Privacy Policy

1. Who We Are

Vetted is a digital platform designed to support football players during and after their transition out of academy football. We provide continuity, visibility, and access to development pathways during this high-risk transition period.

For the purposes of data protection law, Vetted acts as an independent Data Controller.

Contact Information:
Email: karlon@joinvetted.co
Company: Vetted (Nolrak Limited)
Company Number: 16876813
Registered in England

2. What Data We Collect

We may collect and process the following categories of personal data:

A. Information You Provide

• Personal Identifiers: Name, date of birth, email address, phone number, and contact details.
• Account & Profile Data: Sports interests, position, football history, academy background, age group, and athletic goals.
• Engagement Data: Interactions within the platform, session participation, and communication records where you contact us for support.
• Optional Performance Content: Videos, footage, or other materials uploaded by you.
• Payment Information: Billing address and payment method details. Note: We do not store full credit card numbers. All financial transactions are processed securely by our third-party payment processor (Stripe).

B. Information Automatically Collected

• Session Recordings: For safety, quality assurance, and dispute resolution, video mentorship sessions may be recorded. By participating in a session, you consent to this recording.
• Usage Data: IP address, browser type, device information, and interaction logs.

Note: We do not collect medical records or clinical mental health data.

3. Lawful Basis for Processing

Under GDPR, we process personal data on the following lawful bases:

• Consent: Where you choose to create an account, participate in services, or upload content. You may withdraw consent at any time.
• Legitimate Interests: Limited to safeguarding continuity, platform security, service improvement, and ensuring player safety during transitions.
• Contractual Necessity: To provide the services you have requested (e.g., mentorship sessions, platform access).
• Legal Obligation: Where required by law or to protect the rights and safety of individuals.

You have the right to withdraw consent at any time by contacting us at karlon@joinvetted.co. Withdrawal will not affect the lawfulness of processing based on consent before its withdrawal.

4. How We Use Your Information

We use the data we collect to:

• Provide the Service: Connect players with mentors, facilitate development pathways, and provide continuity during transitions.
• Verify Identity: Use SMS verification to prevent fraud and ensure real users.
• Ensure Safety: Monitor sessions to enforce our Code of Conduct and provide safeguarding support.
• Process Payments: Facilitate transactions and payouts to mentors.
• Communicate: Send booking confirmations, reminders, and important account updates.
• Service Improvement: Analyze platform usage to improve our services and user experience.
• Marketing: Send newsletters, promotions, or educational content (with your consent). You may opt-out at any time.

5. Where Data Is Stored & International Transfers

Vetted uses Amazon Web Services (AWS) and other cloud infrastructure providers to securely host its platform and data.

International Transfers: Data may be stored and processed in the United States or other countries outside the UK/EEA. Where this occurs, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Technical safeguards including encryption (SSL/TLS), access controls, Row Level Security (RLS), and limited personnel access
• Organizational measures to ensure data protection compliance

These measures ensure that your personal data is protected in line with UK GDPR and EU GDPR requirements, regardless of where it is processed.

6. Data Sharing

We do not sell your personal data.

Data may be shared only:

• With your explicit consent: When you choose to share visibility with clubs, scouts, or other users
• Where legally required: In response to valid requests by public authorities or to comply with legal obligations
• With trusted service providers acting under strict data protection obligations:
  • Cloud Infrastructure & Database (Supabase, Vercel, AWS)
  • Video Conferencing (Daily.co or similar)
  • Payment Processing (Stripe)
  • Communication & CRM (HubSpot, Twilio)

Important: Clubs do not have automatic access to player data unless you have chosen to share visibility.

7. Safeguarding & Duty of Care

Vetted provides continuity, peer support, and signposting during player transitions. We are committed to creating a safe environment for all users, particularly young players.

• We do not provide medical, clinical, or therapeutic services.
• Where safeguarding concerns arise, we may encourage players to seek appropriate external support services.
• Session monitoring: Video recordings may be reviewed for safety, quality assurance, and dispute resolution purposes.

8. Protection of Minors (Children's Privacy)

Vetted services may be used by young players transitioning from academy football.

• Parental Requirement: For users under the age of 13, accounts must be created and managed by a Parent or Legal Guardian.
• Data Handling: Any data involving minors is treated with the highest level of security and is only accessible by authorized Vetted administrators for safety purposes.
• Parental Rights: Parents have the right to review, delete, or prohibit further collection of their child's information at any time by contacting us.

9. Data Retention & Security

• Retention Period: We retain personal data only for as long as necessary to support your participation, provide our services, or meet legal obligations. You may request deletion of your data at any time.
• Security Measures: We use enterprise-grade encryption (SSL/TLS), Row Level Security (RLS) database policies, access controls, and regular security audits to protect your personal information from unauthorized access.
• Video Storage: Session recordings are stored securely with restricted access and are not accessible to the general public.

10. Your Data Rights Under GDPR

Under UK GDPR and EU GDPR, you have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Correct inaccuracies in your personal data.
• Right to Erasure ('Right to be Forgotten'): Request deletion of your account and personal data (subject to legal retention requirements).
• Right to Restrict Processing: Request that we limit how we use your data in certain circumstances.
• Right to Object: Object to processing based on legitimate interests or for marketing purposes.
• Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format.
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.
• Right to Lodge a Complaint: File a complaint with the Information Commissioner's Office (ICO) in the UK or your local supervisory authority.

To exercise these rights, please contact us at: karlon@joinvetted.co

We will respond to your request within one month. In some cases, we may need to verify your identity before processing your request.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. We encourage you to review this policy periodically.

12. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or have concerns about how we protect your data, please contact us:

Email: karlon@joinvetted.co
Company: Vetted (Nolrak Limited)
Company Number: 16876813
Registered: England