Privacy Notice

Ovalball is operated by Pipaxon Technologies Ltd. Where this notice says “we” or “us”, it means Pipaxon Technologies Ltd acting as the provider of the Ovalball service.

Ovalball is rugby administration software. Clubs use it to hold their team structure, arrange fixtures against other clubs, keep a shared calendar, allocate pitches and venues, record player and guardian relationships, manage age-grade progression between seasons, handle player movement requests between teams, and communicate about rugby activity.

Ovalball is not a social network, and it is not a governing body. It does not sell information, and it does not use information about players or families for advertising.

This notice applies to everyone whose information appears in Ovalball, including:

• people who hold an Ovalball account, such as club administrators, team administrators, coaches, parents and guardians
• players, including young players who may not hold an account of their own
• people invited to join a club or team who have not yet accepted
• people at other clubs involved in arranging a fixture

The sections below describe the categories of information Ovalball actually holds. Not every category applies to every person.

When an account is created, Ovalball holds an email address, a first name and surname, and the account’s status. Ovalball does not store your password: authentication is handled by our authentication provider.

Ovalball holds information about the club itself — its name, location, rugby code, crest, contacts published by the club, venues and pitches — and about its teams, including team names, age grades, squad designations and whether a team is active or folded.

Ovalball also holds a directory of rugby clubs used to identify opposition when arranging fixtures. That directory is drawn from publicly available club information.

Player records may include:

• first name and surname
• date of birth
• the resulting rugby age grade
• the team or teams the player is a member of, and whether that membership is pending, active or ended
• attendance responses to fixtures
• player movement requests, such as being called up to another team, and any dispensations recorded against them
• where a club uses paid memberships, whether the player is enrolled and who the paying party is

Ovalball is used by rugby clubs that run youth teams, so a substantial amount of the information in it relates to children. This is handled deliberately rather than incidentally.

A young player’s date of birth is used to determine the correct rugby age grade, which in turn governs which teams they may play for and which protections apply. Young players may be linked to one or more guardians. Where a young player has an account of their own, what that account can do is constrained by permissions their guardian controls.

There is a separate, plain-English privacy page written for young players: Your Privacy on Ovalball.

Guardians hold an account with the usual account information, and are linked to specific players. That link is a record in its own right: it says which player the guardian is connected to, whether the relationship is active, and what the guardian has permitted that player’s own account to do.

For people holding a role at a club, Ovalball records the club or team the role applies to, the role itself, whether it is active, and whether the person’s authority has been suspended. Actions taken using administrative authority may be recorded in an audit log.

Fixtures hold the teams involved, the date and kick-off time, home or away, venue and pitch, status, and the result once played. Attendance holds a player’s response to a fixture. Pitch allocation records which pitch a fixture is assigned to and the warm-up and pack-up time reserved around it.

Ovalball supports training sessions, which hold the team, date, times and an optional note. Training is scheduled activity information; it is treated the same way as other rugby activity in this notice.

When a player is requested for another team, Ovalball records the request, the teams involved, the eligibility rule applied, and the decision. Dispensations record that a club, and where required a governing body, has approved a player playing outside their normal age grade. These records exist so that eligibility decisions are traceable.

Ovalball holds messages sent through the service, who sent them, when, and which fixture, club conversation or team community they belong to. It also holds reports made about messages and any moderation outcome. Messaging in Ovalball is scoped: a conversation belongs to a fixture, a club or a team, and is visible to the people connected to it.

Where a club has enabled paid memberships, Ovalball holds the club’s programme settings — the monthly amount, the collection day, the first-payment policy and any sibling discount rules — along with who the paying party is for each player, the amount agreed at the time they enrolled, and the status of payments.

Payments are processed by GoCardless. Ovalball stores references to the customer, mandate, payment and subscription records held by GoCardless, together with their status. Ovalball does not store full bank account details.

At the date of this notice, live payment collection is not enabled in the production service.

Signing in is handled by our authentication provider. Ovalball receives confirmation that you signed in successfully, together with your account identifier and email address. A session cookie then keeps you signed in.

Ovalball may allow you to create an account or sign in using Google, Facebook or Apple.

If you choose one of these options, the provider confirms your identity and may send Ovalball limited account information such as a provider account identifier, your name and your email address, depending on the provider and the choices you make.

Ovalball uses this information to create, identify and secure your Ovalball account.

Ovalball does not receive your Google, Facebook or Apple password.

Using a social sign-in option does not give Ovalball access to unrelated information such as your contacts, files, photographs, posts or calendars unless a separate Ovalball feature expressly asks for that information and you choose to grant that access.

Signing in through Google, Facebook or Apple authenticates the account. It does not by itself prove a player’s age, a guardian relationship, club membership, team membership or an administrative role in Ovalball.

