Privacy notice

1. Who is responsible for your information

Your swimming club decides what it records about its members and swimmers and why. For that information the club is the data controller, and Medley is its data processor: we store and process it only on the club's instructions, under our data processing terms. Questions about what your club holds, or requests to see or correct it, are best sent to your club first; we'll help them respond.

Medley is the data controller for the information we need to run Medley itself: your sign-in account, our website, service emails, support requests and clubs' billing with us.

Contact Medley at contact@medleysports.app.

2. What we hold

Medley doesn't hold home addresses, and doesn't use your information for advertising, profiling or automated decisions about you.

3. Why it's used, and the lawful basis

• Running the club: membership, squads, meet entries, fees and club messages. The club relies on its legitimate interests in running a swimming club, or its contract with members.
• Safeguarding records: so the club can show its coaches and volunteers meet its governing body's safeguarding requirements (Swim England's Wavepower, Swim Wales and Scottish Swimming policies). The club relies on its legitimate interests and, where relevant, the substantial public interest condition for safeguarding children and individuals at risk (Data Protection Act 2018, Schedule 1, paragraph 18).
• Medical and emergency details: to keep swimmers safe at training and meets. These are given by the swimmer's parent or guardian with their explicit consent, or used to protect a swimmer's vital interests in an emergency.
• Your Medley account, service emails and support: Medley's legitimate interests in providing a secure, working service, and our contract with the club.
• Billing clubs for Medley: our contract with the club, and our legal obligations to keep financial records.

4. Who can see it

Inside a club, access depends on a person's role:

• Parents see their own account and their own swimmers.
• Medical and emergency details: the Welfare Officers, coaches, team managers, the Club Secretary and the swimmer's own parents.
• Safeguarding checks: the Executive Committee (Chair, Vice Chair, Treasurer, Secretary) and the Welfare Officers. Everyone can see their own.
• Payments: the person who paid, and those who manage meet fees.
• Clubs can never see each other's information.

Medley staff access club information only to support the club or keep the service running and secure.

We use these suppliers to run Medley:

Where information leaves the UK, it's protected by the UK's adequacy regulations or the UK International Data Transfer Addendum to the EU standard contractual clauses.

When a club takes payments online, parents pay the club through the club's own Stripe or GoCardless account. Stripe and GoCardless process those payments for the club under their own privacy notices. We never sell information, or share it for marketing.

5. Children

Swimmers don't have Medley accounts: their parents or guardians manage their details. Clubs only record what they need for training, competition and safety. We take particular care with children's information: it's visible only to the swimmer's parents and the club roles listed above.

6. How long it's kept

• Club information is kept while the club uses Medley and the person is a member. Clubs can remove someone's information, or ask us to, at any time.
• Safeguarding records are deleted automatically when someone leaves the club in Medley, and club officers can delete them sooner.
• When a club stops using Medley, its information is deleted within 90 days, after giving the club the chance to export it.
• Your Medley account is kept until you or your club close it. Billing records are kept for six years, as UK tax law requires.
• Server logs are kept for up to 30 days.

7. Keeping it secure

Information is encrypted in transit and at rest. Access is checked on our servers for every request, by club and by role, and those rules are tested before every release. Passwords are never stored in readable form. If something goes wrong that puts your information at risk, we'll tell your club straight away so you can be told where needed, and report it to the Information Commissioner's Office when the law requires.

8. Your rights

You have the right to:

• ask for a copy of your information;
• have it corrected if it's wrong;
• have it deleted, or its use restricted, in some circumstances;
• object to its use where it's based on legitimate interests;
• withdraw consent (for example, for medical details) at any time;
• receive information you gave in a portable format.

Parents and guardians can exercise these rights for their children. Under My account you can correct your details, download a copy of everything Medley holds about you and your swimmers, and ask your club to delete your account. The club may need to keep some records first, such as unpaid fees or safeguarding records, and will tell you why. For anything else, contact your club, or us at contact@medleysports.app. We'll respond within one month.

If you're unhappy with how your information has been handled, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

9. Cookies

Medley uses only the cookies and similar storage it needs to work, such as keeping you signed in. There's no tracking or advertising. See our cookie policy.

10. Changes to this notice

We'll update this notice when what we do changes, and tell clubs about significant changes before they take effect. The date at the top shows when it last changed.