Privacy policy

What we collect, and why

If you create an account: your name, email address and a securely hashed password, how you heard about us if you choose to say, plus, for organisers, the organiser and event details you choose to publish. If you send an enquiry about an event: the name, email, optional phone number, team name, age group and message you enter. We also keep a salted, one-way hash of the network address an enquiry came from. We use it only to limit spam and abuse, never displayed, and not reversible to your address.

Asking a coach for a session

If you ask a coach for a session from their page: your name, email address, the session, date and time you ask for, the player's age group if you give it, where you would like the session, and any message you write. We record when you confirmed you are the parent or guardian, or an adult player. We do not ask for or store the player's name. Your request goes to that coach so they can accept or decline it and reply to you; our administrators can see it for support. We also keep a salted, one-way hash of the network address the request came from, used only to limit spam and abuse, never displayed, and not reversible to your address.

Asking a club about a place

If you use the form on a club's page, we keep your name, your email address, the age group, experience and level you chose, and your message. Our team reads it first, then passes it to the club's public email address, with your email address, so the club can reply to you. We may decide not to pass a message on. We delete it six months after you sent it. We also keep a salted, one-way hash of the network address your message came from, used only to limit spam and abuse, never displayed, and not reversible to your address.

Coaches' credentials and documents

If you list your coaching: the credentials you enter about yourself (your DBS check type and issue month, whether you are on the Update Service, your coaching qualifications, first aid, safeguarding course and insurance renewal dates), when you confirmed they are true, and any documents you upload, such as certificates, insurance or references. Your credentials are shown on your public page as added by you and not checked by us. Your documents are shown only to people signed in to FindMeFootball; each is labelled as uploaded by you. A DBS certificate is shown either to everyone signed in or only to people you approve, as you choose; a person who asks gives us their account name and email address for you to decide on, and we record your answer. A DBS certificate is deleted two years after you upload it, and we email you a month before. You can remove any document, or clear any credential, from your console at any time, and your documents are deleted with your listing. We email you before a renewal date you entered runs out. We do not check certificates and we never state that we have.

Messaging a coach or club

If you message a coach or a club from their page, or they reply to you: the messages you each write, when they were sent and read, and your account name and email address as they see them. Before your first message we ask you to confirm you are aged 18 or over, and we record when you did. We do not ask for or store a child's name, and the form asks you not to include one. Messages stay on the site: the email that tells you there is a message carries a link and never the text. Conversations are kept, including ones either person has muted or blocked. Our administrators can read any conversation. We read one if either person reports it, a concern is raised, or we need to look into misuse of the site. We keep a conversation for two years after its last message, then delete it. If either person reported it, or a concern was raised about it, we keep it for as long as we keep that report. If you ask us to delete your account, we remove your name and email address from your conversations, and the messages themselves are deleted on the same timetable. We also keep a salted, one-way hash of the network address each message came from, used only to limit spam and abuse, never displayed, and not reversible to your address.

Your account preferences

If you save a postcode, travel distance or the age groups you're interested in, we use them only to show and email you relevant tournaments. They describe your interests, not your child. We don't ask for or store children's names, dates of birth or profiles. Preferences are never shown publicly, never shared, and you can edit or delete them at any time on your account page.

Who sees your details

An enquiry goes to the organiser of that event so they can reply to you, and is visible to our administrators for moderation and support, and no one else. We don't sell personal data, and we don't share it with other organisers or advertisers.

Photos of players added by clubs

A club can add a photo of its players to an advert or a noticeboard post. Before it does, the club must confirm it has written consent from the parents of every child in the photo. Clubs must not name the children in these photos. These pages are public and can appear on Google. We look at every photo after it goes live and take down anything that looks wrong. If you are a parent and want a photo of your child removed, use the 'Is this your child?' link under the photo and it comes down when you send it. If you use that form, we keep your request, including your email address, for 90 days after we have dealt with it, and then delete it. Or email safeguarding@findmefootball.com and we remove it as soon as we see your email. We delete the photo from our systems within 30 days of the advert or post ending.

Children's information

The platform does not create public profiles of children and is not designed for children to use. Photos of players appear on public pages only where a club has added them under the rules above.

If you report a concern

What we collect: whatever you choose to put in the form: the category, your message, and, if you fill them in, your name, your email address and which listing or page your concern is about. Contact details are optional, because a concern about a child has to be reportable by somebody who would rather not be identified. If you started from a listing page, we also record which one. And we keep a salted, one-way hash of the network address the report came from, used only to limit abuse of the form: it is never displayed and cannot be turned back into your address.

