Privacy notice for parents, guardians and players

Who we are

North West Elite Academy ("NWEA", "we") is a youth football academy based at Cardinal Heenan Catholic High School, Honeysgreen Lane, West Derby, Liverpool L12 9HZ. For data protection law we are the data controller: we decide what information is collected and what it is used for.

Legal entity: [PHIL TO CONFIRM: full legal name and trading address]. ICO registration number: [PHIL TO CONFIRM once registered].

Questions about your information go to info@nweliteacademy.com or to Phil on 07738 000 581.

Our website, shop and member portal are built and looked after by Criael, a Liverpool web studio, who act as our data processor. Criael only handle information on our instructions and never use it for anything of their own.

The information we collect, and why

When you book a free taster or send an enquiry

Your name, mobile number, email address, the player's first name and age group, and anything you add in the notes box. We use it to reply to you and to arrange the session. Lawful basis: taking steps at your request before entering a contract.

When you create a member portal account

Your name, email address, password (stored only as a secure hash, we cannot read it) and, if you choose to give it, your mobile number. For each player you add: first name, last name, date of birth, age group, whether you give photo consent, and any medical notes you choose to share so the coaches can look after your child properly. We also record the date and version of each consent you give or withdraw, and we keep an audit log of changes to player records so we can show who did what and when.

Lawful basis: performing our membership contract with you. Medical notes are special category data; we rely on your explicit consent for those, and you can leave the box blank. Photo consent is a separate, optional consent per player, and you can change it at any time in the portal.

When you order from the club shop

Your name, email, phone number, delivery or collection address, what you ordered and how much you paid. Card details go straight to Stripe; we never see or store your card number. We use the order information to fulfil the order, tell you when it is ready, and keep the accounts in order. If you also have a portal account, the order appears under "My orders". Lawful basis: performing a contract, and a legal obligation to keep financial records.

Notices and club emails

We email portal members about things that affect their child's sessions: pitch changes, cancellations, tournament dates, safety information. Lawful basis: our legitimate interest in running the academy safely, which you would expect as a member. You cannot opt out of safety and session notices while your child is a member, but you can close the account at any time.

Marketing emails (camps, kit offers, academy news) are only sent if you tick the marketing box in the portal. Lawful basis: consent. Untick the box or use the unsubscribe link to stop them.

Photos and video

We take photos and short clips at training nights, academy games and camps for our website, Instagram and the gallery. We only include a child where the parent has given photo consent for that player. If you withdraw consent we stop using new images of your child and remove existing ones from places we control as soon as we reasonably can.

Website visits

This site does not use advertising cookies or tracking analytics. The member portal stores a sign-in token in your browser so you stay signed in; that is strictly necessary for the portal to work and is removed when you sign out. Our hosting provider keeps standard server logs (IP address, pages requested, time) for security and to keep the site running.

Who sees your information

• NWEA coaches and admin. Coaches see the players in the groups they coach, including medical notes and emergency contact details. Admin staff see all member records. Admin access is limited to named people with their own accounts.
• Criael (processor): builds and maintains the site, shop and portal, and may see data while fixing a problem or supporting us. Bound by a data processing agreement.
• Supabase hosts the portal database, sign-in service and private document storage in their London (United Kingdom) region.
• Netlify hosts the website, enquiry forms, shop order records and the functions that run behind them.
• Stripe processes shop payments. Stripe is its own controller for your card data; see Stripe's privacy policy.
• Google Workspace provides our email (info@nweliteacademy.com) and is used to send notices and order emails.

We do not sell personal information and we do not share it with anyone else unless the law requires it or there is a safeguarding concern, in which case we follow our safeguarding policy and may share with the relevant authorities.

Where your information is kept

The portal database and documents are stored in the United Kingdom. Some of our providers (Netlify, Stripe, Google) may process data in the United States or elsewhere under UK-approved safeguards such as the UK International Data Transfer Agreement or the UK extension to the EU-US Data Privacy Framework.

How long we keep it

• Enquiries and taster bookings: 12 months after the last contact, then deleted.
• Member portal account and player records: while your child is a member, then 2 years after they leave, so we can answer questions about their time with us. Medical notes are deleted when the player record is deleted.
• Consent records: kept for as long as the related player record plus 2 years, so we can show what was agreed and when.
• Shop orders and payment records: 6 years after the end of the tax year, as HMRC requires.
• Photos and video: while we use them; removed on withdrawal of consent as described above.
• Audit logs and server logs: up to 12 months.

You can ask us to delete your account sooner. We will do so unless we are legally required to keep something (for example, order records).

Your rights

You have the right to ask for a copy of the information we hold about you and your children, to have it corrected, to have it deleted, to restrict or object to how we use it, and to take it elsewhere in a usable format. Where we rely on consent you can withdraw it at any time without affecting anything done before you withdrew it.

In the member portal you can see and edit most of this yourself. For anything else, email info@nweliteacademy.com. We reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, though we would rather you gave us the chance to put it right first.

Keeping it safe

Everything travels over encrypted connections. The portal is built so that a parent can only ever see their own family's information, enforced in the database itself rather than just on the page. Private documents are shared through links that expire after ten minutes. Admin accounts are being moved to two-step sign-in before the portal opens to all members. If we ever suffer a data breach that puts you at risk we will tell you and the ICO within 72 hours.

Players' accounts

Players under 13 do not get their own login; a parent or guardian holds the account. Players aged 13 to 17 may be given a restricted login in future, only with a parent's agreement, and we will update this notice before that happens.

The short version, for players

Your parent or guardian tells us your name, your age and anything the coaches need to know to keep you safe. The coaches can see it. Other families cannot. We might take photos at training for the website and Instagram, but only if your parent says that is okay, and you can ask us to take a photo down. If you ever want to know what we have about you, ask your parent to email us and we will show you.

Changes to this notice

If we change how we use personal information we will update this page and change the version number at the top. For anything significant, portal members will get a notice in the portal and by email.