Your data, our commitments.

Who does what?

The club is the controller: it decides which data it collects and why. Fienix BV (company number BE 0743.386.323, 's Herenbaan 26, 2840 Rumst, Belgium), which offers Myclubly, is the processor and processes that data only on the club's behalf. This agreement applies for as long as the club uses Myclubly.

Which data?

Of people who use the admin: name, email address and permissions. Of board members and contacts the club shows on its site: name, role, photo and contact details.

Of members, parents and visitors who fill in a form, register for an event or sign up for the newsletter or team updates: name, email address, phone number and whatever they enter themselves. Of players in attendance: name, team, email address and their responses. Of scorers, the name, if the club turns this on.

The club does not collect special categories of data through Myclubly, such as health data.

What do we use it for?

Only to run Myclubly: showing the website, receiving forms and registrations, sending emails and newsletters, keeping attendance and posting on Facebook and Instagram the messages the club writes itself. We do not use the data for ourselves, do not sell it and do not use it for advertising. If the club asks for something we believe goes against the GDPR, we say so right away.

Who has access?

Only people at Fienix who work on Myclubly, and only when needed, for example for support or during an outage. Everyone with access is bound by confidentiality.

How do we protect it?

In the database, each club only sees its own data. Connections are encrypted, data is stored encrypted and passwords are never stored in readable form. The club decides for each user which sections they can manage, and revokes access in one click.

Sub-processors

For part of the work we use these partners: Supabase (database, files and the email queue; servers in Frankfurt, Germany), Vercel (website hosting; servers in Frankfurt, Germany), Resend (sending email; servers in the EU), Anthropic (translating content and the help assistant in the admin, only when the club uses them) and Meta (only if the club connects Facebook or Instagram, to publish its posts).

Each sub-processor is bound by terms at least as strict as these. Where data goes to a country outside the European Economic Area, this is based on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

If we start using a new sub-processor, we let the club know at least 30 days in advance. If the club has a well-founded objection, we look for a solution together. If that fails, the club can cancel.

Requests from members and parents

If someone asks the club to view, correct or delete their data, the club can usually do this itself in the admin. If not, we help. If such a request reaches us directly, we forward it to the club.

Data breaches

If we discover a personal data breach, we inform the club without undue delay, at the latest 48 hours after discovering it. We share what we know at that point: what happened, which data and how many people are affected, and what measures we are taking. The club decides whether to report it to the Belgian Data Protection Authority and to the people concerned. We help with that.

Assistance and audits

We give the club the information it needs to show GDPR compliance, and help with a data protection impact assessment if one is needed. The club may have an audit carried out, with at least 30 days' notice, no more than once a year (except after a data breach) and at its own cost.

When the club stops

Up to 30 days after the end, the club can request an export of its data. After that we delete the data, unless the law requires us to keep it longer. Backups are overwritten within our hosting partner's usual retention period.

Liability and governing law

Liability is governed by the terms of use. This agreement is governed by Belgian law. Questions? Email us at info@myclubly.com.