Privacy policy

Last updated: 16 June 2026

About this policy

RinkTracker is a player-development platform for UK ice-hockey academies. This policy explains how personal data is processed when academies, their coaches and staff, and parents or guardians use the service. It is written to align with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Because the platform processes information about junior players who are under 18, we also take account of the Information Commissioner's Office (ICO) Age Appropriate Design Code— commonly known as the Children's Code — and design the product to keep children's data to a minimum and to limit who can see it.

Who is responsible for your data: controllers and processors

Data-protection law distinguishes between a controller (who decides why and how data is processed) and a processor(who processes data on the controller's instructions). RinkTracker sits in two roles depending on the data:

• Academies are the controllers of their players' data. Each academy decides which players to enrol, what assessments to record and who within the academy may access that information. RinkTracker acts as a processor for that academy data, processing it only to provide the service.
• RinkTracker is the controller of account data and any marketing data — for example, the details used to create and secure user accounts, and the contact details of people who request a demo.

For privacy enquiries please email privacy@rinktracker.com. Data-protection matters can be sent to dpo@rinktracker.com.

The data we process

We process the following categories of personal data:

• Account data — names, email addresses, the academy a user belongs to, their role, and authentication details used to keep accounts secure.
• Player development data — skill assessments, athletic and fitness measurements, attendance records, coaching notes and development reports.
• Body-composition data — measurements such as body-fat readings. This is treated as sensitive: it is coach-only and is never shown to parents or in the parent portal.
• Marketing data — contact details supplied by people who ask for a demo or get in touch with us.

Children's data and parental consent

Junior hockey players are under 18, so much of the player development data we process relates to children. We follow a data-minimisationapproach: we only record what an academy needs to support a player's development, and we limit who can see it.

The parent/guardian portal is limited and scoped to linked children. Coaches retain control of the development record; guardians can submit only clearly labelled family actions such as availability, training logs, feedback, messages and account details. Giving a guardian access — and sharing that child's data with them — relies onconsentbeing in place. Academies are responsible for obtaining the appropriate parental consents before a guardian is invited, and for ensuring that the person invited is genuinely the child's parent or guardian.

Our lawful bases for processing

Under UK GDPR we rely on the following lawful bases:

• Legitimate interests— for the day-to-day operation of the academy, such as recording assessments and managing a player's development pathway, where this is necessary and balanced against the interests and rights of the individuals concerned.
• Consent— for parent or guardian access to the portal, and for sharing a child's data with their guardian. Consent can be withdrawn at any time.
• Contract — to provide the platform to academies under our terms of service and to administer user accounts.

Your data-subject rights

Under UK GDPR you have the right to access your data, to rectify inaccurate data, to erasure in certain circumstances, to restrict processing, to data portability, and to object to certain processing. Where processing is based on consent, you can withdraw that consent at any time.

Because academies are the controllers of player data, requests about a player's record are usually best directed to the relevant academy in the first instance. You can also contact us at privacy@rinktracker.com and we will help route your request appropriately.

How long we keep data

We keep personal data only for as long as it is needed for the purposes set out in this policy, or for as long as the academy that controls it requires. Account data is retained while an account is active. Player development data is retained at the direction of the controlling academy. When an academy stops using RinkTracker, its workspace data is exported, returned or deleted according to the academy's written instructions and any contractual, safeguarding or legal retention requirements that apply.

Where your data is held and international transfers

RinkTracker uses cloud providers to host the application, database, authentication, email delivery and video processing. Where providers process personal data outside the UK or European Economic Area, we rely on appropriate safeguards required by UK GDPR, such as standard contractual clauses, a UK international data transfer addendum, or an adequacy decision.

How we keep data secure

We apply technical and organisational measures appropriate to the data, including:

• Row-level tenant isolationso that each academy's data is separated and one academy cannot see another's records.
• Encryption in transit for data moving between your browser and our servers.
• Role-based access control so that staff only see the data appropriate to their role, and sensitive items such as body-composition data remain coach-only.

Sub-processors

We use carefully selected service providers to operate RinkTracker. Current core sub-processors include Supabase for database, authentication and storage services; Vercel for application hosting; Mux for uploaded video processing and playback; Resend for transactional email delivery; GoCardless for Direct Debit payment collection; and, where a coach requests AI-assisted drafting, model providers reached through Vercel AI Gateway. Sub-processors are engaged under written terms that require them to protect personal data and process it only for the service. The current list is maintained at rinktracker.com/legal/subprocessors.

Complaints and the ICO

If you have a concern about how your data is handled, please contact us first at dpo@rinktracker.comso we can try to put things right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at https://ico.org.uk/.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top of this page.