Privacy Policy

Last updated: 15 October 2026

1. Introduction

ClubDeck ("we", "us", "our") is operated by jlehtimaki Consulting Oy, a Finnish limited company (business ID 3421726-7). jlehtimaki Consulting Oy is the controller for the personal data described in this policy. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you use our sports club management platform ("the Service").

This policy applies to all users of the Service, including administrators, coaches, players, and guardians. We are based in the European Union and process data in accordance with the General Data Protection Regulation (GDPR).

2. Data We Collect

Account Information

When you create an account, we collect:

• Name and email address
• Authentication credentials (managed by our authentication provider)
• Role within your organization (admin, coach, player, guardian)

Club and Team Data

When you use the Service, you or your club administrators may provide:

• Organization and team names
• Player profile information (name, position, jersey number, skill ratings)
• Event and schedule data
• Availability responses
• Chat messages and team communications
• Help & feedback requests you send from the app: your message, an optional screenshot, and the context shown before you send (page, browser and device type, app version, club, language, time zone), stored so we can handle the request
• Lineup and team configuration data

When a club is created, the club record also stores how the club found ClubDeck (campaign tags from the link used, any referral code, and the optional “How did you hear about us?” answer) so we can understand which channels work; it is kept with the club and deleted with it, and it is not used to profile individuals.

Payment Information

If you use billing features, payment processing is handled by our payment provider. We do not store credit card numbers or full payment credentials. The payment provider collects and processes payment data under its own privacy policy. We receive limited transaction information (amount, payment and refund status, and the payment provider’s reference IDs) for record-keeping. When a club subscribes to a paid plan, the checkout requires a billing address, which is saved with the club’s customer record at the payment provider.

Referral program

When a club uses a referral code, we record which club referred which. The referring club’s administrators see the referred club’s name and its status (pending, active or lapsed), and the referred club sees the referring club’s name when it enters the code. To stop clubs from referring themselves to earn a discount, we check whether the two clubs are the same: when a referred club pays its first invoice, we compare the clubs’ administrators, names and URL names, and details held by our payment provider for their customer accounts: the customer email address (and its domain), the billing address, tax IDs, and a card fingerprint (a code that identifies a card without revealing its number). These details are read from the payment provider only for this comparison and are not stored by ClubDeck. We keep the outcome: whether the referral was accepted or rejected, the reason (for example shared administrator, customer account, card or tax ID), and derived flags such as “same email domain”, without the compared values. A referral that matches on an administrator, customer account, card or tax ID is rejected automatically. The legal basis is our legitimate interest in preventing abuse of the program (section 4). The referral record is kept for as long as the referring or the referred club exists and is deleted with either of them. If you think a referral was rejected by mistake, write to privacy@clubdeck.fi.

Usage Data

We automatically collect:

• IP address
• Browser type and device information
• Pages visited and features used
• Timestamps of access

3. How We Use Your Data

We use your data to:

• Provide, maintain, and improve the Service.
• Authenticate your identity and manage account access.
• Enable club management features (rosters, scheduling, communication).
• Process billing and invoicing through our payment provider.
• Send transactional notifications (event reminders, availability requests).
• Monitor and ensure the security and stability of the Service.
• Comply with legal obligations.

We do not sell your personal data. We do not use your data for advertising or profiling purposes.

4. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

• Contract: Processing necessary to provide the Service you have signed up for.
• Legitimate interest: Improving the Service, ensuring security, and preventing abuse.
• Consent: Where we request your explicit consent for specific processing activities.
• Legal obligation: Where we are required to process data by applicable law.

5. Data Sharing

We share your data only in the following circumstances:

• Within your club: Club administrators can see members’ email addresses, and the email addresses of people who interact with the club, such as donors, ticket buyers, event registrants and people who apply to join. Coaches, players and guardians cannot see other people’s email addresses: they see their own, and a guardian also sees the addresses of the members they are guardian of. Members can see each other’s names, positions and availability as needed for team coordination, and coaches can also see the player information they need to run the team. Email address is the only contact detail ClubDeck stores about members; we do not collect phone numbers or postal addresses.
• Service providers: We use third-party services to operate the platform, including our hosting provider in the EU, our authentication provider, our payment provider and our email service provider. These providers process data on our behalf under data processing agreements. Push notifications to the mobile app are delivered through the push-notification service of your device’s operating system. A list of the service providers that process personal data on our behalf is available on request at privacy@clubdeck.fi.
• Legal requirements: We may disclose data if required by law, regulation, or legal process.

We do not share your data with third parties for their own marketing purposes.

Address search

When you type at least three characters into the location field of an event, the web app and the mobile app suggest matching addresses. The suggestions come from a public address search service run by a company in Germany. Your browser or device sends the text you typed straight to that service, without going through ClubDeck servers, so the service also receives your IP address. ClubDeck does not send your name, email address or any account details with these requests. The service handles them under its own privacy policy, not under an agreement with ClubDeck. No request is made unless you type in a location field.

Embedded videos

Drill videos hosted on external video services load only after you click play. Until then nothing is sent to the video service. After you click, your browser or device contacts the video service directly, and it handles that request under its own privacy policy.

