Privacy Policy

1. Introduction

This is the privacy policy for Fixture Deck — booking-management software for clubs and venues, operated by Fixture Deck Ltd (“Fixture Deck”, “we”, “us”). It explains what personal data we collect about you, why we collect it, and what your rights are under UK GDPR and EU GDPR.

In plain English: we only collect what we need to run your account and your booking page, we don’t sell your data, and you can export or delete everything at any time.

2. Who we are

Fixture Deck Ltd is a company registered in Scotland, with its registered office in Glasgow, United Kingdom. For the purposes of UK GDPR, we are the data controller of personal data about visitors and account holders. For the personal data of a club’s own booking customers, the club is the controller and Fixture Deck acts as a data processor on the club’s behalf.

3. What we collect

Account data — your name, email, password (hashed), club name, and (if you sign in with Google) your Google account identifier and avatar.
Billing data — billing details for your subscription. Full card details are handled directly by our payment providers (Stripe, PayPal) and our subscription biller (Lemon Squeezy), and never touch our servers.
Booking content — the resources, bookings, invoices and messages you create in the product.
Customer data — the names, emails, phone numbers and booking history of the people who book with your club. You are the controller of this data; we process it on your behalf.
Usage data — IP address, browser, pages visited and actions taken within the app, for debugging, security and product improvement.

4. How we use it

Provide, maintain and improve the Fixture Deck service.
Process subscription payments and issue invoices & receipts.
Respond to support requests and send service notices.
Prevent fraud, abuse and security incidents.
Comply with our legal obligations (e.g. HMRC record-keeping).

We rely on the following lawful bases under UK GDPR: contract (to deliver the service you signed up for), legitimate interests (to secure and improve our product reasonably), legal obligation, and consent (where required, e.g. for non-essential cookies).

We share personal data only with the sub-processors listed below, each bound by a written data processing agreement. We never sell your personal data, and we do not share it with advertising networks.

Stripe — card payments.
PayPal — PayPal payments.
Lemon Squeezy — Fixture Deck subscription billing.
Resend — transactional email (confirmations, receipts, sign-in links).
Cloudflare — CDN, DDoS protection, DNS.
Google Analytics — anonymous marketing-site analytics, only with your consent.
Our hosting provider — servers located in the UK/EU.

6. How long we keep data

While your account is active, we retain your data for as long as you use Fixture Deck. If you close your account, we delete your data within 30 days, except for records we are required to keep for tax, accounting or anti-fraud reasons (typically six years for UK invoices). Anonymised, aggregated analytics may be retained indefinitely.

7. Your rights

Under UK and EU GDPR you have the right to:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion (“right to be forgotten”) where applicable.
Object to, or restrict, certain processing.
Data portability — a machine-readable export of your data.
Withdraw consent where processing is based on consent.

To exercise any of these rights, email [email protected]. We’ll respond within 30 days.

8. Cookies

We use a small number of cookies to keep you signed in and protect our forms, and — only with your consent — Google Analytics to measure how our marketing pages perform. You can read the full details in our Cookie Policy, and change your preferences at any time using the cookie banner on any page.

9. Security

We encrypt data in transit (TLS 1.2+) and at rest. We run regular backups, least-privilege access controls, and an incident response process. If we ever suffer a personal data breach that is likely to result in a risk to your rights, we will notify both the ICO and you within 72 hours as required by law.

10. International data transfers

We primarily host data in the UK and EU. Some sub-processors (for example Stripe and Google) operate in the United States. Where data is transferred outside the UK/EEA, we use the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, together with supplementary technical measures, as approved safeguards.

11. Changes to this policy

We may update this policy from time to time to reflect changes in the service, the law, or our practices. When we do, we’ll update the “Last updated” date at the top of this page, and for material changes we’ll also notify account holders by email at least 14 days before the changes take effect.

12. Contact

Questions about this policy or how we handle your data? Write to Fixture Deck Ltd, Attn: Privacy, Glasgow, United Kingdom, or email [email protected].

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.