Privacy notice
CheerDeck is software for cheer and dance competitions. This notice explains what personal information passes through CheerDeck, who is responsible for it, how long it is kept and what you can ask us to do.
Who is responsible
Responsibility depends on whose information it is and why it is used:
- CheerDeck is the controller for platform accounts (your name, email address and sign-in), security and audit records, judge profiles, and our own billing of producers.
- Each club is the controller for its roster — athletes, guardians, emergency contacts, consents and any medical notes. CheerDeck processes that information for the club.
- Each event producer is the controller for its entries, schedules, scores, results, event-day records and ticket buyers. CheerDeck processes that information for the producer.
- When a club enters a competition, the club shares the entry details the event needs with that producer (a disclosure between two controllers covered by the event’s entry terms, which the club confirms when it submits).
Questions about a club’s roster go to that club; questions about an event go to its producer. You can always contact us at privacy@cheerdeck.co.uk and we will pass your request to the right organisation within 5 working days.
What we hold and why
People with a CheerDeck account
Name, email address, optional phone number, the roles you hold for producers and clubs, and records of your sign-ins and actions. We use it to run your account and keep the service secure (legitimate interests and the contract with you).
Athletes, guardians and club staff
Clubs record athletes’ names, dates of birth and sex (for age and eligibility rules), team membership, guardian and emergency contacts, consents and waivers, and — only with a guardian’s explicit consent — medical notes. Coaches’ names and safeguarding checks are recorded for competition rules.
Producers receive only what an entry needs: athletes’ names, dates of birth (for age checks), consents and waivers, never guardian contacts, addresses or photographs. Medical notes reach an event only when the club shares them for that event with a guardian’s consent, are readable only by that event’s medic during the event days, every view is logged, and the event’s copy is deleted automatically afterwards.
Judges and event staff
Your judge profile, the panels and roles you hold, and the scores and notes you enter. A judge’s own scores are not visible to other judges.
Spectators and ticket buyers
If you buy tickets: your name, email address and order. Public event pages set no cookies and use no trackers; they show team and club names only — never athletes’ names, dates of birth or photographs.
Producers’ websites
If you register interest or join a mailing list on a producer’s own website, that producer receives your details through CheerDeck.
Children
Most athletes are children. There are no athlete logins; parents and guardians use CheerDeck only through consent links, tickets and public pages. Public pages follow the Children’s Code: high privacy by default, no profiling, no advertising and no nudges.
Special category data
Medical information is handled only with the explicit consent of someone with parental responsibility. Withdrawing consent deletes the club’s medical note and every event copy at once. Safeguarding records are kept separately and are visible only to the event’s welfare officer and the producer’s owner.
How long we keep it
| Information | How long |
|---|---|
| Shared medical notes (an event’s copy) | Deleted automatically 7–30 days after the event (the producer’s setting, 30 by default) |
| Club medical notes | Until consent is withdrawn (deleted at once), the athlete is erased, or the club closes |
| Entry rosters with athlete names and dates of birth | Reduced to team level (club, team, division, placing) 12 months after the event |
| Score sheets and judges’ comments | 24 months after the event |
| Audit log (who did what, never medical or contact values) | 24 months |
| Medical incident reports about children | Until the child is 21, or 3 years after the event, whichever is later |
| Safeguarding records | As set by the welfare officer (normally 6 years after the event) |
| Email content | Message bodies removed 30 days after sending; send records deleted after 13 months |
| Ticket buyers | Paid orders: 6 years (financial records); unpaid or cancelled orders: 13 months |
| Invoices, payments and refunds | 6 years from the end of the producer’s financial year |
| Registered interest and mailing-list sign-ups | 24 months after the producer’s last event, unless converted |
| Music files and licence proofs | Deleted once no current or future event needs them (licence files 30 days after the event) |
| User accounts | Until you delete your account, plus 30 days; accounts unused for 3 years are reviewed |
| Backups | 30 days, encrypted |
These periods run as automatic scheduled jobs, and each run is recorded.
Who we share it with
We use a small number of service providers (sub-processors) to host and run CheerDeck — see the sub-processor list, including where each one stores data and the safeguards for any transfer outside the UK. Payments are made to each producer’s own Stripe account. We never sell personal information or use it for advertising.
Security
Every table is protected by row-level security so one organisation can never read another’s data; secret keys stay on our servers; staff access to a producer’s workspace needs two-step verification, a recorded reason and lasts 60 minutes, and never includes medical or safeguarding records. Backups are encrypted.
Your rights
You can ask for a copy of your information, ask us to correct or delete it, object to or restrict some uses, and complain. You can export your own account data and request deletion from your account page. For a child’s information, contact the club (or the producer for event records); we help them respond within one month.
If you are unhappy with how we handle your information, please tell us first at privacy@cheerdeck.co.uk — we acknowledge complaints within 30 days. You can also complain to the Information Commissioner’s Office (ico.org.uk/make-a-complaint, 0303 123 1113).
Cookies and storage
Public pages set no cookies. The signed-in apps keep your session and offline work (for example queued scores) in your browser’s own storage so they work without a connection; nothing is used for tracking.
Changes
We will update this notice when our processing changes and give producers and clubs 14 days’ notice of any new sub-processor.