Sporty Heroes Privacy Notice

Sporty Heroes Ltd is the data controller. Company number 17279814. Registered office: Flat 3 Woodcock Court, Croxdale Road, Borehamwood, WD6 4PZ, England.

For privacy questions or rights requests, contact info@sporty-heroes.com or call 07731 950902. We have not appointed a statutory Data Protection Officer; privacy enquiries are handled through this contact.

Parent or guardian information: name, email address, mobile number, relationship to the child, home postcode where supplied, enquiry information, booking acknowledgements, marketing preferences and relevant payment or subscription references.

Child information: name, preferred name, date of birth, age group, class, booking and membership status, session registrations, attendance information and participation notes.

Health and additional-needs information: information a parent provides about medical conditions, allergies, SEN, additional needs and practical adjustments relevant to safe and inclusive participation. This can be special-category personal data.

Photo and video permissions: whether you allow private family/class sharing and/or Sporty Heroes marketing and promotional use.

Payment information: transaction, invoice, payment status, Stripe customer/subscription/payment identifiers and billing information. Stripe processes full card details; Sporty Heroes does not store complete card numbers or card security codes.

Technical and security information: information needed to operate and secure our website and integrations, such as service logs and request metadata generated by our technology providers.

Most information comes directly from a parent or guardian through our website, enquiry forms or communications. HubSpot is our main CRM and holds parent/guardian and child records, including booking and membership information, consent and acknowledgement evidence, and relevant medical, allergy, SEN/additional-needs and participation information supplied for safe delivery. Stripe provides payment and subscription status information. Base44 provides the public website, booking interface and integration layer that passes information to HubSpot and Stripe.

Health information is more sensitive and receives additional legal protection. We ask for a separate explicit consent when you book. We use this information only so Sporty Heroes can understand relevant risks and practical adjustments for safe, inclusive participation, and for related incident or safeguarding handling where necessary.

You can withdraw this consent by contacting us. Withdrawal does not make earlier lawful processing unlawful. If we no longer have information that is reasonably necessary to support a child safely, we may be unable to continue providing the class until an appropriate way forward is agreed.

We do not send direct marketing to children. Marketing communications are directed to the parent or guardian in line with their marketing preference. A child's photo/video permission is recorded separately and does not subscribe the child or parent to marketing messages.

Photo/video permissions are optional and separate from booking. You can choose private family/class sharing, Sporty Heroes marketing and promotion, both, or neither.

If you consent to public marketing use, content may be published on our website, social media, printed materials or paid advertising. Publicly published content can be copied or shared by other people outside Sporty Heroes' control. If you withdraw permission, we will stop new use and take reasonable steps to remove material we control, but we may not be able to retrieve copies already printed, downloaded, reposted or otherwise outside our control.

We use trusted providers to run Sporty Heroes, including:

• HubSpot — our main CRM for parent/guardian and child records, bookings, memberships, session participation, consent/acknowledgement evidence, relevant health and additional-needs information, operational records and related communications.
• Stripe — payments, customers, subscriptions, payment status and billing.
• Base44 — website, booking forms and integration/backend processing used to connect the public website to HubSpot and Stripe.
• Technology, email, hosting, security, professional advisers, insurers or authorities where reasonably necessary for the purposes described in this notice.

We do not sell personal information to advertisers.

Some of our technology providers and their subprocessors may process information outside the UK. Where UK data-protection law requires safeguards for an international transfer, we rely on the lawful transfer mechanism used by the relevant provider, such as UK adequacy regulations or approved contractual safeguards. You can contact us for more information about safeguards relevant to your data.

We keep information only for as long as reasonably needed for the purpose for which it was collected, including:

• Enquiries that do not become bookings: normally up to 24 months after the last meaningful interaction, unless you ask us to delete them sooner or another lawful reason requires retention.
• Booking, membership, payment and contractual records: normally up to 6 years after the relationship ends where needed for accounting, contract administration or legal claims.
• Health, allergy, SEN and additional-needs details: reviewed for relevance while the child attends and normally deleted or anonymised within 12 months after the child stops attending, unless an incident, safeguarding matter, insurance requirement or legal claim requires longer retention.
• Photo/video consent evidence: while the permission is in use and for a reasonable period afterwards to demonstrate what permission applied. Withdrawal is recorded so we can honour it.
• Marketing preferences: until you unsubscribe or withdraw consent. We may keep a minimal suppression record after opt-out so we do not accidentally market to you again.

We may retain a record longer where this is reasonably necessary for safeguarding, insurance, dispute resolution, legal claims or a legal obligation.

Depending on the circumstances, you may have rights to access personal information, correct inaccurate information, request deletion, restrict processing, object to processing and receive or transfer certain information. Where we rely on consent, you can withdraw it at any time.

A parent or guardian can normally exercise relevant rights on behalf of a young child where appropriate. Contact info@sporty-heroes.com to make a request.

Your right to object: you can object at any time to direct marketing. If you object, we will stop using your information for that purpose.

We may use a child's date of birth to identify the appropriate age group and use live class capacity to determine whether a booking can be offered. We do not use solely automated decision-making that produces legal or similarly significant effects on you or your child.

Some information is required to make and administer a booking, such as parent contact details, the child's name and date of birth, and booking acknowledgements. If required information is not provided, we may not be able to accept or safely deliver the booking.

Please contact us first if you have a privacy concern: info@sporty-heroes.com.

You also have the right to complain to the Information Commissioner's Office (ICO): Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; telephone 0303 123 1113; website ico.org.uk.

We may update this notice when our services, systems or legal obligations change. The current version and effective date will always be shown at the top of this page. If a change materially affects how we use information already collected, we will take reasonable steps to bring it to your attention.