Privacy policy
Information for users of the app, the website, the administration area and ClubUp Partners
This policy explains who processes your personal data, for what purposes, for how long, and how to exercise your rights. It applies to the ClubUp Club Manager app, to the ClubUp website, to the administration area and to the ClubUp Partners platform.
1 Identity and roles
ClubUp is operated by SwissClear B.V., a company incorporated under Dutch law, registered under number 98774956, Herengracht 320, 1016 CE Amsterdam, Netherlands, acting in particular through its Geneva branch, Rue des Voisins 8, 1205 Geneva, Switzerland, business identification number CHE-360.039.349.
Data protection contact: hello@clubup.ch.
For data relating to members, teams, legal representatives and club content, the club to which you belong determines the purposes of the processing and acts, in principle, as controller. ClubUp processes such data on behalf of the club, following its instructions.
ClubUp nevertheless acts as controller for the data required to manage its own contractual relationships, billing, support, platform security, abuse prevention and the operation of the website. The identity and contact details of your club are available in the app or may be obtained from its committee.
2 Data processed
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Surname, first name, email address, telephone and postal address where provided | You, your legal representative or your club |
| Club membership | Club, teams, role, membership status and access rights | Your club |
| Content | Messages, announcements, event responses, documents, photographs and reports | You, your club or other authorised members |
| Technical data | User identifier, notification identifier or token, IP address, connection logs and security data | Generated during use |
| Administration and support | Administrators' contact details, support requests, history of administrative actions | Administrators and users |
| Contract and billing | Plan subscribed to, invoices, payment status and contractual correspondence | Club and payment providers |
ClubUp is not intended to receive medical or other sensitive data in free-text fields or documents. A club should upload such data only where this is necessary, lawful, expressly authorised and accompanied by appropriate measures.
3 Purposes and legal bases
| Purpose | Primary role | Legal basis where the GDPR applies |
|---|---|---|
| Create the account, give access to the club's space and provide the requested functions | Club as controller, ClubUp as processor | Performance of the relationship with the club or the club's legitimate interest |
| Manage teams, events, announcements, attendance, documents, messaging and partners | Club as controller, ClubUp as processor | Performance of the association relationship or legitimate interest; consent where required |
| Ensure security, prevent abuse, diagnose incidents and maintain the service | ClubUp as controller for its own operations | Legitimate interest in securing and operating the service |
| Manage the subscription, billing, support and accounting obligations | ClubUp as controller | Performance of the contract and legal obligation |
| Send notifications and transactional emails | Depending on the message, club or ClubUp | Performance of the service or legitimate interest |
Under Swiss law, processing is carried out in accordance with the principles of lawfulness, proportionality, purpose limitation, transparency and security set out in the FADP. Where consent is relied upon, it may be withdrawn with effect for the future without affecting the lawfulness of prior processing.
4 Recipients and visibility
- Authorised club administrators may access the information required to manage members and teams.
- Coaches and team managers access only the data required for their team and their role.
- Other members see the information made visible by the club, for example the name, profile photograph, team or content shared with them.
- Members of another club must not be able to access your data.
- Authorised ClubUp staff and its technical providers access data only to the extent necessary for the provision, security and support of the service.
- Authorities may receive data where the law requires or permits it.
5 Technical providers and transfers
| Provider or service | Function | Region or safeguard |
|---|---|---|
| Google Cloud and Firebase | Authentication, database, storage and notifications | Primary region configured for the project; further processing under Google's terms and its sub-processor register |
| Google Cloud Translation | Translation of content enabled by the club | Location depending on the endpoint and configuration used |
| Vercel Inc. | Hosting and delivery of the website or the administration area | International processing; contractual safeguards and applicable transfer mechanisms |
| Zoho ZeptoMail | Transactional emails | Data centre of the account; support access governed by Zoho's terms |
| Payment providers | Payment and billing of the subscription | Payment data processed directly by the provider concerned |
Where data is transferred to a state that does not benefit from a recognised adequate level of protection, ClubUp relies on a safeguard permitted under applicable law, in particular the European Commission's standard contractual clauses adapted, where necessary, to Swiss law, or a recognised protection framework. Up-to-date information on providers, their processing locations and the applicable safeguards may be requested from hello@clubup.ch.
Content submitted to machine translation may contain information entered by the club. The club must avoid including sensitive or unnecessary data in it.
6 ClubUp Partners
ClubUp Partners is the platform connecting clubs with businesses wishing to support them, available at partners.clubup.app. It is technically separate from the app and the administration area, and this article describes the processing specific to it.
For data processed on ClubUp Partners, ClubUp acts as controller. That differs from the position for member data in the app, where the club is controller and ClubUp is processor.
The people concerned are those who create an account or enter into contact on the platform: the representatives of sponsor businesses and the people appointed by a club to publish and manage its offers.
