DRAFT FOR REVIEW. This document was prepared as a starting point and has not been reviewed by a qualified data protection professional. Because Rally processes children's data, have it reviewed against UK GDPR and ICO guidance on children's data before launch.
Rally is a season management platform for badminton associations, operated by GRAEYNA LIMITED ("we", "us"), a company registered in England and Wales, company no. 17330833, registered office: 85 New Village Way, Morley, Leeds, England, LS27 7GD. More about us at graeyna.com. You can contact us about privacy at [email protected].
This policy explains what personal data Rally handles, why, and the rights people have over it. We have tried to write it in plain English.
1. The two roles we play
Rally is used by badminton associations, clubs and county squads. For data protection purposes there are two distinct arrangements:
Your association is the data controller for its own people. Player details, guardian contact details, availability replies, selections and results are entered and managed by the association you belong to. The association decides what to collect and why. Rally stores and processes that information on the association's behalf, as a data processor, and only to provide the service.
We are the data controller for account and billing data. When you create a Rally account, we control the data needed to run your account and, for paying associations, billing.
If you are a parent or player with a question about the information your association holds in Rally, your association's team manager is the right first contact. We will assist them with any request.
2. What data Rally holds
Account data (we are the controller): your name, email address, a securely hashed password, your role, and records of when you accepted our terms.
Association data (your association is the controller): player names, sex and age group information, playing status, guardian names and contact details, availability responses and comments, team selections, and match scores and results. Some players are under 18; see section 3.
Billing data (we are the controller): your association's plan, subscription status and invoice history. Card details are entered directly with our payment provider, Stripe, on Stripe's own pages. Rally never sees or stores card numbers.
Technical data: standard server logs (IP address, time, pages requested) kept for security and troubleshooting, and the session cookie described in section 7.
3. Children's data
Rally is designed for junior sport, so much of the data associations store is about children. That data is entered by the association's authorised managers, not by children themselves, and Rally requires the manager to confirm that the association has the guardian's permission before a player record can be created. That confirmation is recorded with a timestamp and the confirming manager's identity.
Contact and personal details about players sit behind role restricted screens: managers see them, coaches and parents do not see other families' details. We process children's data only to provide the service to the association and never use it for marketing, profiling or advertising.
4. Why we process data (legal bases)
For account and billing data we rely on the performance of our contract with you (providing Rally), our legitimate interests in securing and improving the service, and legal obligations such as accounting rules for invoices.
For association data we act on the documented instructions of the association, which as controller is responsible for its own lawful basis. Associations confirm to us that they have guardian permission for the player data they enter.
5. Who data is shared with (sub-processors)
We do not sell personal data and we do not share it with advertisers. Rally uses a small number of service providers to run the platform:
- Hostinger, which hosts the application and database in the United Kingdom.
- Stripe, which processes subscription payments.
- Hostinger email, which delivers transactional email such as availability reminders and account invitations.
Each provider processes data only as needed to provide its service to us.
6. How long we keep data
Account and association data is kept while the association's account is active. If a subscription lapses, the data is retained unchanged so the association can resume, for up to 12 months, after which it is deleted. When an association is deleted, its data is removed. Invoice records are kept for as long as accounting law requires. Server logs are kept for a short rolling period.
7. Cookies
Rally uses only the essential cookies needed to keep you signed in and to protect forms against forgery. We do not use advertising or cross site tracking cookies.
8. Security
Data is encrypted in transit, passwords are stored using strong one way hashing, each association's data is isolated from every other's, access is restricted by role, and administrative actions on the platform are logged.
9. Your rights
Under UK data protection law you have rights over your personal data, including access, correction, erasure, restriction, portability and objection. For player and guardian data, please contact your association (the controller); we support associations in meeting these requests, including export and deletion tools. For your Rally account data, contact us at [email protected]. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
10. Changes to this policy
If we change this policy we will publish the new version with a new version number, and account holders will be asked to review and accept it the next time they use Rally.