Privacy Notice

1. Who can use RefSorted

Referees may register from age 14. Organiser accounts are for adults aged 18 or over. A referee aged 14 to 17 must provide parent, legal guardian or carer details and complete the protected confirmation process.

2. Information we use

• Account email, name, role and authentication or security records.
• Date of birth, outward postcode and travel radius.
• Adult match-contact phone. For an under-18 referee, the guardian phone is used and the young referee's phone is not collected.
• Team, league and organiser profile details.
• Guardian name, relationship, email, phone and email-confirmation status.
• FA registration details, review status and a current-season FA dashboard screenshot. The screenshot must not include unrelated identity or qualification documents.
• Fixture, application, booking, availability, cancellation, review, notification and email-delivery records.
• Venue, address, postcode and Google place details.
• Security and abuse-prevention data. The venue-search limit uses a pseudonymous keyed fingerprint derived from the request IP; the application database does not store the raw IP for that limit.

3. Why we use it

We use account, profile, fixture and booking information to provide the service and take steps requested before a booking. We use eligibility, security, audit and abuse-prevention information for our legitimate interests in running a safe and reliable marketplace. We also process information where necessary for legal obligations, claims, user protection or safeguarding.

Account, guardian-confirmation and booking emails are service messages. Weekly fixture roundups are optional marketing for adults, use a separate unticked opt-in, and include an unsubscribe route. Marketing is disabled for under-18 accounts.

You may object to processing based on legitimate interests by emailing support@refsorted.co.uk.

4. Under-18 safeguards

• A six-digit code confirms control of the guardian email and records consent to the account. It does not prove identity or parental responsibility.
• A valid guardian phone number is required and becomes the protected match-day contact for confirmed bookings.
• Weekly marketing is disabled for under-18 accounts.
• Exact home location is not shown publicly.
• A team receives the approved guardian match contact for a confirmed booking, not a child phone number.

RefSorted uses privacy-protective defaults and minimises child data. A documented Children's Code assessment and Data Protection Impact Assessment are required controls before the service expands beyond the controlled pilot.

5. When information is shared

Applications show the posting team the referee's name, the level shown in their record, whether FA evidence was uploaded, and the current-season FA screenshot supplied for that application, but no phone number. The upload comes from the referee and RefSorted does not independently authenticate it. Screenshot access is limited to the posting organiser while the application is pending or accepted and uses a short-lived private link. The protected booking-contact service releases contact details only to participants in a confirmed or completed booking and authorised RefSorted operators. For an under-18 referee, it releases the guardian match contact instead of a child phone number.

Our operational suppliers include Supabase for authentication and data services, Cloudflare for hosting and security, Resend for primary email delivery, Google Maps services for venue features, Postcodes.io as a postcode fallback, and OpenFreeMap for fixture map images. When you open the fixture map, your browser requests map images directly from OpenFreeMap, which receives your IP address and the map area being viewed. Brevo is configured as a backup for account codes, guardian codes and essential fixture or booking email when the primary provider's allowance is exhausted. Weekly marketing roundups do not use this backup route.

We may share limited information with professional advisers, regulators, law enforcement, football authorities or safeguarding bodies where necessary and lawful.

Some suppliers may process information outside the UK. Before enabling or materially changing a supplier, RefSorted checks its region, contract and applicable international-transfer safeguard. Contact us for current supplier information.

6. Retention

We keep information only while reasonably needed for the purpose described here:

• unused guardian-code HMAC digests expire after 10 minutes and are cleared after successful verification;
• inactive venue-search rate-limit buckets are removed after approximately 24 hours;
• account and profile information is kept while the account is active and while outstanding bookings, safety matters or deletion requests are resolved;
• booking, cancellation and audit records are kept for the period needed for disputes, safeguarding, fraud and legal claims;
• FA registration screenshots, review records and guardian-confirmation records are kept only while needed for eligibility and a defensible safeguarding audit; and
• a minimal email-suppression record may be kept after opt-out so that choice continues to be honoured.

Supplier logs and backups follow their documented cycles. A record may be kept longer where law, safeguarding, a dispute or a regulatory request requires it. You may ask for an applicable period or deletion review.

7. Security and cookies

RefSorted uses access controls, row-level database security, protected server procedures, encryption in transit, rate limits and restricted operator tools. No online service can guarantee absolute security.

The service uses necessary browser storage and authentication data to keep users signed in and retain settings. Cloudflare Turnstile may process technical data to prevent automated abuse. RefSorted does not currently use third-party advertising or behavioural-analytics cookies.

8. Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability or objection, and may withdraw consent where consent is the lawful basis. A parent or guardian may raise a concern about an under-18 account. Email support@refsorted.co.uk. We may need to verify the request and normally respond within one month.

You can complain to the UK Information Commissioner's Office or call 0303 123 1113. You do not have to contact us before contacting the ICO.

9. Changes

We may update this notice as the pilot or its suppliers change. The effective date above shows the latest version. Material changes will be shown in the service or sent to the account email where appropriate.