Security and privacy

Security and privacy of your club’s data

A club handles data about children, parents and payments. So Clubsman takes care of secure sign-in, precise rights and a trail of every change — and makes the club’s GDPR obligations easier.

Sign-in and sessions

  • Two-step sign-in is required for administrators: a code by e-mail or an authenticator app, with recovery codes.
  • A list of signed-in devices with remote sign-out; a new password signs out the other devices.
  • Parents sign in with a one-time code or a link by e-mail — no shared passwords.
  • Passwords are never sent by e-mail; a member gets a personal link to set their password.
  • The second-step screen tells you whether the e-mail with the code was delivered or is delayed; after too many attempts the button counts down the seconds.
  • After signing in you return to the page you came from — also from a link in an e-mail.

Rights and separated data

  • Every club has its own address and data kept apart from other clubs.
  • Custom roles and permissions; the server checks the rights on every request.
  • A coach can see only the groups they coach; a member or parent only their own data.
  • The server refuses every module that is switched off — it does not just hide it.

Trail and oversight

  • An audit trail in plain words: changes and access (records opened, exports, sign-ins), also member by member, with an Excel export.
  • The trail tables are locked in the database — entries cannot be changed quietly.
  • An activity log with a request code that lets support find the exact error.

GDPR for the club

  • The data processing agreement (GDPR Article 28) is signed in Clubsman before first use; the club receives a PDF.
  • Privacy policy templates and the record of processing activities (Article 30) built from the modules you use.
  • On “My profile” members export their data, see their consents, submit requests and follow where a request stands.
  • Data subject requests with the deadline in words (“Due in 12 days”) and one next step for the club.
  • Automatic anonymisation of inactive members by rules the club sets.

No third-party trackers

  • Device notifications by the Web Push standard with our own keys, without an outside provider.
  • External content (e.g. video) loads only after consent.
  • The AI assistant’s language model runs on our own server.
  • Clubsman’s fonts and images are self-hosted.

Infrastructure

  • Servers in the EU; the list of sub-processors is published.
  • The data processing agreement lists the technical and organisational measures.
  • Platinum: a custom data processing agreement and service level agreement (SLA).

Documents

Legal documents of the portal

The current versions are published in the portal. The club signs the data processing agreement in the portal before first use.

Questions

Questions about data

Where is the data and who processes it?

On servers in the EU. Before first use the club signs a data processing agreement (GDPR Article 28) in Clubsman and receives a signed copy as a PDF; the list of sub-processors is published. Administrators sign in with two-step verification.

Who sees members’ data?

Only those whose role allows it. The administrator has every right, a coach by default the calendar, attendance and their own groups, and a member or parent only their own data. The club can create custom roles (e.g. treasurer or accountant). The server checks the rights on every request.

Can we export our data?

Yes. You export members, invoices and reports to Excel, accounting data for your accountant, and for a single member you can prepare a personal data export (GDPR). Members can export their own data themselves.

A question about security?

Write to us. The data processing agreement, the list of sub-processors and the portal’s privacy policy are published.

Try it free Contact us