01Who we are
Ruckr is the rugby club software service operated as Ruckr Rugby (“Ruckr”, “we”, “us”). Contact [email protected] about the service, these documents or Ruckr’s handling of personal information. Your club is a separate organisation; its name and contact details should appear in its own policies.
02For a young player
Your club uses information about you to organise rugby and help keep you safe. That can include your name, age group, team, whether you can come, who to contact in an emergency and information needed to look after you. Some information is private and should only be opened by the people who need it.
You can ask what the club knows about you, ask for a mistake to be corrected and speak to a trusted adult if something makes you uncomfortable. You have privacy rights of your own. If a worry is about a person at the club, you can tell another trusted adult or use an independent safeguarding route.
03Club decisions and Ruckr’s responsibilities
A club generally controls the information it collects to run memberships, teams, fixtures, communications, payments, welfare and events. It decides the purposes, lawful bases, authorised recipients and retention periods. Ruckr processes those club records on documented instructions under the data processing agreement.
Ruckr separately controls information it needs to run its own service, including account administration, subscriptions, support, security, abuse prevention and legal compliance. A payment, identity or social provider may also have independent responsibilities. Roles depend on what each party actually does, not just the label in a policy.
A club’s privacy notice, membership rules or consent request does not replace Ruckr’s notice, waive an individual’s rights or transfer Ruckr’s own legal duties to the club. Each organisation remains answerable for the processing and conduct for which it is responsible.
04Who may act for a child
Ruckr’s under-18 guardian workflows are a product safeguard, not a claim that every person under 18 is legally incapable of making a privacy decision. Clubs must consider the child’s age, understanding, rights and circumstances, including any parental-responsibility or court restrictions.
The club verifies and assigns guardian links and permissions. A guardian can perform the actions their role allows, such as replies, payments and specified consent choices. A parent’s link does not justify access to all confidential safeguarding information or to information whose disclosure could place someone at risk.
05Information and choices
Children’s records can include age, guardian and emergency contacts, teams, attendance, coaching, consents and appropriate medical information. Keep collection proportionate. Optional photography, public sharing and health uses need their own explanation and appropriate permission; a membership form must not bundle them into an unrestricted agreement.
Clubs must give children information they can understand as well as information for adults. As circumstances or understanding change, the club should review who answers and whether a previous permission remains appropriate. Guardians should not include unnecessary family, health or legal details in team chats.
06Public identity, images and messages
Ruckr’s public-display controls are designed to protect children’s names, age-grade information and media permissions. Clubs must still check photographs, captions, free text, exported graphics and external posts: identifying details can be added outside a structured name field. Consent does not make an unsafe publication acceptable.
Use the approved team and guardian communication routes. Do not bypass safeguarding rules with private accounts, separate group chats or copied contact lists. Clubs must set expectations for messaging, moderation, supervision and response times, and act on concerns about inappropriate contact.
07Medical information and safeguarding disclosures
Only share health information needed for the stated purpose. Withdrawal can remove optional information while a justified injury, care or safeguarding record may need to remain restricted. A club should not disclose a concern to every guardian automatically, especially where a disclosure could increase risk.
Where necessary to protect a child, the responsible organisation may share proportionate information with safeguarding services or authorities under an appropriate lawful basis. It must not wait for consent if seeking it would be inappropriate or put the child at risk. Record the reasons and tell the family when it is safe and lawful to do so.
08Retention, leaving and deletion
Club records follow the club’s documented retention schedule, the purpose for keeping each record and any applicable legal, safeguarding, accounting or dispute obligations. The app’s default periods and minimum settings are product controls, not a statement that every club is legally required to retain every record for that length of time. A club must review their suitability and contact Ruckr if a valid erasure request or legal requirement needs a different approach.
Closing a sign-in account, ending membership, withdrawing a permission and erasing a club record are different actions. Some records can be removed; others must be restricted or retained for a justified purpose. A child’s club record is not automatically erased when a parent deletes their own account or when the child removes their sign-in.
Local account closure and a provider’s deletion can finish at different times: the Ruckr record is removed first, and the sign-in held by the authentication provider and any stored files follow. Copies a provider keeps under its own terms are covered by that provider’s notice.
Exports, emailed files, calendar copies, published social posts and a recipient’s own records do not disappear when the original is removed from Ruckr. The controller must address those copies too. Backup copies remain protected and expire through the applicable backup cycle; they must not be restored for ordinary use in a way that defeats an erasure decision.
09Providers and international processing
The provider register separates core service infrastructure, sharing enabled by a club, and connections chosen by an individual. It explains the data, purpose, choice and provider role for each. An optional connection does not give that provider general access to a club’s records.
The main application database and API are configured in London. Uploaded object files use EU storage. This is not a promise that all processing stays in the UK: authentication, email, payments, device services, optional integrations and provider support can involve other countries.
Restricted international transfers require an applicable adequacy arrangement or appropriate contractual safeguards, together with any necessary transfer assessment and supplementary measures. A provider’s country or a privacy-policy link is not, on its own, a transfer safeguard. Clubs can request information about the relevant arrangements from Ruckr, subject to protection of confidential security and contractual information.
10Your choices, requests and complaints
Depending on the processing and its lawful basis, you can ask for access, correction, erasure, restriction or a portable copy; object to processing; and withdraw consent for future use. These rights have conditions and exceptions. Withdrawal does not undo lawful processing before withdrawal, and a request cannot require disclosure of another person’s confidential information.
Use You › Your data and You › Consents where available, or contact the club about its records. Contact Ruckr about your service account, security or support records. If you are unsure who should respond, contact us and we will help route the request. We may need proportionate identity checks; we will not ask for more identification than is necessary.
The responsible controller must respond within the applicable statutory period, normally one month, and explain any permitted extension or restriction. You can complain to that controller and to the UK Information Commissioner. Urgent safeguarding reports should follow the safeguarding routes instead of waiting for a privacy request.
11Getting help
Ruckr support is not an emergency or safeguarding response service. If someone is in immediate danger, call 999 or 112. Otherwise contact your club’s safeguarding lead, the relevant governing body or local safeguarding services. If the concern involves the club lead, use an independent route.
A child or guardian can raise a privacy concern with the club or Ruckr even if they cannot use the in-app account. Explain a safe way to contact you. We and the club must consider the child’s interests and any risk before sending sensitive details to a shared email address.
12Changes and the version you are shown
Each document shows its version date and review status. Material changes must be explained to the people affected before the new processing begins, with any further notice required by law. A public page is the current explanation; an acceptance record must identify the exact document or notice shown at the time.
Reading a privacy notice acknowledges information; it is not blanket consent. Where a club relies on consent for a changed purpose, recipient or activity, it must obtain a fresh, specific choice before that new use. Silence, continued membership and an earlier yes do not authorise an expanded consent-based purpose. Necessary processing based on a different lawful basis must be assessed and explained separately.