Privacy

The Short Version

The plain-English gist, not legally binding; the full policy below is what applies.

• Your club controls its member data; we process it to run the platform. For questions about your records, your club is usually the right first stop.
• We don't sell personal information and we don't use it for third-party advertising. Ever.
• Card details never touch us. Payments are handled by a PCI DSS Level 1 certified provider; full card and bank numbers go straight to it — Clubware never sees or stores them.
• Data is encrypted in transit and at rest, and stored in the EU where reasonably possible.
• You can ask for access to or correction of your information under the NZ Privacy Act 2020.

1. About This Policy

This Policy explains how Clubware collects, uses, discloses, and protects personal information in connection with the Clubware platform, websites, and apps (the "Platform"), in line with the New Zealand Privacy Act 2020. It applies to Clubs — organisations (and their staff) that use the Platform to manage members and collect payments — and to Members and Customers — people a Club manages or bills through the Platform, who generally interact with it indirectly or through Club-facing pages and payment links. By using or interacting with the Platform (directly or through a Club), you agree to this Policy.

2. Our Roles

For Member and Customer information, the Club is the controller and Clubware is the processor: your Club decides what it collects and why, and we process it on the Club's behalf under its signed Organisation Agreement. For our own operations — Club staff accounts, Club billing, support, security, and website usage — Clubware is the controller. Clubs are responsible for having a lawful basis and all necessary consents for the Member information they collect and the charges and messages they initiate through the Platform.

3. What We Collect

• Staff accounts: name, email, phone, optional profile photo, role, login and authentication data (including passkeys, managed by our authentication provider).
• Club configuration: club name, branding, products, plans, pricing, and settings.
• Member and customer records (on behalf of Clubs): names, contact details, date of birth, guardian or emergency contact details, membership and subscription status, optional profile photos, and notes added by Club staff. Clubs decide what they record and must collect it lawfully — including any sensitive information (such as injury or medical notes) — and only where relevant.
• Module data (on behalf of Clubs): optional Modules may store additional records, as described in each Module's listing.
• Payment metadata: payment and subscription statuses, amounts, payout information, and tokenised details returned by our payment provider(s) (e.g., card brand, last 4 digits, expiry, partial bank account details). Full card and bank account numbers are collected directly by our PCI DSS Level 1 certified payment provider(s) and never touch our systems.
• Communications: support emails, notification preferences, and consent settings.
• Technical data: app and device information, IP address, timestamps, usage and analytics events, diagnostic and error logs, push notification tokens, and cookies or similar technologies.

4. How We Use Personal Information

We use information to provide, operate, secure, and improve the Platform; process payments via the Club's connected payment account and allocate fees; send service messages and deliver a Club's messages to its Members; provide support; comply with legal obligations and enforce our Terms and Organisation Agreements; and generate aggregated or de-identified data that does not identify any individual or Club. We do not sell personal information or use it for third-party advertising.

5. Sharing and Sub-processors

We share information with service providers that help us run the Platform, in the following categories: payment processing, hosting and infrastructure, database, authentication, email delivery, error monitoring, and product analytics. These providers act on our instructions under appropriate confidentiality and data-protection obligations, and Clubs can request further detail. We may also disclose information where required by law or legal process, to protect rights, safety, and security, or to a successor entity in connection with a reorganisation, incorporation, or transfer of the Clubware business.

6. Storage and International Transfers

We store data in the EU where reasonably possible; some providers process data in other regions (including the US). Where information is handled outside New Zealand, we use providers we reasonably believe are subject to comparable safeguards, consistent with the Privacy Act 2020.

7. Security

We maintain industry-standard security measures, including authenticated access (with passkey support), club-scoped data isolation, encryption in transit and at rest, and access controls. No method of transmission or storage is completely secure. We will notify affected Clubs of a data breach affecting their data without undue delay, and will comply with our notification obligations under the Privacy Act 2020 for notifiable privacy breaches.

8. Cookies

We use cookies and similar technologies to operate the Platform, maintain sessions, improve performance, and measure usage. You can control cookies in your browser settings; disabling some may affect functionality.

9. Data Retention

We retain personal information for as long as necessary to provide the Platform, for legitimate business purposes (e.g., security, audits, financial and dispute records), and to comply with legal obligations. When a Club leaves the Platform, we may delete or anonymise its data after a commercially reasonable period; export and deletion arrangements are set out in the Organisation Agreement.

10. Children and Guardians

Clubs may enrol Members under 18. Where required, Clubs must obtain consent from a parent or legal guardian and maintain appropriate records — including for photos and any notes about minors.

11. Your Rights

Under the Privacy Act 2020, you may request access to and correction of your personal information. Members and Customers should contact their Club first (as the controller); we may refer or coordinate such requests with the relevant Club. Clubs, and anyone whose request relates to information Clubware controls (e.g., staff logins, support correspondence, website usage), can contact us at contact@clubware.app. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner (privacy.org.nz).

12. Changes to This Policy

We may update this Policy from time to time; the updated version will be posted at clubware.app/privacy and becomes effective when posted. We will make reasonable efforts to notify Clubs of significant changes. Continued use of the Platform after the effective date constitutes acceptance.

13. Contact

Questions or requests: contact@clubware.app