Privacy Policy

1. Overview & Scope

This Privacy Policy explains how SprintScale IT ("SprintScale", "we", "us") processes personal information in connection with our SaaS management platform, in alignment with principles under the UK Data Protection Act 2018 and UK GDPR. Note: Initial Terms and Privacy pages implemented; formal legal and regulatory review remains an operational/business requirement prior to commercial reliance.

2. Roles: Data Controller vs Data Processor

Account & Billing Information: SprintScale acts as the Data Controller for information collected directly from you to set up your administrator account, verify your identity, manage subscriptions, and communicate platform updates.

Student, Parent & Operational Data: Your organisation acts as the Data Controller for student records, parent contact details, attendance registers, and medical notes entered into your tenant database. SprintScale processes this data strictly as a Data Processor on your organisation's behalf.

3. Information We Collect

• Account Identifiers: Name, work email address, hashed passwords.
• Organisation Details: Organisation name, centre addresses, brand colors, contact telephone.
• Technical & Log Data: IP addresses (used for rate-limiting and fraud prevention), browser types, and timestamped security audit events.
• Student & Parent Information: Entered by you or submitted via your centre booking portals (names, emergency contacts, medical/safeguarding notes).

4. How We Use Information

We process personal data to: (a) provide, operate, and maintain the Service; (b) enforce tenant isolation and account security; (c) communicate administrative and operational notices; (d) comply with legal obligations; and (e) prevent abusive, fraudulent, or unauthorized access. We do not sell personal data to third parties.

5. Data Security & Storage

All data is stored in secure managed database clusters with transport layer encryption (TLS 1.3) and encryption at rest. Tenant isolation boundaries prevent cross-organisation access. Access to production infrastructure is strictly restricted to authorised personnel.

6. Your Rights

Under UK data protection law, you have rights including the right to access, rectify, or request erasure of your personal data. Where SprintScale acts as a processor on behalf of an organisation, data subjects (such as parents) should direct requests directly to the organisation managing their club or centre.

7. Contact Data Protection

For questions, data subject requests, or privacy enquiries, contact our privacy contact at support@sprintscaleit.co.uk.