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Surname, first name, email address, telephone, role | You, when creating the account |
| Business | Company name, address, sector, website, VAT number where required | You |
| Offers and exchanges | Published listings, descriptions, photographs, messages exchanged between club and sponsor, requests for quotations | You or your counterpart |
| Orders and payments | Orders, amounts, dates, payment status, supporting documents. Card details are processed directly by the payment provider and are not retained by ClubUp | You and the payment provider |
| Graphic material | Logos and advertising visuals supplied for display | The sponsor |
| Technical logs | Account identifier, IP address, connection logs and security data | Your device |
This data is used to create and manage the account, publish and browse offers, enable exchanges between a club and a sponsor, process orders and payments, calculate and collect the commission provided for in the terms and conditions, issue invoices and supporting documents, prevent abuse and secure the platform. Where the GDPR applies, the basis is performance of the contract or pre-contractual steps, the legitimate interest in operating and securing the platform, and compliance with legal obligations, in particular accounting obligations.
| Recipient | What is disclosed to them |
|---|---|
| The club concerned | The contact details of the sponsor's representative and the content of the exchanges, where the sponsor makes contact or places an order with it |
| The sponsor concerned | The contact details of the person appointed by the club and the content of the exchanges |
| Other clubs and sponsors | Nothing, other than published offers, which are public by nature |
| Authorised ClubUp staff | The data required for operation, advertising approval, invoicing and support |
| Provider or service | Function | Region or safeguard |
|---|---|---|
| Sharetribe | Hosting and operation of the ClubUp Partners platform, accounts, listings, messaging and orders | European Union |
| Stripe | Payment processing and payouts, fraud prevention and identification obligations | International processing; contractual safeguards and recognised transfer mechanisms |
| Data | Period or criterion |
|---|---|
| Account and business profile | For the life of the account, then deletion or anonymisation within thirty days of its closure |
| Listings and exchanges | For the period of publication, then twelve months, so that any dispute can be handled |
| Orders, invoices and supporting documents | Ten years, in accordance with accounting retention obligations |
| Security logs | Twelve months at most, unless an incident requires otherwise |
The rights described in article 8 are exercised for this processing directly with ClubUp, at hello@clubup.ch, without going through a club.
7 Retention periods
| Data | Period or criterion |
|---|---|
| Account, profile and membership | For the duration of membership or authorised access, then deletion or anonymisation according to the club's instructions and, at the latest, on expiry of the applicable end-of-contract period |
| Messages, announcements, events, responses and documents | Period determined by the club according to its association needs, then deletion or anonymisation; general deletion at the end of the service under the contract |
| Security logs | Twelve months at most, save where required in connection with an incident or a legal obligation |
| Support requests and reports | Up to twelve months after closure, save in the event of a dispute or legal obligation |
| Contractual data and accounting records | Ten years, or any other period imposed by applicable law |
| Backups | Rotation and erasure within a maximum of ninety days after deletion from active systems, subject to confirmed technical capabilities |
At the end of the subscription, the club has thirty days to request or carry out the export provided for in the contract. After that period, deletion or anonymisation in active systems is initiated and completed within thirty days, subject to retention required by law, necessary for establishing rights, or limited to protected backups until their rotation.
8 Your rights
Subject to applicable law and the conditions it lays down, you may request access to your data, its rectification or erasure, restriction of processing, the delivery of certain data in a portable format, or object to processing based on a legitimate interest. You may also withdraw consent with effect for the future.
For processing determined by your club, address your request to the committee or to the club's data protection contact. You may also write to hello@clubup.ch; ClubUp will forward the request to the club or respond to it where ClubUp itself acts as controller. Reasonable verification of identity may be requested.
Deleting an account does not necessarily entail the immediate erasure of every contribution: certain content may be anonymised or retained where a legal obligation, third-party rights, security or the defence of rights so justifies. Backups are deleted in accordance with their rotation cycle.
9 Minors and legal representatives
Clubs may manage minor members and the contact details of their legal representatives. The club determines the appropriate legal basis and obtains the necessary authorisations, in particular for photographs and published content. Parental consent is not the only possible basis and is required only where applicable law or the nature of the processing so requires. A minor's rights may be exercised by their legal representative under the conditions laid down by law.
10 Security
ClubUp implements technical and organisational measures appropriate to the risk, in particular encryption of communications, individualised access management, limitation of privileges, logical separation between clubs, security logging and incident management procedures. As no system can guarantee absolute security, the measures are reassessed in light of the risks and the evolution of the service.
11 Complaints
You may contact your club or ClubUp before making any complaint. You may also contact the Federal Data Protection and Information Commissioner in Switzerland. Where the GDPR applies, you may refer the matter to the competent supervisory authority in the state where you reside, work or believe an infringement has taken place.
12 Changes
This policy may be updated to reflect developments in the service, in providers or in the law. Any substantial change is brought to users' attention by appropriate means. The version and date of update are indicated at the top or foot of the document.
In the event of any discrepancy between language versions, the French version prevails.