Stratford Town FC — Privacy Notice

Last updated: 30 April 2026

1. Who we are

Stratford Town FC (“we”, “us”) is the data controller for the personal information we collect when you buy tickets, contact us, or sign up to hear from us. Our website and ticketing platform are operated for us by Chairman AI Ltd, who acts as our data processor under a written processor agreement (UK-GDPR Article 28).

If you have any questions about this notice or want to exercise your rights, please contact the club directly using the contact details on their main website or official social media channels. We will respond to your request within one calendar month, as required by UK-GDPR.

2. What we collect

When you buy tickets or sign up for news from us, we may collect:

• Your name
• Your email address
• Your phone number (optional)
• Your postcode (optional)
• Your payment details (handled directly by Stripe — we never see or store your card number)
• Your consent choices (whether you agreed to data processing and whether you opted in to marketing emails), with the time you made each choice
• Records of emails we send you and basic engagement events (whether the email was delivered, opened, clicked, bounced, or unsubscribed)

If you or your child plays for us

This notice used to say we did not knowingly collect data about anyone under 13. That was never true of a club that runs junior teams, and it has been corrected. For every player registered with us — including children — we hold:

• Their name, date of birth and home address
• A parent or guardian’s name, email address and phone number
• Emergency contact details, and any medical conditions, allergies or dietary needs you tell us about — so that whoever is with your child can act if they are hurt or unwell
• The team they play for, their shirt number, attendance and availability
• Whether you have agreed to us photographing them and using those photographs, recorded with the date and who recorded it

Who can see it. Your own team’s coaches can see the medical notes and emergency contacts they need at the side of a pitch. They cannot see your home address or date of birth, and they cannot see any child outside their own team at all. Club managers and admins can see the full record.

Photographs. We do not use a child’s face in anything we publish unless we hold a recorded consent for that child. You can withdraw it at any time and we will stop.

If you want to see, correct or delete anything we hold about your child, contact us and we will respond within one calendar month.

3. Why we collect it (lawful basis)

Performing our contract with you

When you buy a ticket, we use your name, email, phone, postcode and payment details to take the payment, send your ticket, manage entry on the day, and contact you if there’s a problem with the event.

Your consent

If you tick the marketing opt-in, we use your email to send you news about future events and the club. You can withdraw this consent at any time — every marketing email contains a one-click unsubscribe link, and you can also email us to ask to be removed.

Running our teams

For player records we rely on our legitimate interest in running a football club: we cannot pick a team, arrange training, or contact a family about a fixture without knowing who plays for us and how to reach them.

Medical and dietary information is different. Health data carries extra protection in law, so we rely on your explicit consent when you give it to us, and on protecting someone’s vital interests where a coach needs to act in an emergency. You are never obliged to tell us — but if you don’t, we cannot act on it.

Photographs of children are used only where we hold a recorded consent from a parent or guardian for that child.

Our legitimate interests and legal obligations

We keep records of orders for accounting and tax purposes (HMRC requires us to keep financial records for 6 full tax years plus the current year). We also keep brief records of marketing emails so we can demonstrate that consent was given and respected.

Payment processing and purchase records

When you purchase tickets, your payment is processed by Stripe on behalf of your club. We receive confirmation of payment but your card details are never stored by or transmitted to ChAIrman AI.

We retain a record of ticket purchases to fulfil your order, provide customer support, and comply with financial record-keeping obligations (typically 6 years). Your name, email, and purchase details form part of the club’s supporter records.

Even if you request erasure of your personal data, we are required to retain anonymised financial transaction records for legal compliance. Your name and contact details will be removed but the transaction amount and date will be retained.

4. Who we share it with

We use a small number of trusted processors to run the platform. Each is bound by a written processor agreement and handles your data only on our instructions:

• Stripe Payments UK, Ltd. — processes your card payment. Stripe is the controller for fraud-prevention purposes; for the payment itself it acts as our processor. See stripe.com/gb/privacy.
• Resend, Inc. (United States) — sends our transactional and marketing emails. Transfers are protected by the UK’s International Data Transfer Addendum to the EU Standard Contractual Clauses.
• Supabase, Inc. (data hosted in the European Union) — runs the database and authentication. Where any support work touches data from the United States, transfers are covered by Standard Contractual Clauses.
• Vercel, Inc. (United States) — hosts the website, and provides the cookieless page-view and page-speed measurement described in section 7. Standard Contractual Clauses apply.

We do not sell your data to anyone, and we don’t share it with any other organisation for their own marketing.

5. How long we keep it

• Orders, tickets and refunds: 7 years from the date of the order, to meet HMRC record-keeping requirements.
• Your contact record (if you opted in to marketing): until you unsubscribe or ask us to delete it, then a minimum residual record of your unsubscribe request is kept for 2 years to make sure we honour it.
• Email send/open/click records: 12 months, then deleted.
• Privacy / deletion request audit trail: 6 years, to demonstrate compliance.
• Player records (including children): for as long as the player is registered with us, and then to the end of the following season so that we can settle subscriptions, return kit and answer questions about the year just gone. After that we delete the record. Medical and dietary notes are deleted as soon as the player leaves. You can ask us to delete a record sooner at any time.

6. Your rights

Under UK data protection law you have the right to:

• Access the personal data we hold about you.
• Correct data that’s wrong or incomplete.
• Erase your data (the “right to be forgotten”), subject to our obligation to keep certain financial records.
• Restrict or object to our processing.
• Withdraw consent for marketing emails at any time.
• Data portability — receive a copy of your data in a structured, machine-readable format.
• Complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk/concerns or by phone on 0303 123 1113. We’d ask you to contact us first so we can try to resolve any issue, but you don’t have to.

To exercise any of these rights, email us at the address above. We’ll respond within one calendar month.

7. Cookies and analytics

This site uses only the strictly-necessary cookies required to keep you signed in (if you have a club admin account) and to remember which club site you’re visiting. We do not use advertising cookies, and we never sell or share your data with advertisers.

We do measure how the site is used, through two tools run by Vercel, who host this site: Web Analytics counts page views and where visitors arrived from, and Speed Insights measures how quickly pages load on real devices. Both are cookieless — they store nothing on your device. To count returning visitors without a cookie, Vercel turns your IP address and browser type into a scrambled identifier that cannot be traced back to you and is discarded each day. Neither tool builds a profile of you, and neither follows you to other websites.

We ask before we do any of this. The first time you visit, a banner asks whether we may count your visit, with “No thanks” sitting right next to “Yes” and just as easy to press. If you decline, the measurement software is never loaded at all — it isn’t switched on and ignored, it simply doesn’t run. The cookies that keep you signed in and remember which club you’re visiting stay either way, because the site cannot work without them.

You can change your mind at any time using the Cookies link at the bottom of any page. Your answer is remembered in your own browser, not on our servers, so it’s specific to that device.

8. Security

We use row-level security on our database, encrypted connections, and processor agreements with all our suppliers. Card details never reach our servers — Stripe handles them. If a data breach affected your personal information, we’d notify the ICO within 72 hours and contact you directly if there was a risk to your rights.

9. Changes to this notice

If we make material changes to how we handle your data, we’ll update this page and the “last updated” date at the top. For substantial changes we’ll also email anyone on our marketing list.