Privacy policy

Last updated: 8 July 2026

Football Development Centres Ltd, trading as FDC Academy ("we", "us"), runs weekly football coaching sessions for children and manages memberships through the FDC Academy member portal (web and iOS/Android app). This policy explains what personal data we collect, why, and what your rights are under UK GDPR and the Data Protection Act 2018.

1. Who we are

Football Development Centres Ltd is the data controller. Our contact details are at the bottom of this page.

2. What we collect

When a parent or carer enquires or signs up, we collect:

• Parent details: full name, email address, phone number, postcode (from the "find a nearby venue" tool)
• Child details: full name, date of birth, gender, playing position, medical conditions or allergies (if voluntarily provided), photo consent status
• Session preferences: preferred venue, day, and time
• Membership + payment records: subscription status, direct debit mandate reference, payment history (via GoCardless — we do not store card or bank account numbers ourselves)
• Communications: messages you send us through the portal's support inbox, and our replies
• Technical data: device push-notification tokens (if you opt in to notifications), IP address at the time of enquiry (for spam and abuse prevention)
• App usage: which sessions your child is registered for, attendance records, coaching assessments (if applicable)

3. Why we use it (legal basis)

• To run your membership (contract): booking trials, invoicing, session administration, safeguarding.
• To take payments (contract + legitimate interest): monthly direct debits via GoCardless; sending payment confirmations and failure notifications.
• To keep you informed (legitimate interest / consent for push notifications): announcements about sessions, trial invitations, admin replies to your questions. You can turn off push notifications in the portal at any time.
• To meet legal obligations: record-keeping for tax and accounting, safeguarding audit trails.
• To improve the service (legitimate interest): reviewing which sessions are popular, spotting attendance patterns.

We do not use your data for advertising or profiling, and we do not sell it to anyone.

4. Who we share it with

We use a small number of trusted processors to run the service. Each is bound by a data-processing agreement:

• GoCardless — for direct debit collection. GoCardless is regulated by the FCA. They see the payer name, email, and bank details you enter in their form.
• Spond — for session attendance and RSVPs. They receive the child's name and the sessions they're registered for.
• Cloud infrastructure — our servers are hosted in the UK/EU. We use standard cloud provider services (email delivery, push-notification relay) that see the minimum needed to perform their function.
• Coaches — session coaches see the registered attendees for their session, including relevant medical notes (allergies, conditions) so they can respond in an emergency.

We do not share your data with advertising networks or data brokers.

5. How long we keep it

• Active members: for the duration of the membership.
• Enquiries that don't convert: up to 12 months, then anonymised or deleted.
• Former members: up to 6 years after leaving, for tax and safeguarding record-keeping obligations, then deleted.
• Support messages: up to 3 years, then archived.

6. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you or your child;
• Correct anything inaccurate;
• Delete your data (subject to legal record-keeping obligations);
• Object to processing based on legitimate interest;
• Withdraw consent for push notifications or marketing at any time;
• Data portability — receive your data in a machine-readable format;
• Complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, email enquiries@fdcacademy.co.uk. We'll respond within 30 days.

7. Security

We use industry-standard measures to keep your data safe: TLS encryption in transit, encrypted databases at rest, access controls that limit staff to only the data they need, and offsite backups. Nothing is 100% bulletproof, but we work hard to reduce risk.

8. Push notifications

If you install the FDC Academy iOS or Android app and grant notification permission, we store an anonymous device token to send you push alerts (trial invitations, session announcements, admin replies). You can turn message notifications off inside the portal under My Account → Notifications, or revoke permission entirely in your phone's system settings.

9. Cookies

The web portal uses one first-party cookie to keep you signed in. We do not use tracking or advertising cookies. The app does not use cookies at all — it uses a locally stored auth token instead.

10. Changes to this policy

If we make material changes, we'll update the "Last updated" date at the top and, if the change affects how we use your data, we'll email you. Continued use of the portal after changes means you accept the updated policy.