LEGAL

Privacy Policy

LAST UPDATED · 31 AUGUST 2026

1. Who we are

Festival Manager is a trading style of seatofthepants.net ltd, a company registered in England and Wales (company number 04767792) with its registered office at 25 Alwyn Road, Maidenhead, Berkshire, SL6 5EG.

For personal data about account holders and visitors to this site, we are the data controller. For entrant data that a host club collects through its festival pages, the club is the controller and we process that data on its behalf. Questions about this policy, or requests about your data, go to [email protected].

2. The data we collect

• Account and role data. Your name, email address, club, and the festival roles you hold or grant to others. We sign you in with an emailed magic link, so your email address is central to your account.
• Entry data. When a team enters a festival: the entering contact's name and email, club and team details, and the competition entered. This is collected for the host club.
• Player and squad data. Clubs can optionally record a squad list against an entry — a display name per player (whatever name the club wants on the team sheet; first names or nicknames are fine) and a check-in status. That is all: we do not collect dates of birth or any other player details. Because festivals are typically youth sport these names may relate to children, so they are entered by clubs for the day itself, processed only on the club's behalf (see section 4), and deleted automatically within a week of the festival.
• Payment data. Payments are processed by Stripe; we never see or store card numbers. We keep transaction records — amounts, fees, refunds and payout status.
• Festival content. Fixtures, scores, team names, sponsor material and anything else a club publishes on its festival pages.
• Technical and usage data. IP address, browser type and pages visited, from server logs and our own first-party analytics, plus Google Analytics where it is enabled (see cookies, below).

3. How we use it

• To provide the Service — running accounts, entries, payments, fixtures and live scores (performance of a contract).
• To keep the Service safe and make it better — security monitoring, debugging, and understanding how the Service is used (legitimate interests).
• To meet legal obligations — keeping accounting and transaction records.
• To contact you about the Service — magic links, receipts, and important notices about your festivals or these policies. We do not send marketing email unless you have asked for it, and we never sell personal data.

4. Children

Accounts and entries are made by adults, and the public parts of the Service — fixtures, scores, festival pages — run on team-level information: club names, age groups and results, not players' names.

Where a club chooses to record player details (see "Player and squad data" above), the club is the data controller for that data, including where it relates to children, and is responsible for having a lawful basis for collecting it, for being transparent with players and their parents or guardians, and for following its governing body's safeguarding guidance. We act only as the club's processor: we store the data, show it to the signed-in people managing the entry and running the festival, and do not use it for our own purposes — never for marketing or profiling, and it is not published on public pages.

The Service is built to hold as little as possible here: a squad entry is a display name only — a first name or nickname is fine — with no dates of birth or other details, clubs can edit or delete player records at any time, and every player record is deleted automatically within a week of the festival taking place.

5. Who we share data with

We share data only with the providers we need to run the Service:

• Stripe — payment processing and payouts (Stripe is a controller of the payment data it processes; see Stripe's own privacy policy).
• Postmark — sending transactional email such as magic links and receipts.
• Railway — hosting our application and databases.
• Google Analytics — aggregate usage statistics, where enabled.

The host club sees the entry data submitted for its festival. We may also disclose data where the law requires it, or as part of a sale or reorganisation of our business (in which case this policy continues to apply).

6. International transfers

Some of our providers process data outside the UK. Where they do, we rely on their UK-recognised safeguards — adequacy decisions or standard contractual clauses — as set out in their data processing terms.

7. How long we keep it

• Account data: while your account is active, then deleted or anonymised within a reasonable period after closure.
• Player and squad data: deleted automatically within a week of the festival taking place; clubs can also delete player records at any time before that.
• Transaction records: up to six years, to meet accounting and tax obligations.
• Server logs and analytics: kept only as long as needed for security and reporting.

8. Cookies

The Service uses a small number of cookies: an essential session cookie to keep you signed in, first-party analytics cookies that help us see how the Service is used, and Google Analytics cookies where enabled. We do not use advertising cookies.

9. Your rights

Under UK data protection law — the UK GDPR and the Data Protection Act 2018 — you can ask us for access to, correction of, or deletion of your personal data; ask us to restrict or object to processing; and ask for your data in a portable format. Email [email protected] and we will respond within a month. Where we process entrant or player data for a club, the club is the controller and we may pass your request to it — a parent or guardian can also ask the club directly to correct or remove a player's record.

You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

10. Changes to this policy

We may update this policy from time to time. If we make a material change we will notify account holders by email or through the Service. The date at the top shows when it last changed.