01Who we are
Ruckr is the rugby club software service operated as Ruckr Rugby (“Ruckr”, “we”, “us”). Contact [email protected] about the service, these documents or Ruckr’s handling of personal information. Your club is a separate organisation; its name and contact details should appear in its own policies.
02Club decisions and Ruckr’s responsibilities
A club generally controls the information it collects to run memberships, teams, fixtures, communications, payments, welfare and events. It decides the purposes, lawful bases, authorised recipients and retention periods. Ruckr processes those club records on documented instructions under the data processing agreement.
Ruckr separately controls information it needs to run its own service, including account administration, subscriptions, support, security, abuse prevention and legal compliance. A payment, identity or social provider may also have independent responsibilities. Roles depend on what each party actually does, not just the label in a policy.
A club’s privacy notice, membership rules or consent request does not replace Ruckr’s notice, waive an individual’s rights or transfer Ruckr’s own legal duties to the club. Each organisation remains answerable for the processing and conduct for which it is responsible.
03What Ruckr collects for its own purposes
Account identifiers, sign-in email and provider details; club representative and billing contacts; subscription, invoice and payment references; support correspondence; legal acceptance records; security and request logs; and preferences needed to operate the service. We receive these from you, an authorised club officer, your sign-in/payment provider or your use of Ruckr.
We do not need a full medical or safeguarding case in an ordinary support email. Where investigating a specific issue requires access to club information, access must be authorised, limited and recorded through the appropriate support process or otherwise required by law.
04Why we use it and our lawful bases
We use account and subscription information to supply the service you or your club requests and perform the relevant contract. Where an officer is acting for a club rather than contracting personally, administration of that relationship can instead rely on our legitimate interests in providing and managing the service, subject to the officer’s rights.
We use proportionate security, abuse-prevention, diagnostic and support records for our legitimate interests in keeping Ruckr reliable and protecting people. We use invoicing, legal-response and necessary compliance records to meet applicable legal obligations or establish and defend legal claims. Those purposes do not permit unrestricted monitoring of club life.
Optional marketing updates use the consent or other lawful marketing permission applicable to the recipient and message, with an effective opt-out. Optional device and health permissions have their own explanations; accepting the product terms is not consent to marketing or to a club’s optional use of health data.
05Sharing and service decisions
Only people and providers who need information for the stated purpose should receive it. We may disclose necessary records to professional advisers, a competent authority or a prospective successor where lawful, with appropriate confidentiality and safeguards. We do not sell personal information or give sponsors access to member lists merely because they sponsor a club.
The service uses automated checks to operate access, billing and security. These do not replace a club’s responsibility for selection, medical or safeguarding decisions. Contact the responsible organisation if an automated outcome is wrong or you need an explanation or human review.
06Providers and international processing
The provider register separates core service infrastructure, sharing enabled by a club, and connections chosen by an individual. It explains the data, purpose, choice and provider role for each. An optional connection does not give that provider general access to a club’s records.
The main application database and API are configured in London. Uploaded object files use EU storage. This is not a promise that all processing stays in the UK: authentication, email, payments, device services, optional integrations and provider support can involve other countries.
Restricted international transfers require an applicable adequacy arrangement or appropriate contractual safeguards, together with any necessary transfer assessment and supplementary measures. A provider’s country or a privacy-policy link is not, on its own, a transfer safeguard. Clubs can request information about the relevant arrangements from Ruckr, subject to protection of confidential security and contractual information.
07Storage on your device and email
The signed-in app uses session and local device storage for authentication, preferences and supported offline features. Some sensitive offline data needs special protection; use a device lock and avoid sharing an unlocked account. Removing a permission does not necessarily delete an earlier downloaded copy.
The marketing website’s separate notice explains its forms and hosting. Service emails require delivery records. Club newsletters and Ruckr updates have separate purposes and unsubscribe choices; stopping promotional email does not prevent necessary account, payment or safety messages.
08How long Ruckr keeps its own records
We keep account and service records for the period needed to provide the account, resolve support issues, protect the service and meet applicable legal or accounting obligations. Retention depends on the category, the relationship and unresolved matters; it is not an indefinite right to keep everything.
On account closure, we remove or de-identify information no longer needed and restrict any justified remainder. Consent and acceptance evidence may remain to show what was agreed, even after the underlying optional processing stops. Ask us for the applicable period and reason for a particular record.
09Your choices, requests and complaints
Depending on the processing and its lawful basis, you can ask for access, correction, erasure, restriction or a portable copy; object to processing; and withdraw consent for future use. These rights have conditions and exceptions. Withdrawal does not undo lawful processing before withdrawal, and a request cannot require disclosure of another person’s confidential information.
Use You › Your data and You › Consents where available, or contact the club about its records. Contact Ruckr about your service account, security or support records. If you are unsure who should respond, contact us and we will help route the request. We may need proportionate identity checks; we will not ask for more identification than is necessary.
The responsible controller must respond within the applicable statutory period, normally one month, and explain any permitted extension or restriction. You can complain to that controller and to the UK Information Commissioner. Urgent safeguarding reports should follow the safeguarding routes instead of waiting for a privacy request.
10Changes and the version you are shown
Each document shows its version date and review status. Material changes must be explained to the people affected before the new processing begins, with any further notice required by law. A public page is the current explanation; an acceptance record must identify the exact document or notice shown at the time.
Reading a privacy notice acknowledges information; it is not blanket consent. Where a club relies on consent for a changed purpose, recipient or activity, it must obtain a fresh, specific choice before that new use. Silence, continued membership and an earlier yes do not authorise an expanded consent-based purpose. Necessary processing based on a different lawful basis must be assessed and explained separately.