Data processing terms
Last updated 27 October 2026
These terms are the agreement required by Article 28 of the UK GDPR between each club that uses Medley (the controller) and Medley (the processor). They form part of our terms of use and apply while the club uses Medley.
1. The processing
| Subject matter and purpose | Providing Medley to the club: membership, swimmers, meet entries and fees, safeguarding and qualification records, club communications and online payments. |
| Duration | While the club uses Medley, plus up to 90 days afterwards to return and delete information. |
| People concerned | The club's members, parents and guardians, swimmers (including children), coaches, officials, volunteers and committee members. |
| Types of information | Names and contact details; dates of birth and gender; membership numbers; squads, times and meet entries; fees and payment records; club messages; health information (medical notes, allergies, disability or additional needs) and emergency contacts; records that safeguarding checks (DBS / PVG) were done, never their content. |
2. What Medley agrees to do
- Process the club's information only on the club's documented instructions (these terms and the club's use of Medley), unless the law requires otherwise, in which case we'll tell the club first where we can.
- Make sure everyone who can access it is bound by confidentiality.
- Keep it secure with appropriate technical and organisational measures: encryption in transit and at rest, access controlled by club and role and checked on our servers, tested access rules, and limited staff access.
- Use other processors (sub-processors) only as listed below, under written terms that protect the information to the same standard, and tell the club at least 30 days before adding or replacing one so it can object.
- Help the club respond to people exercising their data protection rights.
- Help the club with its security, breach-reporting and data protection impact assessment duties, as far as they relate to Medley.
- Tell the club without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting its information, with the details the club needs.
- When the club leaves, let it export its information, then delete it within 90 days, unless the law requires us to keep it.
- Give the club the information it reasonably needs to show compliance with Article 28, and allow reasonable audits on 30 days' notice.
3. What the club agrees to do
- Have a lawful basis for the information it records in Medley, and give its members the privacy information the law requires.
- Give access only to people who need it, in appropriate roles, and remove access when someone leaves.
- Tell us promptly if it believes its information is being misused.
4. Sub-processors
| Sub-processor | What for | Location |
|---|---|---|
| Google Cloud and Firebase (Google Ireland / Google LLC) | Hosting, database, sign-in, file storage, push notifications | EU (Netherlands); some sign-in and notification services global |
| Resend | Invitation and notice emails | United States |
A club's own Stripe and GoCardless accounts are the club's relationships with those providers, not Medley sub-processors.
5. International transfers
Information transferred outside the UK is protected by UK adequacy regulations or the UK International Data Transfer Addendum to the EU standard contractual clauses.
6. Contact
For anything about these terms, a data protection request or a security concern, email contact@medleysports.app.
Questions about this page? Email contact@medleysports.app.