Impact Netball Club Privacy Notice

Last updated: 19 September 2026

This Privacy Notice explains how Pegasus Sports Media Limited handles personal data in connection with the Impact Netball Club app. It should be read with the agreement between Pegasus Sports Media and the relevant school or club and, where applicable, the Data Processing Agreement.

1. Who We Are and Our Data-Protection Roles

Pegasus Sports Media Limited provides the Impact Netball Club service and can be contacted at 5 Swan Place, Westerham, Kent TN16 1UF, United Kingdom.

Where a school or club decides why and how athlete, team, fixture and game-performance data is used, that school or club is the Data Controller. Pegasus Sports Media acts as its Data Processor, processing that data only to provide the service and on the controller's documented instructions.

Pegasus Sports Media acts as an independent Data Controller for the personal data it uses for user-account administration, subscription and billing administration, customer support, service security, fraud prevention, legal compliance and management of its commercial relationship with the school or club.

A user may be separately authorised to access more than one school or club. Each organisation is shown and accessed separately. Its information is not combined with another organisation's information merely because the same user has access to both.

2. Personal Data Processed

Depending on use of the service, the following personal data may be processed:

• Account and access data: email address, authentication identifier, organisation membership, assigned role and permissions.
• Organisation and athlete data: school or club details, team details, athlete names or identifiers, squad membership, fixtures, opponents, locations, dates and times, game events, performance metrics and statistics.
• User-provided content: logos, team sheets, images or other information an authorised user chooses to upload or enter.
• Technical and service data: authentication events, synchronisation status, device or operating-system information, IP address, diagnostic and security logs, support correspondence and account-deletion requests.

Schools and clubs must not enter medical, safeguarding or other special-category personal data unless this has been expressly agreed with Pegasus Sports Media and the controller has established an appropriate lawful basis and safeguards.

Passwords are handled through Supabase authentication. Where a user chooses the app's remember-me feature, login details are stored using the device's secure credential storage.

3. Children and Athlete Data

Impact Netball Club is intended to be administered by authorised school, club and coaching users. A school or club may enter information about child athletes even though the app is not directed at children as account administrators.

The school or club is responsible for determining and documenting the lawful basis for processing athlete data, providing the required privacy information to athletes and parents or guardians, and ensuring access is granted only to appropriate authorised users.

Pegasus Sports Media processes school- or club-controlled athlete data only to provide the service and assist the controller with its data-protection obligations. Requests concerning an athlete's school or club record should normally be made to that school or club first.

4. Purposes and Lawful Bases

When acting as a processor, Pegasus Sports Media uses personal data to host, synchronise and display authorised organisation data; support offline game recording; produce statistics and reports; maintain the service; provide support; and follow the controller's documented instructions. The school or club determines the lawful basis for its processing.

When acting as a controller, Pegasus Sports Media relies on contractual necessity to administer accounts and subscriptions, legitimate interests to secure and support the service and manage its customer relationships, and legal obligations for accounting, regulatory and law-enforcement requirements. Consent is used only where appropriate and can be withdrawn.

Personal data is not sold, used for third-party behavioural advertising or used to make solely automated decisions that have legal or similarly significant effects on an individual.

5. Service Providers and Other Recipients

• Supabase provides hosted database, authentication and storage services.
• PowerSync provides data synchronisation and supports the app's local offline data cache.
• SMTP2GO is used for transactional email, including account-deletion requests.
• GoCardless separately processes subscription-payment information under its own privacy terms. Pegasus Sports Media does not receive or store users' full bank or card credentials in the app.

Personal data may also be disclosed to professional advisers, a successor in a genuine business transfer, public authorities or law enforcement where necessary and lawful. A current sub-processor schedule is available from impactnetball@pegasus-sports-media.com.

6. Hosting, Organisation Separation and Local Storage

The Supabase project's primary database, authentication and storage data is hosted in AWS region eu-west-2 (London, United Kingdom). PowerSync is configured to host synchronised application data in its European Union region, and SMTP2GO is configured to use its European Union service region. Provider support and administrative processing locations are described in the current sub-processor schedule and applicable supplier terms.

