N

Netted

Privacy Policy

Last updated: 7 August 2026

This Privacy Policy explains how INED GROUP LTD (“we”, “our”, “us”) collects, uses, stores and protects personal data when you use the Netted mobile application, our website at nettedfc.co.uk, and any related services (together, the “Service”).

We are the “data controller” for the personal data we process about you under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

1. Who we are and how to contact us

The Service is operated by INED GROUP LTD, a company registered in England and Wales. Our full legal and regulatory details are at the bottom of this page.

If you have any question about this Policy or how we handle your data, please email support@nettedfc.co.uk.

2. Personal data we collect

We collect the following categories of personal data:

2.1 Data you provide when you sign in

• Your email address (from Apple, Google or a magic-link email).
• Your display name (from your Apple / Google account, or as you edit it in Settings).
• A unique account identifier generated when you sign in.

2.2 Data you provide when you use the Service

• Team information you create (team name, colours, logo).
• Player information you add (child’s name, shirt number, playing position, optional photograph).
• Match, goal, assist and award records you log or vote on.
• The parent-follower link declaring that you are a specific player’s parent, guardian or family member.

2.3 Data we collect automatically

• A device push token if you enable push notifications.
• Basic technical information sent by your device (device model, operating-system version, app version, IP address at the time of each request) — used for security, error diagnostics and abuse prevention only.

We do not collect any special-category personal data (health, ethnicity, political opinions, biometric identifiers, etc.). Please do not enter such data in free-text fields such as player names.

3. Why we use your data (legal bases)

Under UK GDPR we must have a lawful basis for every use of your personal data. We rely on the following:

• Contract (Article 6(1)(b) UK GDPR) — to provide the Service you have signed up for: creating and joining teams, logging matches, running votes, showing statistics and delivering shareable cards you request.
• Legitimate interests (Article 6(1)(f) UK GDPR) — to keep the Service secure and free from abuse, to diagnose errors, to prevent fraud and to improve the Service. Our legitimate interests do not override your rights.
• Consent (Article 6(1)(a) UK GDPR) — where we ask for it, e.g. before we send you optional push notifications or optional emails. You can withdraw consent at any time in Settings or by contacting us.
• Legal obligation (Article 6(1)(c) UK GDPR) — where we must process data to comply with UK law (for example, to respond to a valid legal request).

4. Who we share your data with

We do not sell your personal data and we do not use it for advertising.

We share personal data with the following categories of recipient:

• Other members of a team you belong to. When you join a team, other team members can see your display name, any players you follow, and match / goal / award records you contribute. Your email address is not shown to other members.
• Processors acting on our instructions and bound by data-processing contracts:
  • Supabase (Supabase, Inc., USA) — database, authentication, storage and edge functions. Our data is hosted in the EU / London region.
  • Cloudflare, Inc. (USA) — DNS, CDN and hosting of this website.
  • Apple Inc. (USA) — when you use Sign in with Apple. See Apple’s privacy notice for details.
  • Google LLC (USA) — when you use Sign in with Google. See Google’s privacy notice for details.
  • Expo (650 Industries, Inc., USA) — if you enable push notifications, we send your device push token to Expo Push Notification Service which relays notifications to Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM).
  • Resend (Resend, Inc., USA) — delivery of transactional emails such as magic-link sign-in and account notifications, if you receive any.
• Regulators, law enforcement or courts, where we are legally required to disclose data (for example, in response to a valid court order).
• A successor entity in the event of a corporate reorganisation, merger, sale or acquisition — any recipient will be bound to protect your data on the same terms.

5. Where your data is stored

Our primary database is hosted in the European Union / United Kingdom region operated by Supabase. Some of our processors listed above are based in the United States. Where personal data is transferred outside the UK, we rely on transfer mechanisms recognised under UK GDPR, in particular the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with any additional safeguards required by the ICO.

6. How long we keep your data

• Account data (email, display name, sign-in identifiers) — kept while your account is active. Deleted within 30 days of you deleting your account via Settings → Account → Delete account.
• Player data you added (names, photographs, statistics) — kept while at least one member of the team keeps the player in their squad. If you leave a team, your parent-follower link is removed; the player remains for the team to manage.
• Match, goal, vote and award records — kept as historical team data. If you delete your account, records you created remain in the team but are no longer attributed to your account.
• Device push tokens — deleted when you disable notifications, sign out or delete your account.
• Technical logs — kept for up to 90 days for security and diagnostic purposes.
• Backups — encrypted backups may retain your data for up to 30 days after deletion, after which they are overwritten.

7. How we protect your data

We use appropriate technical and organisational measures, including:

• Encryption of data in transit (HTTPS / TLS 1.2+).
• Encryption of data at rest on our database and storage.
• Row-level security so that team members only see the data of teams they belong to, and votes remain private until the voting window closes.
• Access controls limiting employee access to production systems on a need-to-know basis.
• Regular software updates and dependency review.

No online service can be guaranteed 100% secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours where required by law, and notify you where the breach is likely to result in a high risk to you.

8. Children’s data

Netted is intended for use by adults aged 18 and over (parents, guardians, coaches and other family members). Children may not create their own account.

Because grassroots youth football involves children, you (the adult account holder) may enter information about a child, such as their name, photograph, position and match statistics. When you do so:

• You confirm that you are the parent or legal guardian of the child, or you have been authorised by the parent or legal guardian to provide the information.
• You are responsible for making sure any consent required from the child (based on their age and understanding) and from the parent or guardian has been given before you upload the child’s photograph or personal information.
• You confirm that publishing the information within the child’s team is in the child’s best interests and is not detrimental to the child.
• You will not upload photographs of children other than your own without the informed consent of that child’s parent or guardian.

Where a parent or guardian asks us to remove information about their child, please contact support@nettedfc.co.uk and we will action the request promptly, typically within 30 days.

Team admins can remove a player and all associated data from a team at any time via Squad → Player → Edit → Remove player.

9. Your rights

Under UK GDPR you have the following rights, free of charge:

• Access — a copy of the personal data we hold about you.
• Rectification — correction of inaccurate or incomplete data.
• Erasure — deletion of your data (“right to be forgotten”). You can delete your account yourself in Settings → Account → Delete account.
• Restriction — ask us to stop processing your data in specific circumstances.
• Data portability — receive your data in a common machine-readable format.
• Object — object to processing based on our legitimate interests.
• Withdraw consent — where we rely on consent (e.g. notifications), you can withdraw at any time.
• Not to be subject to automated decision-making — we do not make automated decisions with legal or similarly significant effects on you.

To exercise any of these rights, email support@nettedfc.co.uk. We will respond within one month.

10. Cookies and tracking

The Netted mobile app does not use cookies and does not use third-party advertising or analytics SDKs. This website (nettedfc.co.uk) uses only strictly necessary cookies to serve the site; it does not set analytics or advertising cookies.

11. Push notifications and email

Push notifications and email notifications about matches, goals and awards are optional. You can enable or disable them at any time in Settings → Notifications (once released) or in your device settings.

12. Changes to this policy

We may update this Policy from time to time to reflect changes to the Service, our processors or the law. If we make material changes, we will notify you in-app or by email before they take effect. The “Last updated” date at the top of this Policy shows when it was last changed.

13. How to complain

If you are unhappy with how we have handled your personal data, please contact us first at support@nettedfc.co.uk so we can try to put things right.

You also have the right to lodge a complaint with the UK data protection regulator, the Information Commissioner’s Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF