This notice is written for parents and guardians. If you are a child reading this, please ask your parent or guardian to read it with you.
1. Who We Are
Kolva Club is a sports club management platform operated by Kolva Ltd (Company Number: 16021159), registered in England and Wales. Your sports club uses our platform to manage sessions, teams, and membership.
Important
Your club is the Data Controller — they decide why and how your child's data is used. Kolva Ltd is the Data Processor — we provide the technology platform and process data on behalf of your club.
2. What Data We Collect About Your Child
We collect only the minimum information necessary to manage your child's participation in the club:
| Data | Why We Need It | Legal Basis |
|---|---|---|
| First name & last name | To identify your child in sessions and teams | Legitimate interest (club management) |
| Date of birth | To place your child in age-appropriate teams and sessions | Legitimate interest (safeguarding) |
| Attendance records | To track session participation for safeguarding and billing | Contract (club membership) |
| Team membership | To manage squad allocation and training groups | Contract (club membership) |
| Medical notes (optional) | To ensure your child's safety during sessions | Consent — you choose to provide this |
| Photo/media consent status | To record whether the club may photograph your child | Consent — you grant or withdraw this |
3. What We Do NOT Do With Children's Data
- We never use children's data for marketing or advertising
- We never profile children or make automated decisions about them
- We never share children's data with third parties for their own purposes
- We never use children's data to train AI models
- We never track children's location or use geolocation data
- We never use “nudge” techniques or dark patterns to encourage children to provide more data
4. Who Can See Your Child's Data
| Who | What They Can See |
|---|---|
| You (parent/guardian) | Everything about your child |
| Club administrators | Name, DOB, team, attendance, medical notes, payments |
| Coaches | Name, date of birth, attendance, medical conditions and medication (for safety), emergency contacts, and the contact details of parents/guardians. No payment data. |
| Other parents/athletes | Nothing. Data is fully isolated between families. |
Data is isolated between clubs (tenants). One club cannot see another club's data, even on the same platform.
5. How We Protect Your Child's Data
- Encryption in transit: Data sent between your browser and our servers is encrypted (HTTPS).
- Encrypted by the app: Safeguarding notes, and the tokens used to connect a club's payment providers (GoCardless and Mollie), are encrypted by the application before they are stored.
- Access control: Role-based access ensures coaches cannot see payments, parents can only see their own children.
- Tenant isolation: Each club's data is completely separate. There is no cross-club data access.
- Where data is kept: Our servers and database are in Finland (Hetzner Cloud, EU). Backups are kept on storage controlled by Kolva in the UK. Some of the service providers listed below process data outside the UK and EEA.
- Cookies: We use no advertising cookies. We use cookies to keep you signed in, and one first-party cookie that counts page views on our own site. See our Cookie Policy.
6. Your Rights as a Parent
As your child's parent or guardian, you have full control over their data:
- Medical consent: You can share medical information about your child for their safety during sessions. You can withdraw this consent at any time from the Privacy & Data page, which will permanently remove the medical notes.
- Photo/media consent: You control whether the club can take and publish photos of your child. You can grant or withdraw this at any time.
- Data export: You can download all data held about you and your children in JSON or CSV format from the Privacy & Data page.
- Data deletion: You can request deletion of your child's data. This has a 14-day cooling-off period. Payment records are anonymised (not deleted) as required by UK financial regulations.
- Rectification: You can update your child's information through your parent portal at any time.
7. How Long We Keep Data
| Data Type | Retention Period |
|---|---|
| Active athlete records | Duration of membership + 6 months |
| Taster/prospect data (not converted) | 6 months from taster session |
| Attendance records | Duration + 12 months, then anonymised |
| Payment records | 7 years (UK HMRC requirement), anonymised on deletion |
| Medical notes | Until consent is withdrawn or membership ends |
8. Third-Party Services
We use a small number of service providers to operate the platform:
- Hetzner Cloud (Finland) — Server hosting, database storage and storage of uploaded files
- Stripe (EU/US) — Card payment processing (we never see card numbers)
- GoCardless (UK) — Direct Debit processing (we only see the last four digits of the bank account)
- Mollie (Netherlands) — Payment processing for clubs that connect a Mollie account
- Resend (US) — Sending transactional emails (session reminders, payment receipts) and receiving replies sent to a club's reply address
- Google (US/global) — AI features (Gemini), “Sign in with Google”, maps on club websites, and web push notifications
- Anthropic (US) — AI features: the help chat, policy review, and importing a club's spreadsheets
- AssemblyAI, Cartesia and OpenAI (US) — The voice feature: speech-to-text, and text-to-speech (OpenAI is the fallback)
- Cloudflare (US/global) — CDN, DNS and proxy in front of the site, and bot protection (Turnstile) on forms
- Apple and Mozilla (US) — Push notification delivery on Apple and Firefox devices
AI features. When a club administrator uses the AI assistant, the details needed to answer the request (for example a child's name, age and team, and medical details if the administrator asks about them) are sent to the AI provider. Staff certificate files that an administrator uploads for the system to read are sent to Google’s Gemini. If your club has its “AI inbox assistant” switched on (it is on by default), the text of emails and portal messages that parents send to the club is also analysed by AI so that it can be sorted and replies suggested; your club can switch this off in its settings, after which nothing in those messages is sent to AI. We never use children's data to train AI models.
See our full sub-processor list for details on data transfer mechanisms.
9. Questions or Complaints
If you have questions about how your child's data is handled:
- Contact your club first — they are the Data Controller
- Contact Kolva: [email protected]
- ICO (UK regulator): If you are not satisfied with our response, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint