purchases, and expenses. Please contact [email protected] to request this.

You can also ask us for a copy of your personal data that we hold (see Section 8: What are your rights? below).

If your free trial expires, your account is not automatically cancelled within our system. We will retain historical details about your payments to ClubManager for accounting purposes because we need to do so by law.

8. What are your rights?

1. Access to your personal data: You can ask us to confirm if we are processing your personal data and you may request a copy of your personal data by contacting our support team at [email protected].
2. Right to change or withdraw your consent: Where you have given us consent to make use of your personal data for any of the purposes outlined in this policy, you may withdraw that consent by contacting us using the details located at section 12 of this policy. If you wish to change your contact preferences or no longer wish to be contacted for marketing purposes, visit our Preference Centre or get in touch.
3. Right to Rectification: You may ask us to update out of date or inaccurate information we hold about you. To do so, please log on to your ClubManager account and update your information or get in touch.
4. Right to Erasure: In certain circumstances you may ask us to erase your Personal Data. If you would like us to erase the personal data we hold about you, please get in touch, specifying why you would like us to do so.
5. Right to Data Portability: In certain circumstances you may ask us to provide you with the personal data that we hold about you in a structured, commonly used, machine readable form, or ask for us to send such personal data to another data controller. You can use the Export All Data functionality at any time to export your data.
6. Right to object: In certain circumstances you may object to our processing of your personal data. Please get in touch.
7. Right to restrict processing: You can ask us to restrict the processing of personal data we hold about you in certain circumstances. Please get in touch.
8. Make a complaint: You may make a complaint about our data processing activities to a supervisory authority. In the UK this is the Information Commissioner's Office (ICO). Further details can be found on their website at https://ico.org.uk.
9. Getting in touch: To make enquiries and/or to exercise any of your rights in this privacy policy please contact our support team at [email protected].

9. Use of cookies

Cookies are small files saved to your device that track, save and store information as well as your interactions and usage of our services. The primary purpose for our use of cookies is to allow us to provide a smooth, efficient and personalised experience for our users both on and off our website through remembering your preferences, storing passwords if you request it and serving you more relevant advertising.

If you want to manage or disable cookies for the ClubManager website or any other site, you can do it by changing your browser settings. We suggest consulting the Help section of your browser or taking a look at the About Cookies website which offers guidance for all modern browsers.

10. Security and data storage

We take security and privacy seriously. We will endeavour to take all reasonable steps to keep your personal and membership data secure once it has been transferred to our systems. We adopt appropriate, industry standard data collection, storage and processing practices and security measures to protect against unauthorised access, alteration, disclosure or destruction. For further details of the some of the security measures we have implemented, please see contact us.

Where we utilise third parties to help provide our services, we will always ensure that the security policies and confidentiality arrangements of those third parties adhere to the same requirements we ourselves impose and expect, as a minimum.

Where we have given you (or where you have chosen) a password which enables you to access certain parts of the ClubManager website or ClubManager itself, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

Please note that the internet is not a secure medium and although we will do our best to protect your data, we cannot guarantee the security of any data transmitted to the ClubManager website or through ClubManager itself. Any transmission is at your own risk.

11. Changes to this privacy policy

We may modify or update this Privacy Policy from time to time to reflect the changes in our business and practices, and so you should review this page periodically. When we change the policy in a material manner we will let you know and update the ‘last updated' header at the top of this page.

This Privacy Policy was last amended on 24th September 2021.

12. Getting in touch

If you have any queries relating to this Privacy Policy or ClubManager's use of your personal or financial data, please contact our Head of Information Security via email through [email protected], or our Support Team at [email protected] or by writing to us at Club Manager Limited, Head Office (UK): 195 St. Marys Lane, Upminster, England, RM14 3BU

3rd Party Privacy Policy

To help us deliver ClubManager we have to share information and data with various 3rd party apps. This is in addition to third party providers, such as payment providers, that you will have chosen to link to your ClubManager account. We list those apps here and outline the agreements in place:

Google Inc.

We use Google Analytics to help us understand the way people use ClubManager so we can make it better and communicate relevant information to users. To provide this Google collects anonymised statistical data about the use of our website and applications.

Read Google Analytics' Privacy Policy

SendGrid

We use SendGrid for sending emails. To do this SendGrid stores user names, email addresses and analytical data on their usage of ClubManager. We use that data to ensure we only send emails relevant to the individual.

To ensure compliance with the law on EU/ USA data transfers, our agreement with SendGrid is based on the Notice of Privacy Shield Certification laid down by the EU.

Zendesk Inc.

Our customer support system and emails are provided by Zendesk. Customers email addresses will appear in Zendesk along with all discussion between the customer and ourselves.

Zendesk store their Data in USA Data Centres and have certified with EU-US Privacy Shield https://help.zendesk.com/hc/en-us/articles/229138227-Zendesk-Certifies-to-Privacy-Shield

Appendices

Data Processing Agreement

1. In order to comply with the United Kingdom General Data Protection Regulations (UK GDPR), there must be a written agreement between the Account Holder and ClubManager which processes personal data on behalf of the Account Holder, governing the processing of those data.

1.1 nothing within this contract or any other agreement between the two parties relieves either party of its own direct responsibilities under the UK GDPR;

1.2 see the Terms and Conditions and Privacy Notice provided by ClubManager for information relating to the responsibilities of both parties;

1.3 in this Data Processing Agreement, "personal data", "data subject", "data controller", "data processor", and "personal data breach" shall have the meaning defined in data protection legislation;

1.4 for the purposes of this agreement the Account Holder is the data controller and ClubManager is the data processor;

1.5 the data controller shall ensure that it has in place all necessary lawful bases and notices required to enable the lawful transfer of personal data to the data processor for the purposes described in this Agreement;

2. ClubManager agrees to process the following personal data: names, addresses, and other relevant personal information regarding the Account Holder's data subjects, which may include but is not limited to bank account and payment details and Special Category personal data relating to health or disability. For the provision of the services described below: enabling use of their membership management software system and for no other purpose unless expressly permitted in writing by the Account Holder.