Row Level Security is enabled on the Supabase tables used by the service. Access is based on the authenticated user and their school or club permissions. A user authorised for multiple organisations may switch between them, but each organisation's records remain separately permissioned and are not made visible to another organisation.

A subset of authorised data is stored in a local PowerSync database on the device so that game recording can continue without a network connection and synchronise after connectivity returns. Users and organisations must protect devices with suitable passcodes, operating-system updates and physical access controls.

Reports and other exports are saved or shared only to a destination selected by the user. Once exported from the app, the receiving organisation and user are responsible for protecting and deleting those copies.

7. Data Retention and Deletion

School- and club-controlled data is normally retained while the relevant service is active and afterwards only for the period agreed with, or instructed by, the controller and as required by law. A controller may request export or deletion of its organisation data. Deleting an organisation's historical athlete and game data will also remove the history that would otherwise support an athlete's individual metrics and cannot be reversed.

After a verified user-account deletion request, Pegasus Sports Media manually removes the user's authentication account and direct user or organisation associations, normally within 48 hours. Organisation-controlled athlete, fixture or game records are not automatically deleted merely because an individual user account is removed; their retention remains subject to the controller's instructions and applicable law.

The local PowerSync cache is preserved during a temporary loss of connectivity, an app force-close and a same-user re-login. Following an explicit logout, it may be retained for up to 48 hours to allow the same user to recover unsynchronised work. It is cleared when a different user signs in or, after the 48-hour period expires, the next time the app is opened and PowerSync is initialised.

Transactional email delivery records, security logs, support records and accounting or contractual records are retained only for their operational or legal purpose. Accounting and transaction records may normally be retained for up to six years where required by UK law.

Deleted data may remain temporarily in restricted rolling backups until the relevant service provider's backup cycle overwrites it. Backups are used for disaster recovery and are not used to restore deleted data to ordinary service. If a backup must be restored, applicable deletion instructions will be reapplied.

8. Individual Rights and Requests

Depending on the circumstances, individuals may have rights of access, rectification, erasure, restriction, objection and data portability, and the right to complain to the UK Information Commissioner's Office.

For athlete, team and game data controlled by a school or club, requests should be sent to that organisation. Pegasus Sports Media will assist the controller in responding. For data controlled directly by Pegasus Sports Media, contact impactnetball@pegasus-sports-media.com.

Identity and authority may be verified before a request is completed. Some information may be retained where required by law or where another lawful exemption applies. Information about complaining to the ICO is available at ico.org.uk.

9. International Data Transfers

Some service providers or their support operations may process personal data outside the United Kingdom. Pegasus Sports Media does not rely on an individual's consent as the routine safeguard for these transfers.

Where UK personal data is transferred to a country without UK adequacy regulations, Pegasus Sports Media uses an appropriate transfer mechanism such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission Standard Contractual Clauses, together with a transfer risk assessment and supplementary safeguards where required.

10. Technical and Organisational Security Measures

Security measures include authenticated access, role- and organisation-based permissions, Supabase Row Level Security, encrypted network connections used by cloud providers, cloud-provider encryption at rest, device secure storage for remembered credentials, access limitation, software and dependency maintenance, backup and recovery arrangements, and incident investigation and response procedures.

Supabase reports SOC 2 Type 2 and ISO 27001 compliance, and PowerSync reports an independently audited SOC 2 Type 2 programme. These are supplier certifications or assurance reports and must not be interpreted as certifications held directly by Pegasus Sports Media.

No method of transmission or storage is risk-free. Schools, clubs and users must use unique credentials, protect their devices, restrict access to authorised personnel and promptly report suspected compromise to impactnetball@pegasus-sports-media.com.

11. Changes and Contact

This Privacy Notice may be updated from time to time. Material changes will be notified to customer organisations or displayed in the service where appropriate, and the Last Updated date will be revised.

Data-protection contact:
Pegasus Sports Media Limited
5 Swan Place, Westerham, Kent TN16 1UF, United Kingdom
impactnetball@pegasus-sports-media.com