6. Data Storage and Security

The ClubDeck database, uploaded files, server logs and the visit measurement data described in section 10 are stored by our hosting provider on servers within the European Union. Some of the service providers listed in section 5 process data outside the EU/EEA, mainly in the United States: our authentication provider (for sign-in), our payment provider, our email service provider, and the push-notification services, which run on their providers’ global infrastructure. Our authentication, payment and email service providers cover these transfers with appropriate safeguards, such as the EU Standard Contractual Clauses. We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS) for all traffic between your browser or app and the Service.
• Access controls and authentication for all systems.
• Regular security reviews.

While we take reasonable precautions, no system is completely secure. You are responsible for maintaining the security of your account credentials.

7. Data Retention

We retain your data for as long as your account is active and as needed to provide the Service. Specifically:

• Account data: Retained while your account is active. When you delete your account in the app, it is anonymised immediately: we remove your name, email address, profile photo and profile details, and delete your login. Your club membership stays in the club's records without identifying details so that invoices and club history stay consistent, and chat messages you wrote stay in the club's channels without your name.
• Club and team data: Retained while the associated organization is active.
• Uploaded images and files: Your profile photo is deleted when you delete your account, and a club's files are deleted when the club is deleted. Files that are no longer used anywhere, such as a replaced profile photo, are deleted automatically by a weekly clean-up once they are more than 7 days old.
• Chat messages: Retained while the associated organization exists. Deleting a team does not delete its chat messages.
• Billing records: Kept for the periods the Finnish Accounting Act requires (kirjanpitolaki 1336/1997, chapter 2, section 10): accounting vouchers such as invoices for at least 6 years from the end of the year in which the financial year ended, and the books for at least 10 years from the end of the financial year. When a member is removed from a club or deletes their account, their invoices stay with the club for its bookkeeping, with the name as it was when the invoice was created. If a club is deleted, its invoices are deleted with it, so the club should export its records first. ClubDeck keeps the records of its own subscription billing for the same periods.
• Referral records: Kept while the referring or the referred club exists, and deleted with either of them (see Referral program in section 2).
• Usage logs: Deleted automatically after 7 days.
• Visit measurement: The cookieless analytics data described in section 10 is retained for 6 months.

8. Your Rights (GDPR)

As a data subject in the EU, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Portability: Request an export of your data in a structured, machine-readable format.
• Restriction: Request that we limit how we process your data.
• Objection: Object to processing based on legitimate interest.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at privacy@clubdeck.fi. We will respond within 30 days.

9. Children's Privacy

ClubDeck supports guardian-managed accounts for junior teams. In Finland a child can consent to online services on their own from the age of 13 (Data Protection Act 1050/2018, section 5). For a child under 13, a parent or legal guardian manages the child's profile in ClubDeck and gives any consent on the child's behalf. Children under 13 should not create their own account.

10. Cookies and Analytics

The marketing site (clubdeck.fi) sets no cookies, and no part of the Service is used for advertising, for profiling, or for tracking you across other websites.

Visit measurement. clubdeck.fi and the public, signed-out pages of the application are measured with a cookieless analytics service that we run ourselves, on our hosting provider’s servers in the EU. It records the page address, the site that referred you, any utm_* campaign parameters in the link you followed, and coarse technical facts derived from the request: country, browser, operating system and device type. It sets no cookie, stores no identifier in your browser, and gives you no identifier that could follow you to another website. Visits are grouped into sessions by a hash computed on the analytics server from properties of the request; it cannot be reversed. The analytics server sees your IP address in order to derive the country and that hash; the address is not stored with the visit data, so we cannot identify you from this data. Legal basis: our legitimate interest in knowing which of our own pages and links people use (Art. 6(1)(f) GDPR).

Measurement stops at the login wall. The pages reported are clubdeck.fi, its documentation and its language versions, and the signed-out pages of the application (sign-in, registration, and the public club, event and ticket pages). Pages you see as a signed-in user are not reported, and no club, team, member or event identifier is sent to the analytics service: where a public page address contains such a reference, only the shape of the address is reported (for example /club/:slug), never the reference itself.

Campaign memory in local storage. clubdeck.fi, and the signed-out pages of the application, each store one item in your browser's local storage: the campaign parameters of the link that first brought you to us, and any referral code in it, so they are preserved if you go on to sign up. The item is kept for up to 30 days and then deleted. It holds campaign labels, the referral code and a timestamp, no identifier and nothing about you; each site can read only its own item, and you can clear it at any time with your browser's site-data controls. While you sign up, the application also keeps the same labels in the browser tab's session storage until your club is created; that entry is removed then, or when you close the tab. The referral code is not sent to the analytics service.

The application (app.clubdeck.fi) uses essential cookies and local storage for authentication and session management. These are strictly necessary for the Service to function and do not require consent under GDPR.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the revised policy and updating the "Last updated" date. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

12. Contact

For privacy-related questions or to exercise your data rights, contact us at:

privacy@clubdeck.fi

jlehtimaki Consulting Oy
Business ID (Y-tunnus): 3421726-7
Finland