Privacy Policy

Who CricketRight is

CricketRight is the cricket-club software service available at cricketright.com. In this policy, CricketRight, we and us mean the operator of that service. The club that invited you or created your record is referred to as your club.

If your club pays for CricketRight, its order or subscription record also identifies the party supplying the service to it.

Who is responsible for the data

• Your club is the controller for player, parent, team, availability, selection, training and club-message data. It decides why that information is used and who may access it.
• CricketRight is the processor when it hosts and handles that club-controlled data to provide the service. Our Data Processing Agreement applies.
• CricketRight is a controller for limited data used to operate its own business, such as account security, service logs, support correspondence, trial administration and billing records.

Information we process

• Account details, including name, email address and authentication records.
• Optional contact details, including a telephone number where supplied.
• Club setup, teams, age bands, fixtures, training and access roles.
• Player and parent records, including names, parent relationships, eligibility information, availability, selection and participation history.
• Operational club messages and their delivery status.
• Technical information needed to keep the service working, including session cookies, device/browser information, IP-derived security logs and diagnostic events.
• Support, privacy and security correspondence sent to CricketRight.

Information may come from you, a parent or guardian, your club, or be generated when the service records an action such as an availability response or team publication.

Purposes and lawful bases

For club-controlled data, the club determines the lawful basis and must explain it in its own privacy notice. CricketRight processes that data on the club's documented instructions.

Where CricketRight acts as controller, it uses information:

• to create and secure accounts and provide the requested service;
• to answer support, privacy and security enquiries;
• to administer trials, subscriptions and financial records;
• to prevent abuse, diagnose faults and protect clubs from unauthorised access; and
• to comply with legal, tax, regulatory and safeguarding obligations.

The relevant lawful bases are performance of a contract, compliance with legal obligations and CricketRight's legitimate interests in operating, improving and securing the service. We do not sell personal data or use children's information for advertising.

Children's information

CricketRight is designed for clubs that include junior cricket. Clubs and parents should provide only the information needed to organise cricket. The product can use age-band or birth month/year information where a full date of birth is unnecessary.

Clubs remain responsible for their lawful basis, transparency, safeguarding practices and decisions about junior access. CricketRight applies role-based access and aims to present privacy information in clear language. See Safeguarding & children's privacy.

Recommendations and human decisions

CricketRight may record playing opportunities and recommend a junior team using availability and participation history. A coach controls the final selection and nothing is published solely by the algorithm. CricketRight does not make legal or similarly significant decisions about players.

Who receives information

• Authorised people at your club, according to their role.
• Service providers needed to operate CricketRight, currently including managed hosting, database/authentication and transactional-email providers.
• Professional advisers, insurers or authorities where reasonably necessary or legally required.

The main product infrastructure currently uses Vercel for application hosting, Supabase for database and authentication services, and Amazon Simple Email Service (Amazon SES) for transactional email. Providers may use their own approved sub-processors. CricketRight does not allow them to use club data for their own advertising.

International transfers

Some infrastructure providers may process information outside the UK. Where a restricted transfer occurs, CricketRight relies on an applicable UK adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to EU Standard Contractual Clauses, together with the required transfer assessment.

How long information is kept

• Club data is kept while the club account is active and as needed to provide the service. Club admins should correct records and remove leavers promptly.
• After a club closes its account, live service data is scheduled for deletion or anonymisation, subject to reasonable export, recovery and legal-record requirements.
• Encrypted backup copies age out through the infrastructure provider's backup cycle and are not restored except for disaster recovery.
• Security, support and financial records are retained only for as long as reasonably needed for security, disputes and legal obligations.

Your rights under UK data-protection law

Depending on the circumstances, you may have rights to be informed, access information, correct it, erase it, restrict or object to its use, and receive certain information in a portable form.

For club-controlled information, contact your club first. For data controlled by CricketRight, use the contact form. We may need to verify your identity before acting on a request.

You may complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.

Security, cookies and changes

Read the Security overview and Cookie Policy for more detail.

We may update this policy when the product, providers or law changes. The date at the top shows the latest revision. Material changes will be brought to clubs' attention through the service or by email where appropriate.