If you use Sign in with Apple, you may choose Apple’s Hide My Email feature. If you do, Ovalball may receive an Apple relay email address instead of your usual email address.

At the date of this notice, these sign-in options are supported by the platform but are not yet enabled in the live service.

Our hosting and database providers process technical information needed to serve the site and keep it secure, such as network request information and error logs. Ovalball keeps an audit log of significant changes made through the service.

Information reaches Ovalball in three ways:

• you provide it yourself, for example when you create an account or add a child
• a club provides it, for example when a club administrator adds a team or records a player
• it is generated by using the service, for example an attendance response or an audit entry

The club directory used to identify opposition clubs is compiled from publicly available information about rugby clubs.

To provide the Ovalball service: to run accounts, hold club and team structure, arrange fixtures, allocate pitches, record attendance, manage age-grade progression and player movement, enable scoped communication, support paid memberships where a club has enabled them, keep the service secure, and meet legal obligations.

The allocation above reflects how the service currently works. The final legal determination for each entry is subject to professional review.

Where we rely on legitimate interests, the interest is running a functioning rugby club administration service: clubs need to know who plays for which team, who is available, and who is authorised to act. We weigh that against the privacy of the people involved, particularly children, which is why access in Ovalball depends on role and relationship rather than being open to every user.

Information is shared with the club or clubs it relates to, with our technology providers, and where the law or a serious safeguarding concern requires it. It is not sold, and it is not shared for advertising.

Information in Ovalball is not intended to be visible to every user. Access depends on factors such as the club you belong to, the team you are connected with, your role, and any verified player or guardian relationships.

Specifically:

• a guardian relationship does not automatically make someone a club administrator
• a team administrator does not automatically receive authority over unrelated teams
• belonging to one club does not give access to another club's players or teams

Authentication and authorisation are separate. Signing in proves who you are; it does not decide what you may see or do. That is decided by your roles and relationships, and it is enforced by the service itself rather than only hidden in the interface.

Ovalball runs on hosting and database infrastructure provided by third parties. They process information on our instructions in order to run the service. They are listed on the Third-Party Services page.

Sign-in is handled by our authentication provider. Where social sign-in is enabled, Google, Facebook or Apple confirm your identity as described in section 17.

Where a club has enabled paid memberships, GoCardless processes the payment and holds the bank details. Ovalball holds references and statuses, not full bank details.

We may disclose information where we are legally required to, or where there is a serious concern about the safety of a child or another person. Where a safeguarding concern arises within a club, the club retains its own safeguarding responsibilities.

Our providers may process information outside the United Kingdom. Where that happens, the transfer must be covered by an appropriate safeguard recognised under UK data protection law. We do not claim that all information remains within the UK, because that would depend on provider region configuration that is documented on the Third-Party Services page rather than asserted here.

We keep personal information only for as long as reasonably necessary for the purpose for which it is held, taking account of club administration, account security, safeguarding, audit, financial and legal requirements.

Some records are deliberately durable. Fixture history, results, audit entries and eligibility decisions are kept so that a club’s record of what happened remains accurate; ending a team membership records an end date rather than erasing the history. Defined retention periods for each category are being confirmed and will be published here once settled.

Access to information is enforced by the database itself, using rules tied to your roles and relationships, so a request for information you are not authorised to see is refused by the service rather than merely hidden from the screen. Administrative actions are recorded in an audit log. Payment provider credentials and other secrets are held server-side and are never sent to the browser.

No online service can promise perfect security, and we do not claim to. If you believe an account has been compromised, contact us using the details in section 38.

Young people have privacy rights of their own; those rights do not belong solely to their parents. A young player can ask what information Ovalball holds about them, ask for wrong information to be corrected, ask who can see it, and raise a concern. They can ask a trusted adult to help, and a guardian may exercise rights on their behalf where that is appropriate.

You have rights of access, correction, erasure, restriction, objection and portability, and the right to withdraw consent where we rely on it. These are explained, with how to use them, on the Your Data Rights page.

Ovalball does not make decisions about people using automated profiling that produce legal or similarly significant effects. Age grade is calculated from date of birth using the published rules of the relevant rugby code, and eligibility for a player request is checked against those rules; both are rule-based calculations that a person reviews and decides on, not automated judgements about an individual.

Ovalball uses a small number of cookies and browser storage items, all of which are needed to sign you in, keep you signed in, remember which club or team context you are working in, and keep the service secure. They are itemised on the Cookie Policy page.

If you are unhappy with how your information has been handled, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at ico.org.uk.

We may update this notice as Ovalball develops. The effective date, last-updated date and version at the top of this page always reflect the published version.

To contact Pipaxon Technologies Ltd about privacy or data protection, email hello@ovalball.co.uk or use the Ovalball contact page, choosing “Privacy / data rights” as the reason.