CHGConnect - Privacy Policy

Effective date: August 24, 2026

1. Introduction
Champion Her Game ("we", "our", or "us") operates the application at https://championhergame.co.uk. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our app. CHGConnect is a coaching intelligence app for grassroots girls' sport. Coaches use it to run anonymous team check-ins, track how their squad is feeling across five areas (Enjoyment, Belonging, Development, Voice and Confidence), give player recognition, and manage their squad. Players sign in with a name and PIN (no account or email required) to answer anonymous questions and receive recognition from their coach. The service is accessed via a web browser at app.chgconnect.app — there is no native app download.

2. Scope of This Policy
This Privacy Policy applies to all personal information collected through https://championhergame.co.uk and any related applications, services, APIs, or communications provided by Champion Her Game. It does not apply to third-party websites, products, or services even if they are linked from our platform. By using our services you acknowledge that you have read and understood this policy.

3. Information We Collect
We may collect the following categories of information: Full name Email address IP address Device information Usage data. This includes information submitted when users create an account or manage their workspace. Some information is required to create an account or to comply with a legal obligation; if you do not provide it, we may be unable to offer some or all of the service to you.

4. How We Use Information
We use personal information to:
- provide, maintain, and improve our services;
- respond to support requests and communicate about the service;
- secure the platform and detect fraud or abuse;
- comply with legal obligations;
- understand usage patterns and improve product performance through analytics;

5. Cookies and Tracking
We use cookies and similar technologies to keep users signed in, remember preferences, and improve site performance. We also use analytics tools to understand feature usage and performance trends.

6. Third-Party Service Providers
We work with trusted service providers to operate the platform. Current providers may include: We use trusted third-party service providers to support our operations, such as hosting, analytics, and communications. These providers may process personal information on our behalf subject to contractual and legal safeguards.. These providers may process personal information on our behalf subject to contractual and legal safeguards.

7. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes described in this policy; it is then securely deleted or anonymised.

8. Children's Privacy

Our service may be accessed by or offered to minors. We do not knowingly collect personal information from children in violation of applicable law. Where consent is required for a child, we will seek consent from a parent or legal guardian and take reasonable steps to verify that consent where required.

If you believe a child has provided personal information unlawfully, contact us so that we can review and delete the information where appropriate.

CHGConnect is designed for use by grassroots sports coaches (adults). Players — who may be under 18 — access the service through a first name and 6-digit PIN set up by their coach. Players do not create accounts, provide email addresses, or hand over personal data beyond their first name, Player Profile answers, and anonymous check-in responses. Check-in answers are aggregated at team level and never linked to an individual player. Player Profile responses are visible only to that player's coach. We do not use player data for marketing, advertising, or profiling purposes.

9. Your Privacy Rights
Depending on where you are located and the laws that apply, you may have the right to:
- **Right of Access**: request a copy of the personal information we hold about you;
- **Right to Rectification**: request correction of inaccurate or incomplete information;
- **Right to Erasure**: request deletion of personal information, subject to legal exceptions;
- **Right to Data Portability**: receive a machine-readable copy of your data where applicable;
- **Right to Object**: object to processing based on legitimate interests or direct marketing;
- **Right to Restriction**: request that we limit how we process your information in certain circumstances;
- **Right to Withdraw Consent**: withdraw consent at any time where we rely on consent as our legal basis;

How to exercise your rights:** You may submit a Data Subject Access Request (DSAR) or any other privacy request by emailing us at data@championhergame.co.uk. We will acknowledge your request within 5 business days and provide a substantive response within **30 days** of receipt (or such shorter period as required by applicable law). In complex cases we may extend this by a further 60 days and will notify you accordingly.

10. Legal Basis and Jurisdiction

We process personal information in accordance with applicable privacy laws in **England and Wales, United Kingdom**. The table below sets out the legal basis we rely on for each category of processing activity:

| Processing activity | Legal basis |
|---|---|
| Account creation and core service delivery | **Contract performance**: processing is necessary to perform our agreement with you |
| Transaction records and regulatory compliance | **Legal obligation**: processing is required to meet applicable legal requirements |
| Security monitoring, fraud prevention, and abuse detection | **Legitimate interests**: we have a legitimate interest in keeping the service and our users secure |
| Platform analytics and product improvement | **Legitimate interests**: we have a legitimate interest in understanding how the service is used; anonymised or aggregated data is used where possible |

Privacy contact:** We have not appointed a formal DPO but have designated a responsible person to oversee privacy compliance. All privacy enquiries should be directed to the contact address in Section 13.

11. Security
We implement reasonable technical and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction.

12. International Transfers
If personal information is transferred across borders, we take steps to ensure the information receives an adequate level of protection under applicable law.

13. Contact Us
If you have questions about this Privacy Policy or want to exercise a privacy right, contact us:

- **Email:** data@championhergame.co.uk
- **Privacy requests:** data@championhergame.co.uk

We aim to respond to all privacy enquiries within 5 business days.

14. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and provide notice where required.

Annex A. Jurisdiction-Specific Privacy Disclosures

The following provisions supplement this Privacy Policy and apply where the relevant law governs your relationship with us.

UK GDPR & Data Protection Act 2018
The UK General Data Protection Regulation (UK GDPR) applies to processing of personal data of UK residents alongside the Data Protection Act 2018. Your rights and our obligations broadly mirror the EU GDPR. You have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113. International transfers from the UK rely on the UK Addendum to the EU SCCs or the UK International Data Transfer Agreement (IDTA).

Data protection complaints procedure (Data (Use and Access) Act 2025, s.164A DPA 2018).** We maintain a formal complaints procedure for data-protection concerns. You may submit a complaint to us using the contact details in this Policy. We will acknowledge your complaint within **30 days** and aim to provide a substantive response without undue delay. You are not required to complain to us before contacting the ICO, and you retain the right to lodge a complaint directly with the ICO at any time.

### App Tracking Transparency (iOS) and Advertising IDs
On iOS 14.5+, we request your permission via Apple's App Tracking Transparency (ATT) framework before using the IDFA or other identifiers to track you across apps and websites owned by other companies. On Android, we honor your "Delete advertising ID" setting and limit-ad-tracking signals.

Data Breach Notification
If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where required by Article 33 GDPR / UK GDPR and notify affected individuals without undue delay where required by applicable breach-notification law (including U.S. state breach laws, Australia's NDB scheme, PIPEDA breach reporting, and LGPD Article 48).

Sub-Processors

We engage trusted third-party service providers ("sub-processors") to help operate the Service, including cloud hosting, payment processing, and web application infrastructure. Each sub-processor is bound by a written contract requiring confidentiality, appropriate security measures, and processing only on our documented instructions in accordance with UK GDPR Article 28. A current list of sub-processors is available on request by emailing data@championhergame.co.uk