Privacy Policy

Advance Football School ("AFS", "we", "us") is committed to protecting the privacy of parents, second parents/guardians, children, coaches, and site visitors. This policy explains what we collect, why, and how it's protected.

What we collect

• Parent account details: first name, last name, email address, phone number.
• Second parent/guardian details (optional): first name, last name, email, phone.
• Child profile details: first name, last name, date of birth (used to derive age band), and optional medical/allergy notes.
• Booking, attendance, and payment history.
• Coach applicant details: name, email, and the CV file itself.
• Contact form submissions.

Why we collect it, and our legal basis

• Contract — to create and manage accounts, process bookings and payments, and run sessions safely (including medical/allergy information available to coaches on the day).
• Legitimate interests — to communicate essential service updates, process coach applications, and keep our platform secure.
• Consent — for marketing emails and for photographing/filming a child at a session (see "Marketing emails" and our Safeguarding Statement below).
• Legal obligation — where we must keep or disclose information to comply with the law (for example, a safeguarding referral).

Sign-in codes

AFS uses passwordless sign-in: a one-time 6-digit code sent to your email, valid for 10 minutes and usable once. We never ask for or store a password.

Children's data

A child's AFS profile is created and controlled by their parent's account — children do not hold their own login. Child data is treated as the most sensitive information we hold: it is collected minimally, medical/allergy notes are encrypted at rest, access is limited to staff roles who need it to run sessions safely (plus the parent account that owns the profile), and it is never used for marketing or profiling. Photographs/video of a child are only taken with per-child parental consent — see our Safeguarding Statement.

Cookies

AFS uses only strictly necessary cookies (to keep you signed in and remember your booking session) and no tracking or advertising cookies. See our Cookie Notice for the full list.

Who we share data with

• Stripe — processes card payments; AFS never sees or stores card details.
• Brevo — sends transactional emails (booking confirmations, reminders, receipts).
• Supabase — hosts our database and secure file storage (coach CVs).
• Cloudflare — hosts the website and provides privacy-friendly, cookieless analytics.

Some of these providers may process data outside the UK/EEA (for example, in the US). Where they do, they provide appropriate safeguards such as the UK/EU Standard Contractual Clauses. We do not sell personal data, and we do not share it with any third party for their own marketing purposes.

How long we keep it

Booking, attendance, and payment records are kept for as long as the account is active, and afterwards for as long as we're required to for accounting/tax purposes. Coach CVs for unsuccessful applicants are kept only as long as needed to conclude the application, then deleted. Inactive accounts are anonymised after 24 months. [RETENTION_PERIODS] — the exact periods above should be confirmed and stated precisely once finalised.

Your rights

Under UK GDPR you can ask us to access, correct, delete, or export your data, or to restrict or object to certain processing. You can export your data or request account deletion at any time from your dashboard; contact help@afs.football for any other data protection request. If you're unhappy with how we've handled your data, you can also complain to the UK Information Commissioner's Office (ico.org.uk).

Marketing emails

We only send marketing emails if you tick the opt-in box at account creation, and every marketing email includes one-click unsubscribe. Transactional emails (bookings, receipts, reminders) are always sent, as they're necessary to deliver the service.