Children’s Data & Parental Consent Policy

Cluboom is built for grassroots sports clubs, and the majority of those clubs include children and young people. Protecting children’s personal information is therefore treated as a core design principle rather than a compliance afterthought: what is collected, who can see it, and how long it is kept are all decisions made with young members in mind.

This policy explains what that means in practice — the information that may be processed about a child, the responsibilities each party carries, and how parents, guardians and clubs can raise questions or concerns.

This policy applies wherever a club uses Cluboom to manage youth teams and junior members. It is relevant to:

• players, including children and young people;
• parents;
• guardians and others with parental responsibility;
• coaches;
• team administrators;
• club administrators;
• welfare and safeguarding officers.

Where a club uses Cluboom only for adult teams, the general Privacy Policy applies and this document is informational.

Cluboom has been designed around six connected principles:

• Privacy — children’s information is visible only to the people who genuinely need it to run the team.
• Safeguarding — platform features are built to support, not replace, a club’s safeguarding arrangements.
• Data minimisation — clubs are only asked for information that serves a clear purpose in organising and supporting players.
• Security — information is protected in transit and at rest using recognised technical measures.
• Role-based access — what a coach, parent, player or administrator can see is determined by their role, not by chance.
• Appropriate parental involvement — parents and guardians have visibility of their own child and a route to raise questions.

The information held about a child depends on how each club chooses to use Cluboom. Depending on those choices it may include:

• player name;
• date of birth, used for age group and eligibility;
• team and squad membership;
• attendance at training and fixtures;
• availability responses;
• match statistics;
• fitness testing results;
• awards and achievements;
• emergency contact details;
• medical or injury information, where the club has enabled those features;
• player photographs, where the club has enabled photograph uploads.

Features that involve more sensitive information — medical, injury and photographs — are optional and controlled by the club.

Accurate information keeps children safe on matchdays. Parents and guardians should:

• keep contact and emergency contact information up to date;
• notify the club of relevant changes, including medical, dietary or welfare changes;
• report inaccuracies in a child’s record to the club promptly;
• protect login credentials and PINs, and avoid sharing them with people outside the family;
• notify the club if access should be removed — for example after a change in family circumstances or when a child leaves the club.

Clubs act as Data Controllers for the personal information they hold in Cluboom. Each club is responsible for:

• ensuring there is an appropriate lawful basis for processing children’s information;
• obtaining any necessary parental consent, and recording and honouring its withdrawal, where consent is the basis relied upon;
• managing access permissions so that only appropriate people hold coach, administrator or welfare roles;
• maintaining safeguarding procedures in line with their governing body;
• removing access when a coach, volunteer, parent or player is no longer connected to the club.

In relation to children’s information, Cluboom:

• acts as a Data Processor on behalf of each club;
• processes information only on the club’s documented instructions, as set out in the Data Processing Agreement (UK GDPR);
• applies technical and organisational security measures;
• protects accounts using secure authentication;
• restricts access using role-based permissions;
• supports clubs in meeting their UK GDPR obligations, including responding to rights requests.

Cluboom does not sell personal information, and does not use children’s information for advertising or profiling.

Safeguarding responsibility always remains with the club. Cluboom provides administrative tools — role-based access, controlled communication and structured records — that support a club’s arrangements, but the platform does not replace safeguarding procedures, designated officers or reporting duties.

Clubs should continue to follow the safeguarding policies of their national governing body, county association or league. Where there is a conflict between convenience in the platform and a safeguarding requirement, the safeguarding requirement takes precedence. See the Safeguarding & Child Protection Policy for how concerns should be raised.

Photographs of children are only present in Cluboom where a club chooses to upload them. The club is responsible for ensuring it has the appropriate permissions in place before any photograph of a child is uploaded, and for removing images where permission is withdrawn or a child leaves the club. Photographs should be limited to what the club actually needs — typically identification within the squad — and should not include images that would be inappropriate to share within a youth sport setting.

Medical and injury information is sensitive and should be limited to what is necessary for a player’s safe participation — for example an allergy, a condition that affects training, or a current injury and its recovery status. Detailed clinical history does not belong in Cluboom. Access to this information is restricted by role, and clubs should keep entries factual, proportionate and up to date, removing detail once it is no longer relevant.

Data protection rights belong to the child, even where they are exercised in practice by a parent or guardian. How those rights work, how requests are verified and how long they take is set out in the Data Subject Rights Policy. What information is held and why is explained in the Privacy Policy, and how long it is kept is covered by the Data Retention Policy.

Requests relating to a child’s personal information often require cooperation between Cluboom, the club as controller and, where appropriate, the child’s parent or guardian. Depending on the child’s age and understanding, a request may come from the child themselves. Where a safeguarding concern exists, the club and any relevant statutory body take precedence over routine disclosure.

Children’s information is protected by the same controls used across Cluboom:

• encryption in transit and at rest;
• role-based permissions enforced at the database level;
• audit logging of sensitive administrative actions;
• secure authentication for accounts and player devices;
• secure, managed infrastructure hosted in the United Kingdom or EEA.

Full detail is set out in the Security Policy.

This policy is reviewed at least annually, and sooner where legislation, regulatory or safeguarding guidance, or Cluboom platform functionality changes. The document version, effective date and review date shown above always reflect the current published position.

Questions regarding this policy can be sent to support@cluboom.co.uk.

Cluboom welcomes responsible feedback that helps improve our governance, safeguarding and compliance documentation.