Sponsorfy Privacy Policy
Version 1.0 Last updated: 19 August 2026
01Who we are
SPONSORFY LTD (“Sponsorfy”, “we”, “us”, “our”) is the controller of the personal data described in this policy.
- Registered in England and Wales, company number 16098355
- Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
- ICO registration number: TBC (registration paid, number awaited)
- Data protection contact: mark.makin@sponsorfy.com
02Who this policy covers
This policy applies to:
- Club users: staff at clubs, county associations, leagues and governing bodies using the platform
- Sponsor users: staff at businesses buying or enquiring about sponsorship
- Website visitors: anyone browsing our site
- Prospects and contacts: people we contact about Sponsorfy
- Applicants: people applying for roles with us
It does not cover clubs' or sponsors' own processing of personal data. Where you deal with a club through the platform, that club is a separate controller and its own privacy notice applies.
03What we collect and why
3.1 Account and contact data
- Name, work email, phone, job title, organisation — to create and administer your account, authenticate you, provide support (lawful basis: contract)
- Password (hashed) — to secure your account (contract)
- Communication preferences — to respect your choices (consent / legitimate interests)
3.2 Transaction data
- Listings, enquiries, messages, purchase records, contract records, invoices — to operate the marketplace, form and evidence contracts, resolve disputes (contract; legitimate interests in maintaining an evidenced transaction record)
- Payment metadata (amount, date, status, last four digits, card type) — to reconcile payments, handle refunds and chargebacks (contract; legal obligation)
We do not collect or store full payment card details. Payments are processed by Stripe, who act as a separate controller for payment data. See Stripe's privacy policy at stripe.com/privacy.
3.3 Verification and compliance data
- Company registration number, registered address, VAT number, tax identification number, evidence of authority to bind — to verify organisations, comply with platform reporting rules, prevent fraud (legal obligation; legitimate interests in preventing fraud)
- Identity verification data collected by Stripe during connected account onboarding — anti-money-laundering and payment regulation (legal obligation, Stripe as controller)
3.4 Usage and technical data
- IP address, device and browser type, operating system, pages viewed, time on site, referrer, actions taken — to operate and secure the platform, diagnose faults, understand and improve how it is used (legitimate interests)
- Terms acceptance records: user ID, timestamp, IP address, version accepted — to evidence contract formation (legitimate interests; legal obligation)
- Cookies and similar technologies — see our Cookie Policy (consent for non-essential; legitimate interests for strictly necessary)
3.5 Marketing data
- Business contact details, engagement with our emails, event attendance — to tell you about Sponsorfy and relevant features (legitimate interests (B2B) or consent)
You can opt out of marketing at any time using the unsubscribe link or by emailing mark.makin@sponsorfy.com. Opting out of marketing does not stop service messages about your account.
04Where we get your data
- Directly from you
- From your organisation, where a colleague sets up your account
- From Stripe, in relation to payment and verification status
- From publicly available sources such as company registers, club and league websites, and professional networking sites, where we are researching prospective clients
- From cookies and similar technologies
05How we share data
Clubs and sponsors. When you enquire about or buy a sponsorship package, we share your name, work contact details and purchase details with the other party so they can deal with you and perform the contract. Each acts as an independent controller.
Our service providers. Each is bound by a written contract limiting what they may do with the data. A current list of our sub-processors is available on request from mark.makin@sponsorfy.com.
PostHog, for consent-based website analytics and error reporting. We use its EU service, do not create person profiles, and have disabled session replay on this site.
Google Analytics, for consent-based website analytics after Accept. It may use _ga and _ga_<container> browser cookies. We do not enable marketing cookies, Google Signals, Ads, or cross-site advertising for this site. Google's privacy policy applies: policies.google.com/privacy.
Stripe, for payment processing, connected account onboarding and fraud prevention.
Tax authorities. We may be required to report information about clubs transacting on the platform, including identifying details and transaction volumes, to HM Revenue & Customs under the reporting rules for digital platform operators.
Professional advisers: lawyers, accountants, auditors and insurers, under duties of confidentiality.
Prospective purchasers or investors, in connection with a sale of our business, a fundraising, or due diligence, under confidentiality obligations and limited to what is necessary.
Law enforcement and regulators, where required by law or to establish, exercise or defend legal claims.
We do not sell personal data, and we do not share it with third parties for their own marketing.
06Aggregated and anonymised data
We produce aggregated and anonymised analytics about sponsorship inventory, pricing, demand and transaction activity across the platform. We use and publish this to operate and improve the platform, to produce market reports, and to provide leagues and governing bodies with a view of commercial activity in their competitions.
Once data is properly anonymised it is no longer personal data and this policy does not restrict our use of it. We do not publish anonymised data in a form that identifies an individual, and we do not publish an individual club's pricing or transactions without that club's agreement.
07International transfers
Some of our service providers are outside the UK. Where personal data is transferred outside the UK, we rely on UK adequacy regulations, or the International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where required. Details of where our service providers are located are available on request from mark.makin@sponsorfy.com.
08How long we keep it
- Account data: duration of the account, then 12 months
- Transaction, contract and invoice records: 6 years from the end of the relevant financial year (Companies Act and HMRC)
- Terms acceptance records: 6 years after the contract ends
- Support correspondence: 3 years
- Marketing data: until you opt out, or 24 months of no engagement
- Website analytics: up to 12 months
- Unsuccessful job applications: 6 months
- Security and access logs: 12 months
Where we no longer need data we delete it or irreversibly anonymise it.
09How we protect it
We use encryption in transit, access controls limiting who can see personal data, and regular backups. We maintain an incident response process and will notify the ICO and affected individuals where legally required.
10Your rights
Under UK GDPR you have the right to: be informed; access your data; have inaccurate data corrected; have data erased in certain circumstances; restrict processing; data portability; object to processing based on legitimate interests; object to direct marketing at any time; and not be subject to solely automated decisions with legal or similarly significant effects.
We do not carry out solely automated decision-making that produces legal or similarly significant effects.
To exercise a right, email mark.makin@sponsorfy.com. We will respond within one month, extendable by two months for complex requests. There is no charge unless a request is manifestly unfounded or excessive.
Where we rely on consent, you can withdraw it at any time. This does not affect processing already carried out.
You can complain to the Information Commissioner's Office at ico.org.uk, helpline 0303 123 1113. We would appreciate the chance to resolve it first.
11Children
The platform is not intended for anyone under 18 and we do not knowingly collect their data. Clubs must not upload personal data of any person under 18 in a listing. If you believe we hold such data, contact mark.makin@sponsorfy.com and we will delete it.
12Changes
We may update this policy. Material changes will be notified by email to account holders and by notice on the platform at least 30 days in advance. The current version and date are shown at the top.
13Contact
mark.makin@sponsorfy.com | SPONSORFY LTD, registered in England and Wales, company number 16098355, registered office 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.
We have not appointed a Data Protection Officer as we are not required to.