Privacy policy
Information for users of the app, the website and the administration area
This policy explains who processes your personal data, for what purposes, for how long, and how to exercise your rights. It applies to the ClubUp Club Manager app, to the ClubUp website and to the administration area.
1 Identity and roles
ClubUp is operated by SwissClear B.V., a company incorporated under Dutch law, registered under number 98774956, Herengracht 320, 1016 CE Amsterdam, Netherlands, acting in particular through its Geneva branch, Rue des Voisins 8, 1205 Geneva, Switzerland, business identification number CHE-360.039.349.
Data protection contact: hello@clubup.ch.
For data relating to members, teams, legal representatives and club content, the club to which you belong determines the purposes of the processing and acts, in principle, as controller. ClubUp processes such data on behalf of the club, following its instructions.
ClubUp nevertheless acts as controller for the data required to manage its own contractual relationships, billing, support, platform security, abuse prevention and the operation of the website. The identity and contact details of your club are available in the app or may be obtained from its committee.
2 Data processed
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Surname, first name, email address, telephone and postal address where provided | You, your legal representative or your club |
| Club membership | Club, teams, role, membership status and access rights | Your club |
| Content | Messages, announcements, event responses, documents, photographs and reports | You, your club or other authorised members |
| Technical data | User identifier, notification identifier or token, IP address, connection logs and security data | Generated during use |
| Administration and support | Administrators' contact details, support requests, history of administrative actions | Administrators and users |
| Contract and billing | Plan subscribed to, invoices, payment status and contractual correspondence | Club and payment providers |
ClubUp is not intended to receive medical or other sensitive data in free-text fields or documents. A club should upload such data only where this is necessary, lawful, expressly authorised and accompanied by appropriate measures.
3 Purposes and legal bases
| Purpose | Primary role | Legal basis where the GDPR applies |
|---|---|---|
| Create the account, give access to the club's space and provide the requested functions | Club as controller, ClubUp as processor | Performance of the relationship with the club or the club's legitimate interest |
| Manage teams, events, announcements, attendance, documents, messaging and partners | Club as controller, ClubUp as processor | Performance of the association relationship or legitimate interest; consent where required |
| Ensure security, prevent abuse, diagnose incidents and maintain the service | ClubUp as controller for its own operations | Legitimate interest in securing and operating the service |
| Manage the subscription, billing, support and accounting obligations | ClubUp as controller | Performance of the contract and legal obligation |
| Send notifications and transactional emails | Depending on the message, club or ClubUp | Performance of the service or legitimate interest |
Under Swiss law, processing is carried out in accordance with the principles of lawfulness, proportionality, purpose limitation, transparency and security set out in the FADP. Where consent is relied upon, it may be withdrawn with effect for the future without affecting the lawfulness of prior processing.
4 Recipients and visibility
- Authorised club administrators may access the information required to manage members and teams.
- Coaches and team managers access only the data required for their team and their role.
- Other members see the information made visible by the club, for example the name, profile photograph, team or content shared with them.
- Members of another club must not be able to access your data.
- Authorised ClubUp staff and its technical providers access data only to the extent necessary for the provision, security and support of the service.
- Authorities may receive data where the law requires or permits it.
5 Technical providers and transfers
| Provider or service | Function | Region or safeguard |
|---|---|---|
| Google Cloud and Firebase | Authentication, database, storage and notifications | Primary region configured for the project; further processing under Google's terms and its sub-processor register |
| Google Cloud Translation | Translation of content enabled by the club | Location depending on the endpoint and configuration used |
| Vercel Inc. | Hosting and delivery of the website or the administration area | International processing; contractual safeguards and applicable transfer mechanisms |
| Zoho ZeptoMail | Transactional emails | Data centre of the account; support access governed by Zoho's terms |
| Payment providers | Payment and billing of the subscription | Payment data processed directly by the provider concerned |
Where data is transferred to a state that does not benefit from a recognised adequate level of protection, ClubUp relies on a safeguard permitted under applicable law, in particular the European Commission's standard contractual clauses adapted, where necessary, to Swiss law, or a recognised protection framework. Up-to-date information on providers, their processing locations and the applicable safeguards may be requested from hello@clubup.ch.
Content submitted to machine translation may contain information entered by the club. The club must avoid including sensitive or unnecessary data in it.
6 Retention periods
| Data | Period or criterion |
|---|---|
| Account, profile and membership | For the duration of membership or authorised access, then deletion or anonymisation according to the club's instructions and, at the latest, on expiry of the applicable end-of-contract period |
| Messages, announcements, events, responses and documents | Period determined by the club according to its association needs, then deletion or anonymisation; general deletion at the end of the service under the contract |
| Security logs | Twelve months at most, save where required in connection with an incident or a legal obligation |
| Support requests and reports | Up to twelve months after closure, save in the event of a dispute or legal obligation |
| Contractual data and accounting records | Ten years, or any other period imposed by applicable law |
| Backups | Rotation and erasure within a maximum of ninety days after deletion from active systems, subject to confirmed technical capabilities |
At the end of the subscription, the club has thirty days to request or carry out the export provided for in the contract. After that period, deletion or anonymisation in active systems is initiated and completed within thirty days, subject to retention required by law, necessary for establishing rights, or limited to protected backups until their rotation.
7 Your rights
Subject to applicable law and the conditions it lays down, you may request access to your data, its rectification or erasure, restriction of processing, the delivery of certain data in a portable format, or object to processing based on a legitimate interest. You may also withdraw consent with effect for the future.
For processing determined by your club, address your request to the committee or to the club's data protection contact. You may also write to hello@clubup.ch; ClubUp will forward the request to the club or respond to it where ClubUp itself acts as controller. Reasonable verification of identity may be requested.
Deleting an account does not necessarily entail the immediate erasure of every contribution: certain content may be anonymised or retained where a legal obligation, third-party rights, security or the defence of rights so justifies. Backups are deleted in accordance with their rotation cycle.
8 Minors and legal representatives
Clubs may manage minor members and the contact details of their legal representatives. The club determines the appropriate legal basis and obtains the necessary authorisations, in particular for photographs and published content. Parental consent is not the only possible basis and is required only where applicable law or the nature of the processing so requires. A minor's rights may be exercised by their legal representative under the conditions laid down by law.
9 Security
ClubUp implements technical and organisational measures appropriate to the risk, in particular encryption of communications, individualised access management, limitation of privileges, logical separation between clubs, security logging and incident management procedures. As no system can guarantee absolute security, the measures are reassessed in light of the risks and the evolution of the service.
10 Complaints
You may contact your club or ClubUp before making any complaint. You may also contact the Federal Data Protection and Information Commissioner in Switzerland. Where the GDPR applies, you may refer the matter to the competent supervisory authority in the state where you reside, work or believe an infringement has taken place.
11 Changes
This policy may be updated to reflect developments in the service, in providers or in the law. Any substantial change is brought to users' attention by appropriate means. The version and date of update are indicated at the top or foot of the document.
In the event of any discrepancy between language versions, the French version prevails.