Data processing
Data processing agreement
Version 2026-10-21
- The club decides why and how its members' information is used. Run The Club only handles it on the club's instructions.
- Everyone at Run The Club who can see it keeps it confidential, and we keep it secure.
- We use only the companies listed below, and tell you before adding another.
- We tell you without undue delay if something goes wrong, and help with requests from members.
- When you leave, we give you a copy if you ask, then delete it within 90 days.
This is the agreement a club accepts, together with our terms for clubs, when it signs up. Each version has a date, so a club can be asked to agree again if it changes.
1. Parties and meaning
1.1 This agreement is between the club that uses Run The Club ("the club"), and Run The Club (James Webster, sole trader), c/o Trampoline Life, Sport@Kenton, Newcastle upon Tyne, NE3 3RU ("Run The Club", "we", "us").
1.2 It is made under Article 28 of the UK GDPR. "Personal data", "controller", "processor", "processing", "data subject" and "personal data breach" mean what they mean in the UK GDPR and the Data Protection Act 2018.
1.3 The club is the controller of the personal data it keeps in Run The Club. Run The Club is its processor.
2. Subject matter and duration
2.1 We process personal data to provide Run The Club to the club: bookings, payments, memberships, registers, progress, members and the other features described in our terms for clubs.
2.2 This agreement starts when the club's account is created and lasts for as long as we hold the club's personal data, including after the club leaves, until it is returned or deleted under clause 10.
3. The data and the people
3.1 The people whose personal data we process are the club's members, their parents and guardians, gymnasts (most of whom are children), coaches, welfare officers and other staff, and anyone else the club adds.
3.2 The data includes names, contact details, dates of birth, emergency contacts, bookings and attendance, progress and routines, payment records, competition entries, and any health notes, incident reports, safeguarding records and staff documents the club chooses to record.
3.3 Some of this is special category data (such as health information), and much of it is about children. The club should record only what it needs.
4. Instructions
4.1 We process the club's personal data only on the club's documented instructions, which are this agreement, our terms for clubs, and the club's use of the features in the app. We do not use it for our own purposes, other than as clause 4.3 allows.
4.2 If we think an instruction breaks data protection law, we will tell the club. If we are required by law to process the data in another way, we will tell the club first, unless the law forbids us.
4.3 We may use anonymous, combined figures that cannot identify a club or a person, such as total bookings across all clubs, to improve the service.
4.4 The club is responsible for having a lawful reason to process the data, for telling its members how it is used, and for the instructions it gives.
5. Confidentiality
5.1 We make sure that everyone who can access the club's personal data is bound to keep it confidential, by contract or by law, and can access it only to provide the service.
6. Security
6.1 We use appropriate technical and organisational measures to protect the personal data, taking into account the risks, including that much of it concerns children. These include:
- information is encrypted on its way to and from the app;
- passwords are stored scrambled, never readable;
- each club's information is kept separate from every other club's, and staff only see what their role allows;
- important actions are recorded in an audit log;
- only the people who run Run The Club can reach the systems behind it, and only to support clubs and keep the service running.
6.2 We review these measures from time to time and will improve them as the service and the risks change.
7. Sub-processors
7.1 The club authorises us to use the sub-processors listed in this agreement and in our privacy policy. We keep the two lists the same:
| Sub-processor | What for | Where |
|---|---|---|
| Render | Hosts the app and its database | United States |
| Stripe | Takes card payments for clubs, and collects our monthly bills to clubs | UK, EU and United States |
| Postmark | Sends emails such as booking confirmations and receipts | United States |
| Sends some emails while we move them to Postmark | United States | |
| Anthropic | Powers optional AI features such as routine suggestions. It receives a gymnast's age and skills, not their name. | United States |
| Cloudflare and ImprovMX | Run our domain name and forward email sent to runthe.club addresses | United States and EU |
| Apple, Google and Mozilla | Deliver notifications to phones and browsers, if you allow them | United States |
7.2 We tell the club at least 30 days before adding or replacing a sub-processor, so it can object. If the club objects on reasonable grounds and we cannot resolve it, the club may leave under our terms for clubs.
7.3 We have a written contract with each sub-processor that requires it to protect the personal data to the same standard as this agreement. We remain responsible to the club for what our sub-processors do.
7.4 Stripe also acts as a controller in its own right for some of the information it needs to run payments and meet its legal duties. That is covered by Stripe's own terms.
8. Rights requests, assistance and breaches
8.1 We help the club respond to requests from data subjects to use their rights (such as access, correction and deletion), using the features in the app and, where needed, by hand. If a data subject asks us directly, we pass the request to the club without undue delay and do not answer it ourselves unless the club asks us to.
8.2 We help the club meet its duties on security, breach notification, data protection impact assessments and consulting the Information Commissioner's Office, taking into account the information we have.
8.3 We tell the club without undue delay, and within 48 hours, after we become aware of a personal data breach affecting its personal data. We tell the club what we know about what happened, the data and people affected, the likely effects, and what we are doing about it, and we keep the club updated as we learn more.
8.4 The club decides whether to report a breach to the Information Commissioner's Office and to data subjects.
9. International transfers
9.1 Some of our sub-processors are in or use servers in the United States. We transfer personal data outside the UK only where the transfer is covered by UK adequacy regulations or by the safeguards UK law requires, such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
9.2 Our privacy policy says where each sub-processor handles information.
10. Deletion or return
10.1 When the club leaves, or on the club's written request, we give the club a copy of its personal data in a common format if it asks, and then delete it within 90 days. Copies in our backups expire within 7 days after that, as our privacy policy says.
10.2 We may keep personal data only where the law requires us to, for example financial records, and we keep it protected and use it only for that purpose.
11. Audits
11.1 We give the club the information it needs to show that we are meeting this agreement and Article 28 of the UK GDPR.
11.2 The club may audit us, or have an auditor it appoints do so, on reasonable notice and no more than once a year (unless there has been a breach). Audits must be during working hours, must not disrupt the service or other clubs, and must not give access to other clubs' data. The auditor must keep what they learn confidential.
12. General
- This agreement is part of our terms for clubs. If the two disagree about personal data, this agreement applies.
- We may update this agreement with at least 30 days' notice, and will ask the club to agree to the new version.
- Questions go to hello@runthe.club.
- This agreement is governed by the law of England and Wales, and the courts of England and Wales deal with any dispute.