3. ClubManager agrees to process the personal data in accordance with the terms of this Agreement. ClubManager agrees that it shall:

3.1 process the personal data strictly in accordance with the terms of this Agreement and the Account Holder's reasonable written instructions given in advance with respect to the processing of the personal data during the length of the existing contract/provision of services to the Account Holder;

3.2 take appropriate technical and organisational measures against the unauthorised or unlawful processing of the personal data and against the accidental loss or destruction of, or damage to the personal data. This includes:

• secure storage (premises and equipment) and secure transfer of electronic and paper documents (e.g. using encryption when sending by email);
• adequate back up and disaster recovery procedures and systems;
• training in data protection law and practice for employees of ClubManager used by it to provide the services to the Account Holder as detailed above);
• ensuring that people processing the personal data are subject to a duty of confidence;

Measures shall be proportionate to the potential harm resulting from unauthorised or unlawful processing, taking into account the current state of the art in technology and the cost of implementing those measures;

3.3 ensure that only such of its employees who may be required by it to assist it in meeting its obligations to the Account Holder shall have access to the personal data;

3.4 process the personal data only in accordance with the laws of the United Kingdom, paying particular attention to the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and subsequent relevant laws and with regard to guidance on data protection from the Information Commissioner's Office;

3.5 acknowledge all data subjects' rights under the UK GDPR and assist data subjects of the Account Holder to exercise their rights as appropriate. The Account Holder shall reimburse ClubManager for any reasonable and properly incurred costs which ClubManager incurs in complying with this requirement to the extent that such costs are not covered by the payment of any charges under the contract between the two parties. Informing The Account Holder that a subject access request has been received shall not constitute a reasonable and properly incurred cost in the context of this agreement;

3.6 not use the personal data for any purposes which may be inconsistent with those notified to the data subject on or before the time of collection provided that the Account Holder has previously supplied copies of all such notices to ClubManager. Notification to ClubManager by way of this clause, that the Account Holder's privacy notice is available on its website, constitutes the supply of the privacy notice;

3.7 not disclose the personal data to a third party in any circumstances other than at the specific request of the Account Holder or as otherwise specified in this agreement. The Account Holder gives approval for the personal data for which it is the data controller to be disclosed to ClubManager's data processors and partner organisations as listed in its Terms and Conditions and Privacy Notice at the time the contract between the two parties is signed;

3.8 promptly carry out any request from the Account Holder requiring ClubManager to amend, transfer or delete all or any part of the personal data if the Account Holder is unable to do this itself. The Account Holder shall reimburse ClubManager for any reasonable and properly incurred costs which ClubManager incurs in complying with this requirement.

3.9 notify the Account Holder immediately upon receiving any notice or communication from any supervisory or government body which relates directly or indirectly to the processing of the personal data;

3.10 notify the Account Holder immediately upon receiving a request to do something which infringes the UK GDPR or other domestic data protection law;

3.11 if requested in writing by the Account Holder, provide to the Account Holder a copy of the personal data in the format and on the media reasonably specified by it, if the Account Holder is unable to do this itself. The Account Holder shall reimburse ClubManager for any reasonable and properly incurred costs which ClubManager incurs in complying with this requirement;

3.12 if any personal data in the possession or control of ClubManager become lost, corrupted or rendered unsuitable for any reason, promptly restore such personal data using its backup and/or disaster recovery procedures at no cost to the Account Holder;

3.13 notify the Account Holder immediately in the event of any personal data being irrecoverably lost, stolen or disclosed without express permission of the Account Holder;

3.14 at the conclusion of work requiring personal data provided by the Account Holder destroy all information given to them as detailed in paragraph 2 by the Account Holder in accordance with ClubManager's retention schedule in a secure fashion and confirm to the Account Holder when this has been completed;

3.15 inform the Account Holder prior to giving work to any new sub-contractor in order that the Account Holder can determine if that contractor can fulfil all the data protection obligations detailed in this Agreement and the UK GDPR;

3.16 Transfer of data

• For clubs outside of India we will not transfer any personal data outside Europe other than in the circumstances detailed in the main Terms and Conditions at the time of signing (see 3.12, 3.15 and full list of subprocessors) unless there are suitable safeguards in place for the transfer of the personal data
• For clubs within India we will not transfer any personal data outside India other than in the circumstances detailed in the main Terms and Conditions at the time of signing (see 3.12, 3.15 and full list of subprocessors) and for the purposes of supporting and onboarding our customers based within India

3.17 keep records of processing activities in accordance with Article 30.2 of the UK GDPR;

4. ClubManager acknowledges and agrees that the Account Holder retains all rights, title and interest in the personal data, including any copyright and database rights. If ClubManager creates any intellectual property rights in the course of providing the services to the Account Holder, ClubManager hereby assigns such intellectual property rights to the Account Holder with full title guarantee, free from third party rights and for the full term during which those rights and any renewals or extensions subsist.

5. ClubManager will allow its data processing facilities, procedures and documentation which relate to the processing of the personal data to be scrutinised by the auditors of the Account Holder and/or their employees or agents, in order to ascertain compliance with the terms of this agreement and the UK GDPR 2018, providing that this scrutiny is agreed in advance with ClubManager.

6. This Agreement shall be governed by and construed in accordance with English law and each party hereby submits to the non-exclusive jurisdiction of the English courts.

7. This Agreement shall be fully executed by the parties' authorised representatives on the date of signing the main contract.