Draft — not final. This privacy policy is a working draft pending legal review and does not yet constitute the final policy.

Privacy Policy

Last updated: draft

1. Who we are

CoachSpot is operated by CoachSpot Training Ltd, registered in England and Wales. We are the data controller for personal data collected through the CoachSpot platform.

2. What we collect and why

Account data (all users)

  • Name, email address, password (stored hashed), account role (parent, athlete or coach).
  • For athlete accounts under 18: date of birth or age group, and the email address of a nominated parent or guardian for verification.

Coach verification data (coaches only)

  • Enhanced DBS certificate (including Children's Barred List check).
  • Photo ID (used to confirm the DBS certificate belongs to the coach).
  • Sport-specific safeguarding certificate.
  • Coaching qualifications and public liability insurance documents.

These documents are collected to verify coaches and meet safeguarding expectations. They are stored securely and are visible only to CoachSpot administrators for verification. Families and other users never see these documents.

Profile and marketplace data

  • Coach profile content (bio, sports, disciplines, base area, session types, pricing, availability).
  • Family / athlete preferences (age group, sport, postcode used for search).
  • Enquiries, messages and booking records exchanged through the platform.

Payment data

Payment for the £19.99 monthly coach subscription is handled by our payment provider (Stripe). We receive confirmation of payment and limited transaction metadata; we do not store full card details on our own servers. CoachSpot does not process any payments from parents or athletes — payment for coaching sessions is arranged directly between the family and the coach.

Technical data

IP address, device and browser information, and standard server logs, used to secure and operate the service.

3. Legal bases

  • Contract: to provide the CoachSpot platform to you.
  • Legal obligation and safeguarding: to verify coaches and to protect children.
  • Legitimate interests: to operate, secure, improve and defend the platform.
  • Consent: where specifically requested (e.g. optional marketing).

4. Who sees what

  • Verification documents (DBS, photo ID, safeguarding cert, qualifications, insurance): CoachSpot administrators only.
  • Coach public profile: visible to logged-in and, where a coach chooses, non-logged-in visitors.
  • Enquiry and message content: the coach and the family involved. Administrators may access it where required for safeguarding, dispute resolution or legal compliance.
  • Personal contact details (phone, email): for safeguarding, kept out of first-contact messages before an enquiry is accepted. Coaches may choose to publish their own mobile number, email, Instagram, website and WhatsApp directly on their public profile.
  • Guardian details on under-18 accounts: used solely for guardian confirmation and safeguarding contact.

5. Processors we use

We use trusted third-party processors to host, store and operate the platform (including cloud hosting, database, email delivery and payment processing). These processors act on our instructions under written data-processing terms.

6. Retention

  • Account data: kept for the life of the account and for a reasonable period after closure to meet legal and safeguarding obligations.
  • Verification documents: kept while a coach is active on the platform, and for a reasonable period after their account closes for audit and safeguarding purposes.
  • Booking, payment and safeguarding-relevant records: kept for the periods required by UK law.

7. Your rights

You have rights under UK GDPR to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. To exercise these rights, use our contact form. You have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

8. Children

CoachSpot is designed for families booking coaching for children, and for athletes aged 13 and over. Children under 13 must not create an account. Athlete accounts for 13-17 year olds require confirmation from a nominated parent or guardian before becoming active.

9. Security

We use industry-standard measures to protect personal data, including encrypted transport, row-level database access controls and admin-only access to verification documents. No system is perfectly secure — please use a strong, unique password.

10. Changes

We may update this policy from time to time. Material changes will be notified through the platform.

11. Contact

Questions about this policy can be sent through our contact form.