Data processing agreement

Last updated 11 October 2026 · summary

When a club runs on The Magic Sponge, the club owns and controls its data. This summarises how we process it on the club's behalf. The full DPA forms part of your customer agreement and is available on request.

Roles

Your club is the data controller for the personal data of its members, coaches, players and parents. We are the processor — we only process that data to provide the platform, on your documented instructions, and never for our own purposes.

What we process, and why

To run your branded club site and app: contact and role details for committee, coaches and volunteers; player and parent details you choose to store (including, where you use those features, coaching qualifications and safeguarding/DBS status); fixtures, results, line-ups and match reports; enquiries submitted through your site; and, where your club collects player fees through The Magic Sponge, payment records (payer name and email, the player the payment is for, amounts, dates and payment status). The purpose is solely to deliver the features your club uses, for as long as you're a customer.

Our commitments

• Instructions only. We process personal data only to provide the service and on your instructions.
• Confidentiality. Anyone who accesses the data is bound by confidentiality.
• Security. Data is encrypted in transit and at rest, access is restricted, and each club's data is isolated from every other club's at the database level (tenant isolation / row-level security).
• Children's data. Youth data is minimised, access-controlled and processed only on the club's instructions.
• No selling. We never sell data.
• Payments. Where your club collects player fees through the platform, payments are processed by Stripe. Card details are entered directly with Stripe — we never see or store full card numbers.
• Your members' rights. We help you respond to access, correction and deletion requests.
• Breaches. We notify you without undue delay if a personal-data breach affects your data.
• End of service. On termination we return or delete your data, at your choice.

Where data is hosted

Your club's data is hosted in the United Kingdom — the product's database runs in Amazon Web Services' London region. Where a sub-processor operates outside the UK, appropriate transfer safeguards apply.

Sub-processors

We use a small number of trusted infrastructure providers to deliver the platform:

We'll give you reasonable notice of any change to our sub-processors.

The full agreement

This page is a plain-English summary. The signed DPA (with all defined terms and annexes) is part of your customer agreement — email hello@themagicsponge.app for a copy.