Privacy Policy

This Privacy Policy explains how NoviNine Entertainment Limited (“we”, “our”, or “us”) collects, uses, and protects personal data when you use the CTM Club Team Management mobile application (“CTM”, “the App”) and the website at getctm.app.

We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR), the Irish Data Protection Act 2018, and applicable UK data protection law.

1. Data Controller

The data controller is NoviNine Entertainment Limited, a company registered in Ireland. Contact: support@novinine.com, including for any request relating to your data protection rights.

2. What we collect

We collect the following categories of personal data:

• Account data: name, email address, phone number, and (where supplied) profile photo.
• Club & team data: the club, team(s), and role(s) you belong to, and the data you (or your club admins) enter while using the App, including fixtures, attendance, messages, scorecards, and payment records.
• Children’s data: where a parent or club admin records information about a child member (name, age group, attendance, RSVPs), this data is held under the parent’s or club’s legal basis. We apply additional safeguards for children’s data, including restricted visibility within the club.
• Payment data: when you make payments through CTM, payment-card details are processed by Stripe. We do not store card numbers. We retain a record of each transaction (amount, date, fee) tied to your account, and, where a payment is refunded or disputed, its refund or dispute status, amount and dates, which we receive from Stripe.
• Lift sharing (Premier and Champion clubs): for away matches, a parent’s lift answer (needs a lift, has their own lift, or can give a lift, and the number of seats), a once-per-child lift-sharing consent (who gave it and when), and the published lift plan, which shows the names of drivers and children.
• Data breach records: if a club admin records a personal data breach in the App, the description they enter, which may name the people affected.
• Usage data: device type, app version, IP address (truncated), session timestamps, and crash reports.
• Cookies / website analytics: getctm.app uses Vercel Analytics (privacy-respecting, no cross-site tracking), Google Search Console, and Google Analytics (GA4). Google Analytics sets cookies and processes data such as your IP address, device and browser type, and pages visited. This relies on your consent, given through the cookie banner on the website, and you can withdraw consent at any time using the “Cookie preferences” link in the site footer. We do not use this data for advertising.

3. Why we use your data (lawful bases)

• Performance of the contract: to provide CTM features you sign up for (accounts, messaging, fixtures, payments).
• Legitimate interests: to keep the service secure, prevent fraud, and improve product quality (with usage analytics).
• Legal obligation: for tax, accounting, and safeguarding records, and for clubs’ records of personal data breaches.
• Consent: for any optional communications such as product updates by email, and for lift sharing. A parent gives consent once for each child before the child can be included in a lift plan, and can withdraw it at any time. When consent is withdrawn, the child is removed at once from every lift plan for a match that has not yet happened, including plans already published, and the team’s coaches are notified.

4. Where your data is stored

The CTM database is stored on Google Firebase (Google Cloud) infrastructure in the European Union (Belgium). Many of the server functions that process personal data run in Google Cloud’s United States region, including those that handle account and club set-up, payments, data export and erasure requests, data retention clean-up, reported messages, coach compliance checks and subscriptions. Payments are processed by Stripe. For these functions, and for any sub-processor that transfers data outside the European Economic Area, we rely on appropriate safeguards including the EU-US Data Privacy Framework and Standard Contractual Clauses.

5. Data retention

We retain personal data for as long as your account is active, plus a defined retention period needed for legal, accounting, and dispute-resolution purposes (typically up to seven years for transactional records). When you close your account, we will delete or anonymise personal data within 30 days, except where retention is required by law.

• Lift plans and lift answers for an away match are deleted automatically 30 days after the match.
• Lift-sharing consent is kept on the child’s record until a parent withdraws it or the child’s data is erased.
• Data breach records are not deleted automatically, because clubs must keep documentation of breaches under GDPR Article 33(5). A club admin can delete an entry.
• If a person’s data is erased, their name and account ID are removed or anonymised in lift plans and lift-sharing consents.

6. Sharing your data

We do not sell personal data. We share data only with the sub-processors needed to operate CTM:

• Google Firebase (hosting, authentication, push notifications)
• Stripe (payments)
• Apple and Google (App Store / Google Play services)
• Vercel (website hosting and analytics)
• RevenueCat (in-app subscriptions)
• Google Analytics (website analytics, with your consent)

Your club’s data is visible only to authorised members of your club, in line with the role-based access controls in the App. A published lift plan is visible to the coaches of that team and to the parents of children in that team. It shows drivers’ and children’s names only, never phone numbers or email addresses. Data breach records are visible only to the club’s admins.

7. Your rights under GDPR

You have the right to:

• Access your personal data.
• Rectify inaccurate or incomplete data.
• Erase your personal data (“right to be forgotten”).
• Restrict or object to processing.
• Data portability: receive your data in a structured, common format.
• Withdraw consent at any time, where processing relies on consent.
• Lodge a complaint with the Irish Data Protection Commission (dataprotection.ie) or your local supervisory authority.

To exercise any of these rights, email support@novinine.com.

8. Children’s data and safeguarding

CTM is designed primarily for use by club admins, coaches, and parents. Where information about a child is recorded, it is held under the parent’s or club’s responsibility. A child is included in a lift plan only after a parent has given lift-sharing consent for that child, and the plan shows the child’s name only. Parents can request deletion of their child’s data at any time by contacting their club admin or support@novinine.com.

9. Security

We use industry-standard security controls including encryption in transit (TLS), encryption at rest, role-based access control, and regular security reviews. No system is perfectly secure; please contact us immediately if you suspect a security issue.

10. Changes to this policy

We may update this policy from time to time. The current version is always available at getctm.app/privacy. Material changes will be notified to active users by email or in-app notice.

11. Governing law

This policy is governed by the laws of Ireland.

Contact

NoviNine Entertainment Limited
Email: support@novinine.com