Privacy policy

• Your club decides what goes into RinkTracker about its players. For that data the club is the controller and we are its processor.
• We never sell personal data, never show adverts, and never use children's data to market anything.
• Club data is stored in London and kept separate for each club. Children are never ranked against each other.
• This website sets no optional cookies unless you say yes. The only cookie it sets without asking remembers your choice.
• You can ask to see, correct or delete your data at any time, and you can complain to the ICO.

RinkTracker is a product of EIH Stats, a UK business, at Digital Media Centre, The Seam, County Way, Barnsley, S70 2JW. In this policy “we” and “us” means EIH Stats. We are registered with the Information Commissioner's Office, number ZC273973.

You can contact us about anything in this policy at hello@rinktracker.com. We have not appointed a Data Protection Officer because the law does not require one for us, but this address reaches the person responsible for data protection.

When we are the controller. For people who use this website, send us an enquiry, or sign a club up, and for the account details we need to run the service (your name, email and sign-in records), we decide how the data is used, so we are the controller.

When your club is the controller. For player development records (scores, goals, coach notes, reports, attendance, video, medical and emergency details, SEND support, safeguarding records) the club decides what to collect and why. The club is the controller and we process that data only on its written instructions, under a data processing agreement the club accepts before any child's data goes in. Questions about that data, including requests to see or delete it, should go to your club first; we will help them answer.

Enquiries. If you use the demo or pricing form we receive your name, email address, club, role at the club, roughly how many junior players it has, and your message. We use it to reply, send a price or arrange a demo. Our lawful basis is legitimate interests: answering people who contact us. We don't add you to a mailing list.

Server logs. Like every website, our hosting provider records technical details of each request (IP address, browser, the page asked for and the time) to keep the site running and secure. These logs are kept for a short period and are not used to identify you. Lawful basis: legitimate interests in security.

Cookies. See our cookie policy. Nothing optional is set unless you agree.

The RinkTracker app at app.rinktracker.com holds, on the club's behalf:

• Players: name, date of birth, team, position, shirt number, photo, attendance, skills scores, goals, practice logged, coach notes and reports.
• Contact and welfare details: home address and emergency contacts; medical conditions, allergies, medication and dietary needs, kept only with a parent's recorded agreement and seen only by club staff and the player's own family.
• SEND support: if a child has special educational needs or a disability, what a parent chooses to tell the coaches (their needs, what helps, what to avoid, how to talk to them and signs they're struggling), and documents such as an EHC plan. Kept only with a parent's recorded agreement. Seen only by the child's own coaches and assistant coaches, the club's head coaches and its welfare officer, and never by team managers, club admins who don't coach, other parents or players.
• Video of games and practice, used only in the ways the family has agreed.
• Staff and parents: names, email addresses, phone numbers and roles; for staff, licence, vetting and safeguarding training records the club keeps.
• A record of who viewed or exported each child's record, so the club can check access.

Medical details and SEND support are special category data under UK GDPR, because they are about a child's health. The app keeps them only when a parent has agreed, and records who agreed and when. A parent can change SEND support or delete it, documents included, at any time from their own account. Every time a member of staff opens the full profile or a document, that is logged.

For our own account data (your sign-in email, the clubs you belong to, sign-in times and security events) our lawful basis is contract (to provide the service you or your club signed up to) and legitimate interests (keeping accounts secure). If you choose “Continue with Google”, Google tells us your name and verified email address, and nothing else.

Most players are under 16, so the app follows the ICO's Age Appropriate Design Code:

• Children under 13 never have their own login; a parent or guardian uses the app for them.
• Players aged 13 and over can have their own login only with a parent's recorded consent, and see only themselves, never coach notes or other players.
• Privacy settings are high by default. There are no leaderboards, no public profiles, no location tracking, no direct messages between adults and children, and no nudges to share more.
• Nothing is profiled for marketing. Goal suggestions follow rules a coach can explain and a coach always decides.

If you are a young player reading this: your club keeps notes about how your hockey is going so your coaches can help you improve. Only your coaches, your club's staff and your family can see them. You can ask your club to show you what they hold about you, or to fix anything that's wrong. If something worries you, talk to your parent or your club's welfare officer.

Where a club turns it on, the app can draft the wording of a report from the coach's scores using an AI model hosted in London. A named coach reads, edits and approves every report before a family sees it. No decision about a child is made by software alone, and the data is not used to train anyone's models.

We use a small number of trusted companies (sub-processors) to host and run RinkTracker, each under a written contract that limits them to acting on our instructions. They are listed, with what they do and where, on our sub-processors page. Clubs are told 30 days before we add a new one.

We share data with nobody else, except where the law requires it (for example a court order) or to protect a child from harm, in line with safeguarding law.

Club data is stored in the UK (London). A few providers are based outside the UK, for example our hosting and video providers in the United States. Where personal data leaves the UK we make sure it is protected to UK standards, using UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the ICO's International Data Transfer Agreement or Addendum.

• Website enquiries: deleted within 12 months if your club doesn't become a customer.
• Questions club staff ask us from Help in the app: two years after the question is closed, then deleted automatically.
• Club data: for as long as the club is a customer and decides to keep it. When a club leaves it can export everything, and we delete it within 30 days unless the law requires otherwise.
• SEND support: until a parent deletes it, or the club erases the child's record. Either way the profile and every document are deleted.
• Earlier versions of edited or deleted notes: kept for two years so a club can see what changed, then deleted automatically.
• In-app notifications: deleted after 90 days. Each club's audit log of who viewed or changed records: two years.
• Sign-in sessions and sign-in links: deleted when they expire.
• Your account: until you delete it, which you can do yourself from your profile. What you wrote into a child's record stays with the club without your name.
• Server logs: kept briefly by our host for security, then deleted.

Each club's data is separated by the database itself, not just the screens. Access follows the person's role and the teams they're assigned to. Data is encrypted in transit and at rest, nobody has a password to steal (sign-in is by email link or Google), and every view and export of a child's record is logged. If a breach affects your data we will tell the club, and where required the ICO and you, without undue delay.

Under UK data protection law you have the right to:

• see the personal data held about you (a subject access request);
• have it corrected if it's wrong, or deleted;
• restrict or object to how it's used, including objecting to anything based on legitimate interests;
• get a copy in a portable format;
• withdraw consent at any time, where we rely on consent (for example cookies), without affecting what happened before.

A parent can make these requests for a child. For player records, ask your club, or email hello@rinktracker.com and we'll pass it on and help. We reply within one month. It's free.

If you're unhappy with how we've handled your data, please tell us first at hello@rinktracker.com. We will acknowledge your complaint within 30 days and tell you what we're doing about it. You can also complain to the Information Commissioner's Office at any time: ico.org.uk/make-a-complaint or 0303 123 1113.

When we change this policy we update the date at the top. If a change affects how a club's data is processed, we tell the club in advance.