Privacy notice

This explains what happens to your details when you join a club, manage a membership, run a club, or visit our website. Last updated 17 October 2026.

1. Who we are, and our two roles

We are Braidwood Digital Ltd, trading as Braidwood Sports, a company registered in Northern Ireland (company number NI744374) with its registered office at 92 Castle Street, Office 2094, Belfast BT1 1HE. We are registered with the Information Commissioner's Office (ICO) under number ZC279315. You can write to us at support@braidwoodsports.com.

We do two different jobs, and they matter for who answers your questions:

• For a club's members (people who join a club, the people who pay for them, and people who play Last One Standing), the club decides what happens to your details and is responsible for them. We look after them for the club and use them only to run the service for that club. We are the club's "processor".
• For club admins and LOS Managers, people who ask us about starting a club, and visitors to our website, we decide what happens to the details. We are the "controller" for those.

2. What we hold

• If you join a club or pay for someone: your name and email address (we need both, as the person who joins or pays), your mobile number if you choose to give one (it is only for WhatsApp), your membership type and payment day, and the payments made or missed. We never ask for a date of birth.
• If you are looked after by someone else (for example a child, or a friend or relative who does not use the internet): your name, your membership, and your payments. We hold no email or mobile number for you; everything goes to the person who pays for you.
• If you play Last One Standing: your name (or the name a club typed for a guest), your entries and picks, and the results. If you use a club's game link, also the email address you enter: we use it to send you a button that opens your picks, or confirms your entry when you join, and pick reminders if the club turns them on. A guest's email address is never shown to the club's admins or anyone else.
• If you are a club admin or LOS Manager: your name, email address and mobile number, your role, who invited you, and, if you are also a member, a link to your member record.
• If you ask us about starting a club: your name, email address, phone number if given, your message, the club's details, and any colours, crest or player list you send us.
• Messages and sign-in: a short record of the WhatsApp and email messages we send you (the first part of each, with sign-in codes hidden), the codes and sessions that let you sign in, and a record of who did what in a club and when (the audit log).
• Payments: card and bank details are held by Stripe, not by us or your club. We keep Stripe's references, the card brand and its last four digits (or, for a Direct Debit, the last four digits of the bank account), and the amounts and dates.
• If you open a club with us: a coded fingerprint (a hash) of the club's name and country, and of the email addresses and phone numbers of its admins. It cannot be read back into those details. We use it only to see that a club that has already had its one free game is not given a second.

3. Why we use it, and our legal basis

• To run your membership (approving it, taking payments, telling you about changes, letting you sign in to My membership): this is needed to provide the service you or your club asked for (contract).
• To keep records the law requires, such as payment and accounting records (legal obligation).
• To keep the service safe and working: sign-in limits, spotting abuse, the audit log, finding faults, helping a club that asks for help, and making sure each club gets only one free game (our legitimate interest in running a secure and fair service).
• To message you on WhatsApp: only if you agree when you join (consent). Reply STOP at any time and the messages stop. Sign-in codes and receipts by email are part of running your membership.
• To answer an enquiry about starting a club (your agreement, and our legitimate interest in replying).

We do not sell your details, use them for advertising, or use them to make automated decisions about you.

4. Children

Clubs have junior members. Someone aged under 18 is signed up by an adult, who tells the club they are entitled to do that, for example as a parent or guardian. We hold only the child's name, membership and payments, and any Last One Standing entries: no contact details, no date of birth, no photographs, and no medical, school or welfare details. Messages about a child go to the adult who pays for them and can name the child. The club, as controller, decides who in the club can see this.

5. Who we share it with

Only the companies that help us run the service, and only what each needs:

• Cloudflare hosts the service and holds the database (we choose a Western European region for it).
• Stripe takes card and Direct Debit payments and receives the payer's name and email address and the payment details.
• Meta (WhatsApp) delivers WhatsApp messages and receives the mobile number and the text of the message.
• Amazon Web Services (Amazon SES, in London) sends emails (sign-in codes, receipts, notices) and receives the email address and the text of the email.
• Brevo sends the same emails only when Amazon SES cannot, and receives the same details.
• An AI service provider (today, Anthropic). When a club admin uploads a member list that needs reading (a photo, a PDF or a messy list), the list is sent to it to pick out names, emails and phone numbers, which the admin then checks. When a club asks "Tidy with AI" for its crest, the picture is sent. When someone asks Quick help a question on our website or in the app, or a member sends a WhatsApp question our automatic replies do not cover, the question is sent with our help pages, and it is not kept. Nothing else is sent. We use services whose business terms say they do not use what we send to train their models, and we will update this notice if the provider changes.
• football-data.org provides fixtures and scores and receives no personal data.

