Privacy policy

1. Who we are

Pitch Perfect is a trading name of Nation FC Ltd, a company registered in England and Wales (company number 15669540), with its registered office at Expressway, 1 Dock Road, London, England, E16 1AH. Where this policy refers to we, us or our, it means Nation FC Ltd.

For most of the personal data in the platform, your football club is the data controller and Pitch Perfect is the data processor acting on the club's instructions. The club decides what data is collected and why; we process it to provide the service. For our own business records, such as the accounts of club staff and our billing, we act as a controller.

2. The data we process

Depending on how a club uses Pitch Perfect, we may process:

• Club staff details: name, email address, role and sign-in information.
• Player details: name, date of birth, team and age group, shirt number, and notes a coach records.
• Guardian details: name, email address, mobile number, preferred contact channel and language.
• Audio recordings made by coaches, and the transcripts produced from them.
• The development reports generated, edited and approved by coaches.
• Delivery and access records, such as when a report was sent and opened.
• Limited technical and usage data needed to run and secure the service.

3. Children's data

Much of the data in Pitch Perfect relates to children. Children's personal data is given heightened protection under UK law. We minimise what we hold, restrict who can see it, and exclude sensitive and safeguarding-related content from anything sent to a parent.

We do not knowingly create accounts for children. Parents and guardians do not create accounts at all; they access reports through secure links.

4. How and why we use it

We process personal data in order to:

• Transcribe coaches' voice notes and draft development reports.
• Let coaches review, edit and approve reports before they are sent.
• Detect potential safeguarding concerns and route them to the club's Designated Safeguarding Officer.
• Deliver approved reports to guardians by their chosen channel and in their chosen language.
• Keep clubs' accounts, branding and settings, and provide support.
• Secure the service, prevent abuse, and meet our legal obligations.

5. Lawful basis

The club, as controller, is responsible for the lawful basis for processing players' and guardians' data. This is typically the consent of a parent or guardian, recorded within the platform. Special-category data is handled only where an appropriate condition applies, and is kept out of parent-facing reports.

For our own processing as a controller, such as managing club staff accounts and billing, we rely on the performance of our contract with the club and our legitimate interests in running the service.

6. Service providers we use

We use a small number of trusted providers to deliver the service. Each processes data only as needed:

• Hosting and database: Supabase and Vercel.
• Speech to text and report drafting: OpenAI (and, where configured, Anthropic).
• Email delivery: Resend.
• SMS and WhatsApp delivery: Twilio.
• Error monitoring: Sentry.
• Payments: Stripe.

Data sent to our speech-to-text and language model providers is not used to train their models.

7. Where data is processed

Some of our providers may process data outside the United Kingdom, including in the United States. Where that happens, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. We keep the basis for each transfer documented.

8. How long we keep it

We keep personal data only for as long as it is needed for the purposes above, or as the club instructs, after which it is deleted or anonymised. Audio recordings are kept only as long as needed and then securely deleted. Retention periods are configurable and are described further in our agreement with each club.

9. Your rights

Individuals have rights over their personal data, including the right to access, correct, erase, restrict or object to processing, and to data portability. Because the club is usually the controller, requests are normally handled through the club; we support clubs in responding to them.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

10. Security

We use technical and organisational measures appropriate to the sensitivity of the data, including strict separation between clubs, access controls, encryption in transit, private storage for audio, and audit logging of sensitive actions.

11. Contact us

For privacy questions, contact us at info@nationfootballclub.co.uk. If you are a parent, your club is usually the best first point of contact.