Grassroute Privacy Policy

1. Who we are

Grassroute is operated by kadoH Ltd (company number 14751469), a company registered in England and Wales. In this Privacy Policy, references to “Grassroute”, “we”, “us” and “our” mean kadoH Ltd unless stated otherwise.

For the purposes of UK data protection law, kadoH Ltd is the controller of personal data processed through the Grassroute website and platform, except where this policy states otherwise.

Contact for privacy matters: contact@grassroute.co.uk. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

2. Scope of this policy

This policy explains what personal data we collect, how we use it, who we share it with, how long we keep it, and the rights available to individuals under applicable UK data protection law.

Grassroute is built to minimise personal data where possible. However, even at an early stage, operating the platform may involve processing personal data such as user account details, contact information, technical identifiers, communications, and content submitted by users.

3. Personal data we may collect

Depending on how the platform is used, we may collect and process the following categories of data:

• Account and registration data, such as name, email address, role, login credentials, and profile details.
• Club and team profile data submitted through the platform, including club name, team name, age group, playing format, county, location, contact route, and related profile content.
• Communications data, such as information provided when contacting us, submitting an enquiry, requesting support, or reporting content.
• Content data, including listings, notices, event information, images, written descriptions, or other material uploaded or submitted by users.
• Technical and usage data, such as IP address, browser type, device information, pages viewed, timestamps, session data, and security logs.
• Cookie and analytics data, where cookies or similar technologies are used on the site.
• Location data, including postcodes you enter for search or club registration, and approximate geographic coordinates derived from postcodes using the postcodes.io geocoding service. If you set your location for search purposes, this may be stored locally in your browser.
• Push notification data, where you opt in to receive browser or device notifications. This includes a technical subscription token stored on our servers to deliver notifications to your device. You can revoke permission at any time through your browser or device settings.
• Pre-populated profile data. Some club profiles have been created using publicly available information from County Football Association records and league directories. This data typically includes club name, location, and postcode only. No personal data is included in pre-populated profiles.

4. How we collect personal data

• Directly from you when you create an account, complete forms, submit listings, contact us, or otherwise use the platform.
• Automatically through your use of the website, including technical logs, authentication processes, and cookies or similar technologies.
• From another user or organisation where they submit information connected with a club, team, event, or platform relationship.
• From publicly available sources, such as County Football Association records and league directories, where we pre-populate club profiles to help users find and claim their club. This data does not include personal data.

5. How we use personal data and our lawful bases

We use personal data only where there is a valid legal basis to do so. In particular, we may use it for the following purposes:

6. Data submitted about other people

If you submit personal data about another person, such as another club official, coach, manager, organiser, or contact, you are responsible for ensuring that you are entitled to provide that information and that it is accurate, relevant, and appropriate for publication or platform use.

Users must not upload personal data that is excessive, misleading, or shared without proper authority. We may remove or restrict access to information if we consider that it creates privacy, legal, or safeguarding risk.

7. Children and safeguarding

Grassroute operates in the grassroots football environment, which may involve clubs and activities connected with children. The platform is not intended for the unnecessary public posting of children's personal data.

• Do not upload sensitive child information, detailed personal contact information, medical information, or any other excessive child-related personal data unless strictly necessary and properly authorised.
• Where content relating to children is submitted, the submitting user or organisation is responsible for ensuring they have the right to share it.
• We reserve the right to remove or restrict content where we consider there to be privacy, safeguarding, or reputational concerns.

8. Sharing personal data

We may share personal data where reasonably necessary with:

• Hosting, infrastructure, and database providers used to operate the platform, including Supabase (database and authentication, hosted in EU West London), Vercel (website hosting), Resend (transactional email delivery for notifications and account communications), and postcodes.io operated by Ideal Postcodes Ltd (postcode geocoding for location features).
• Analytics, communications, support, security, or software providers used to run or improve the service.
• Professional advisers, insurers, auditors, regulators, courts, law-enforcement bodies, or other third parties where disclosure is legally required or reasonably necessary to protect our rights or the safety of users.
• A purchaser, investor, successor, or restructuring counterparty in connection with a merger, acquisition, reorganisation, or sale of assets, subject to appropriate confidentiality controls.

We do not sell personal data.

9. International transfers

Some service providers may process personal data outside the UK. Where this happens, we will take appropriate steps to ensure that transfers are made lawfully and that personal data remains protected through recognised safeguards where required.

10. Data retention

• Account data is retained for as long as the account remains active and for a reasonable period afterwards where needed for security, audit, dispute handling, or operational continuity.
• Support and contact records are retained for as long as reasonably necessary to deal with the relevant matter and maintain an appropriate support history.
• Technical logs and security records are retained for limited periods appropriate to security, diagnosis, and platform integrity.
• Published listings or content may remain visible until removed, edited, or archived, subject to operational, legal, or evidential needs.

We may keep data for longer where required by law or where reasonably necessary to establish, exercise, or defend legal claims.

11. Cookies and similar technologies

Grassroute uses essential cookies and similar technologies needed for core website and account functionality, such as authentication, session continuity, security, and basic platform operation.

If we use non-essential analytics, advertising, or performance cookies, these will only be activated in line with applicable UK cookie rules and with appropriate consent mechanisms in place.

12. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, or disclosure. No internet-based service can be completely secure, but we seek to apply proportionate safeguards based on the nature of the platform and the data involved.

13. Your rights

Subject to applicable law, you may have the right to:

• request access to personal data we hold about you;
• request correction of inaccurate or incomplete personal data;
• request erasure of personal data in certain circumstances;
• request restriction of processing in certain circumstances;
• object to processing based on legitimate interests;
• request portability of personal data where applicable;
• withdraw consent where processing is based on consent; and
• complain to the Information Commissioner's Office (ICO) if you believe your data has been handled unlawfully.

14. Contact and complaints

To exercise your rights or raise a privacy question, contact us at contact@grassroute.co.uk. You may also write to us at kadoH Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

If you remain dissatisfied, you may complain to the Information Commissioner's Office through the ICO's published channels.

15. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to the platform, legal requirements, or our processing practices. The latest version will always be published on the Grassroute website with an updated revision date.