This policy explains how Rally handles personal data. Rally is operated by GRAEYNA LIMITED, a company registered in England and Wales (company number 17330833, registered office: 85 New Village Way, Morley, Leeds LS27 7GD). You can contact us about anything in this policy at [email protected].
GRAEYNA LIMITED is registered with the Information Commissioner's Office as a data protection fee payer.
1. The two roles we play
Rally is used by badminton clubs, counties and associations of all ages to run their seasons. Because of that, we handle personal data in two different roles, and your rights work differently under each.
Your association is the data controller for the information it enters and manages in Rally: player details, guardian contact details, availability replies, team selections, match results and similar records. GRAEYNA LIMITED processes that data on the association's instructions as its data processor. If you or your child are registered in Rally by an association, that association decides what is collected and why, and requests about that data (access, correction, deletion) should go to the association in the first instance. We support associations in meeting those requests with built-in export, correction and erasure tools.
The same applies when an association uses Rally to collect payments from its members, such as match fees, season fees or kit money. The association is the data controller for those payment records, and both Stripe and GRAEYNA LIMITED process them on the association's behalf. Questions about a payment to an association should go to that association first.
GRAEYNA LIMITED is the data controller for the information we collect to run the Rally service itself: account details for signed-in users, billing records, our correspondence with you, and technical data from visits to our website.
2. What we collect
Account data: name, email address, password (stored only as a secure hash) and role, for managers, coaches and parents or guardians who hold Rally accounts. Rally accounts are held by adults: guardians, association staff, and adult players who manage their own participation. Children never hold accounts.
Association data (processed for your association): player names, sex, date of birth or age group where the association records it, guardian names and contact details, availability replies, selections, match scores and results, and a log of the emails the association sends through Rally. Where an adult player manages their own contact, Rally holds that player's own email address and uses it in place of a guardian contact.
Billing data: subscription and payment records. Card details are collected and held by our payment provider, Stripe; we never see or store full card numbers.
Club payment data (processed for your association, where it collects payments through Rally): who was asked to pay and for what, the amount, the status (for example unpaid, paid, waived or refunded), how it was paid (card or cash), when, Stripe's reference numbers for the payment and any refund, and which member of the association's staff recorded a cash payment or waived a fee. For the association itself we store only its Stripe account reference and whether payments are switched on. Rally never stores card numbers or bank details: card details are entered on Stripe's own payment pages, and the association gives its bank details to Stripe directly.
Technical data: server logs and strictly necessary cookies (session and security cookies). Rally does not use advertising or analytics cookies.
3. Why we use it and our lawful bases
We use account and billing data to provide the service under our contract with you and your association, to secure accounts, to send service emails such as invitations, availability requests, reminders, team sheets and password resets, and to meet our legal obligations (for example tax and accounting rules). Where we process association data, we do so on the association's documented instructions. Where we rely on legitimate interests (service security, preventing abuse, improving reliability), we balance those interests against your rights.
4. Where results appear
Match results, selections and season statistics are visible only to signed-in members of the association they belong to. Rally does not publish results, rankings or player information on the public internet.
5. Children
Rally is used by adult and junior sport alike. Where an association manages junior players, the player's data is entered by the association, which confirms it has the player's, or their guardian's, permission. Guardians hold the Rally accounts connected to junior players, receive the communications, and reply to availability on their behalf. We do not knowingly allow children to hold accounts, we do not market to children, and we collect no more about a junior player than the association needs to run its season.
6. Who we share data with
We do not sell personal data, and we do not share it for advertising. We use a small number of service providers to run Rally: our hosting provider (Hostinger, which hosts the application and database and relays our email), Stripe (payments), and Cloudflare (DNS). Each processes data only as needed to provide its service to us, under appropriate confidentiality and data protection obligations.
Stripe also processes payments that associations collect from their members through Rally. For those payments the association is the data controller, and Stripe and GRAEYNA LIMITED process the payment information on its behalf: Stripe takes and holds the card or other payment details and pays the money into the association's own Stripe account, and Rally keeps the payment record described in section 2 so the association can see who has paid. Stripe's handling of that data is also governed by its own privacy policy and terms.
Rally is hosted on servers located in the United Kingdom, provided by Hostinger. Where Stripe transfers data outside the UK, it does so under its data processing agreement, which incorporates the UK Addendum to the EU Standard Contractual Clauses.
7. How long we keep it
Associations control their own data and can correct, export or erase it at any time. In addition, Rally applies an automatic retention policy: association data that has been inactive for 12 months is deleted, with a warning to the association's manager at 11 months and deletion only proceeding at least 30 days after that warning. Account and billing records are kept for as long as the account exists and afterwards only as long as the law requires. Club payment records are part of the association's data: they are kept while the association uses Rally, included in its data export, and deleted with the rest of its data under the retention policy above. Erasing a player anonymises their personal details while preserving the association's match results and payment records. Stripe keeps its own records of payments under its own legal obligations.
8. Security
Rally isolates every association's data, encrypts traffic in transit, stores passwords only as secure hashes, restricts access by role, rate-limits sensitive endpoints, and sends every family's email individually so no guardian ever sees another's address. No system is perfectly secure, but we design for privacy and test these protections as part of every release.
9. Security incidents and data breaches
We maintain procedures for identifying, managing and responding to security incidents involving personal data. Where we act as a data processor and become aware of a personal data breach affecting an association's data, we will notify that association without undue delay so it can meet its own obligations. Where we are the controller and a breach is likely to result in a risk to individuals, we will notify the Information Commissioner's Office and, where required, the affected individuals, in accordance with UK data protection law.
10. Your rights
Under UK data protection law you have rights of access, rectification, erasure, restriction, portability and objection, and the right not to be subject to solely automated decisions with legal effect (Rally makes none). For data your association controls, contact your association; its manager has the tools to respond, and we will assist them. For data we control (your account, billing, our website), contact us at [email protected] and we will respond within one month. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
11. Cookies
Rally sets only strictly necessary cookies: a session cookie to keep you signed in and a security cookie to protect forms. No consent banner is required for these, and we set nothing else.
12. Applicable law
This policy and any dispute arising from it are governed by the laws of England and Wales, and the courts of England and Wales have jurisdiction.
13. Changes to this policy
When we make material changes, we will update the version shown here and ask signed-in users to review and accept the updated policy before continuing.
Leeds, October 2026