Why we can hold it: protecting children is a legitimate interest, and it is why this route exists at all. Where a report suggests somebody is at immediate risk, we may also rely on protecting a person's vital interests. Where a report contains sensitive information about someone's health, or an allegation of a criminal offence, we handle it under the safeguarding provisions of UK data protection law, which allow it where it is necessary to protect a child.

Who sees it: a small, named group: our administrators, our Welfare Officer, and one safeguarding adviser outside FindMeFootball, described below. Nobody else. Your report is not published, and it is never sent to the club, organiser or person it is about. When one arrives we email that group, and that email contains nothing you wrote: not your message, not the listing or page you typed in, not your name. It says a report has come in, in which category, which of our listings it concerns if you started from one, whether you gave your name, and where to read it.

How they read it: your words stay in our system, and there are two ways in. An administrator signs in. Everyone else gets a personal link, sent with the alert. It opens that one report and no other, works for a limited time, can be withdrawn by us at any point, and records who opened it and when. We do this instead of putting your report in an email, because an email cannot be taken back.

One of those people is outside FindMeFootball, and it is worth being plain about what that means. While we are getting established, a named safeguarding adviser at a separate organisation holds one of those links, so that a report is not left unread if the other two are unavailable. They can open your report and read it in full, including your name and email address if you gave them. They cannot see any other report, and we can withdraw their access at any time. This is internal cover only, and we will say so here when it ends.

Who else we may tell: where a concern needs it, we pass it to the police, a local authority's children's services, the NSPCC, the club's County FA, or the local authority's Designated Officer. We will do that without asking you first where a child may be at risk. That is the point of the route, and we would rather tell you plainly here than surprise you later. Your details are never given to the person you are reporting.

How long we keep it: safeguarding records are kept longer than ordinary enquiries, because a single report can matter years later as part of a pattern nobody could see at the time. We keep them for 7 years from the date of the report, then delete them, unless they are part of an ongoing matter or we are required to keep them longer.

Your rights: you can ask what we hold about you, and ask us to correct it. Email hello@findmefootball.com. We may not be able to delete a safeguarding record on request, and we would rather be straight about that than promise otherwise: a record about a child's welfare may need to be kept even when the person who made it would prefer it gone. Where we refuse, we will explain why. You can complain to the Information Commissioner's Office at any time.

Finding clubs near you

If you browse clubs without entering a postcode, we order them by distance from the rough area your network address suggests, usually a town or city and sometimes wrong. We use it only to decide that order, and we say on the page which area we guessed so you can correct it. It is never stored, never attached to your account, and never used for advertising. Enter a postcode at any time to search from where you actually are.

Cookies

We use an essential session cookie to keep you signed in. We don't run advertising or cross-site tracking cookies.

Page views

We count page views on event listings anonymously, to show organisers how their listing is doing. We use no cookies and no personal data, just a daily number of views per event page. We also keep anonymous daily tallies of feature usage (searches, schedule follows) with the same rule: no record of who did what. We can't tell who viewed a page or link anything back to a person. We also use Vercel Web Analytics, from our hosting provider, to count visits to the site as a whole: which public pages are viewed, the website a visitor came from, and their country, device and browser. It uses no cookies and does not identify you. We never send it search terms, postcodes or any page from a signed-in area.

Email alerts

If you set up an alert, we store your email address and what you asked to hear about. For a tournament alert, that is the filters you chose. For a coach or camp alert, it is your postcode and, if you give one, an age group. If you asked us to tell you when part of the site opens, it is that choice and, if you gave one, your postcode. We use these only to send the alerts you asked for. Your postcode is used only to find listings near you. It is never shown publicly, never passed to coaches, camp providers or anyone else, and never used for advertising. Alerts only start after you confirm your address, every email has a one-click unsubscribe, and unsubscribing stops them immediately.

How long we keep things

Account and event data stays while your account is active. Enquiries stay while the organiser needs them to manage their event. If you set up an email alert without an account and then unsubscribe, we delete that alert, with your email address and postcode, 30 days after you unsubscribe. A saved search on your account stays until you delete it or your account. If you'd like something corrected or deleted, ask. See below.

Your choices

To access, correct or delete personal data we hold about you, email hello@findmefootball.com and we'll deal with it promptly. Safeguarding reports are the one exception. See "If you report a concern" above.