Within a club, only the club's admins see its members' details. An LOS Manager sees only the Last One Standing game they help run. Our staff see what they need to help a club: for example, clubs and counts, and an activity feed in which member names are hidden. If the law requires it, we may have to give details to a court or the police.

6. Sending details outside the UK and the EEA

Some of these companies handle details outside the UK and the EEA, for example in the United States. Where they do, they rely on a safeguard the law accepts, such as standard contractual clauses approved for that purpose, or an adequacy decision such as the UK-US data bridge, and we have a data processing agreement with each.

7. How long we keep it

• A member's details: while they are a member, and afterwards until the club removes them. You can ask for your details to be erased at any time: ask your club, or ask us, and your details are erased. Payment and accounting records the law requires are kept, without your name.
• Payment, refund and accounting records: while the club is open, and for at least 6 years after it closes, because accounting and tax rules say records must be kept. Once a person's details are removed, these records stay without a name on them.
• The audit log: while the club is open, with names removed from the records about a person when their details are removed. After a club closes it is deleted 24 months later, except short lines that record the club's free game and its closing.
• Join requests: waiting ones for 12 months; declined or withdrawn ones for 6 months.
• WhatsApp message records: 12 months.
• Sign-in codes: deleted the day after they expire. Sessions: deleted 90 days after they end.
• Uploaded lists and crests that were never used: deleted after 90 days.
• Enquiries about starting a club: 12 months.
• When a club leaves: its account stays open for 30 days so it can take a copy of its data, and is then closed. When it is closed nobody at the club can sign in, and nothing is deleted at that point. Ninety days after closing, the personal details of its members, admins and other people are removed. The rest of the club's records are kept for 24 months after closing, for disputes, refunds and accounting questions, and then deleted. Two things are kept longer: the coded fingerprint that stops a club being given a second free game, which holds no readable personal details and is kept for good, and the payment and fee records in our own accounts, for at least 6 years.

8. Your rights

You can ask to see the details held about you, have them corrected, have them removed, ask us to limit or stop using them, or take a copy to move elsewhere. You can object to our use of your details where our legitimate interest is the reason, and you can withdraw your WhatsApp agreement at any time by replying STOP.

• For your membership, ask your club, or ask us, and your details are erased. A club admin can first download everything held about you if you want a copy, and then remove your personal details, from your member page. Payment and accounting records the law requires are kept, without your name.
• For anything we decide, or if your club does not reply, write to support@braidwoodsports.com. If you ask us about a club's member data, we pass it to the club the same day and tell you we have. We answer within one month.
• Removing details has limits: a club must keep payment records, and Stripe, WhatsApp and our email provider keep their own records under their own rules. We will tell you what applies when you ask.

If you are not happy with how we have handled your details you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), or, in Ireland, to the Data Protection Commission (dataprotection.ie). We would like the chance to put it right first.

9. How we keep it safe

• Every request is checked against the signed-in person's own club, so one club can never see another club's details.
• You sign in with a six-digit code sent to your email (valid for 10 minutes, used once). There are no passwords. A session lasts 30 days for a club admin and 90 days for a member, counted again each day it is used, and you can end every session at once with "Sign out everywhere". Serious actions ask for a fresh code. A sign-in to an admin account from a browser we have not seen before is emailed to the account holder.
• Everything travels over encrypted connections, and card details are never stored by us.
• Important actions are written to an audit log, and access for our own staff is limited to what the job needs.

If a breach ever put your details at risk, we would tell the club straight away and, where the law requires it, you and the regulator.

10. Cookies and similar

When you sign in we set two cookies: one keeps you signed in, and one is a random number for your browser, so we can tell you if your admin account is signed in from a browser you have not used before. They are needed for the service to work and keep it secure, so they do not need your consent. Your browser also stores your light or dark choice and small display settings, on your own device. We use no advertising, tracking or statistics cookies, and load no third-party scripts.

11. Changes to this notice

If we change how we use your details we will update this page and, for an important change, tell club admins by email. The date at the top shows when it last changed. The terms we agree with clubs, including the data processing terms, are in the Terms for clubs.