Data processing
Data processing agreement
When your club keeps its members' personal information on Club Routes, your club decides what's collected and why (the controller), and Gear Labs Marketing Ltd stores and handles it for you (the processor). This agreement sets out how we do that, as Article 28 of the UK GDPR requires. It forms part of the terms of service and applies for as long as we hold the club's member information.
It doesn't cover information we decide how to use ourselves, such as members' own Club Routes accounts, check-ins, sign-ins and the adverts shown in the app. That's covered by our privacy notice, where we're the controller.
1. What's covered
| Purpose | Running the club's membership: joining, payments, renewals, reminders, the members list and exports, and member cards |
| People | The club's members, people who apply to join, family members on a joint membership, and emergency contacts |
| Information | Names, email addresses, phone numbers, postal addresses, dates of birth, gender, England Athletics numbers, emergency contacts, membership type, dates and payment status, and notes the club adds |
| Special category data | None, unless the club chooses to collect it (for example a medical note); the club is responsible for having a lawful basis for that |
| How long | While the club uses Club Routes, then as in section 8 |
The club decides which of the optional fields its join form asks for.
2. What we do
- Handle the information only on the club's documented instructions: these terms, the club's settings, and what the club's committee does in the portal. If we're ever required by law to do otherwise, we'll tell the club first, unless the law stops us.
- Make sure everyone at Gear Labs who can see the information is bound by confidentiality.
- Keep it secure, with the measures in section 3.
- Use only the sub-processors in section 4, under written terms that protect the information at least as well as this agreement.
- Help the club respond to members using their rights (access, correction, deletion, objection), mainly through the portal's own tools: the members list, editing, deleting and export.
- Help the club with its own security, breach and data protection impact assessment duties, as far as is reasonable given what we do.
- Delete or return the information when the club leaves (section 8).
- Give the club the information it needs to show we're meeting these duties (section 9).
We never use the club's member records for advertising, sponsorship or our own marketing, never give them to advertisers or sponsors, and never combine them with advertising data. Adverts and sponsored content in the Club Routes app (terms of service, section 10) rely only on members' own Club Routes accounts, under our privacy notice.
3. Security
- Information is encrypted in transit (HTTPS) and at rest.
- Committee members sign in with an emailed one-time code or a passkey, and see only what their role allows. Members' details are only visible to roles the club gives the Members permission.
- Sensitive actions, such as downloading the club's data, ask the person to confirm it's them, and are written to the club's activity list.
- Card details go straight to Stripe and never reach Club Routes.
- The database is backed up every night. Daily backups are kept for 30 days, and one a month for 12 months.
- Only Gear Labs staff who need to can reach the service's systems, and staff sign-ins are logged.
4. Sub-processors
| Company | What it does | Where |
|---|---|---|
| Cloudflare, Inc. | Hosts the service, database and files; sends emails | Worldwide network; covered by the UK Extension to the EU-US Data Privacy Framework |
| Stripe Payments Europe Ltd and Stripe, Inc. | Takes membership payments (to the club's own Stripe account) and Club Routes plan payments | Ireland and the United States |
We'll tell the club's owners by email at least 30 days before adding or replacing a sub-processor. The club can object on reasonable data protection grounds; if we can't resolve it, the club can cancel and we'll refund the unused part of any period it's paid for.
The portal's Ask box (run by Anthropic) is never sent members' personal information.
5. Transfers outside the UK
Where a sub-processor handles information outside the UK, the transfer is covered by UK adequacy regulations or the UK International Data Transfer Addendum.
6. Breaches
If we find a personal data breach affecting the club's information, we'll tell the club's owners without undue delay, and within 48 hours of finding it. We'll say what happened, what information and how many people are affected, what we've done, and who to contact. The club decides whether to report it to the ICO or tell its members, and we'll help.
7. The club's responsibilities
The club makes sure it has a lawful basis for the information it collects, tells members how it's used (for example in its own privacy notice), keeps it accurate, and only gives the Members permission to people who need it.
8. When the club leaves
The club can download all its members' information as a spreadsheet at any time. When the Members plan ends, we keep the information for 12 months so the club can start again, unless the club asks us to delete it sooner. After that, or when the club asks, we delete it, and it drops out of our backups as they expire, within 12 months. We may keep payment records where the law requires it.
9. Checks
We'll answer reasonable questions about how we protect the information, in writing. If the ICO requires it, or after a breach, we'll allow a reasonable audit, at the club's cost, with at least 30 days' notice.
10. Liability and contact
Liability under this agreement is as set out in the terms of service. Data protection questions go to dpo@gear-labs.com. Gear Labs Marketing Ltd is registered with the Information Commissioner's Office (registration ZB522575).