PRIVACY POLICY

This Privacy Policy explains how [COMPANY LEGAL NAME] (trading as “Throw”, “we”, “us”, or “our”) collects, uses, stores, and shares personal data when you use the Throw website, applications, and related services (the “Service”). It is written to comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR”) and, where applicable, the UK GDPR and the Data Protection Act 2018.

If you have any questions about this Policy or about how we handle your personal data, please contact us at admin@treblo.co.uk.

01Who we are

The data controller responsible for your personal data is:

[COMPANY LEGAL NAME]
Registered address: [REGISTERED ADDRESS]
Country of registration: [COUNTRY OF REGISTRATION]
Company number: [COMPANY NUMBER]
VAT number: [VAT NUMBER, if applicable]
Contact: admin@treblo.co.uk

02Scope of this Policy

This Policy applies to personal data we process when you:

• visit our website or marketing pages;
• register for a Throw account;
• subscribe to a paid plan or use the free trial;
• create or join leagues, teams, fixtures, or matches on the platform;
• record or submit match data, scores, statistics, or player profiles;
• contact us for support, feedback, or any other reason.

03The personal data we collect

We collect and process the following categories of personal data:

3.1 Information you give us

• Identity data: your display name, username, and (where you choose to provide it) any name or initials shown on player profiles, leagues, or fixtures.
• Account data: your email address and a hashed password used to authenticate you. We never store your password in plain text — passwords are hashed using bcrypt.
• Plan / subscription data: the plan you have selected (free or paid), your subscription status, and any communications related to it.
• Player and match data: match scores, legs, averages, checkouts, head-to-head records, fixtures, league standings, and any notes or stats you submit. This data may be visible to other members of the leagues or teams you join.
• Communications: the content of messages you send us by email or other support channels.

3.2 Information we collect automatically

• Session and security data: your IP address, browser user-agent string, session identifiers, login timestamps, and similar technical information. We use this to keep your account secure, prevent abuse, and maintain audit logs.
• Usage data: actions you take in the Service, such as fixtures created, matches finalised, and pages visited, used to operate and improve the Service.
• Cookies and similar technologies: we use a small number of strictly necessary cookies (for example, your login session). See section 10 below.

3.3 Information we receive from third parties

• Payment data from Stripe: when you subscribe to a paid plan, payments are processed by Stripe, Inc. and its EU/UK affiliates. We do not see or store your full card number, CVC, or bank details. Stripe shares with us a customer ID, subscription ID, your billing email, country, the last four digits of your card, the card brand, and the status of your subscription (active, trialing, past due, cancelled, etc.).
• Email service providers: if you contact us or we send you transactional emails (such as password resets), our email provider may process your email address and the message contents on our behalf.

We do not knowingly collect special category data (such as health, biometric, or political opinion data). Please do not submit such data to the Service.

04Children

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data without appropriate consent, please contact admin@treblo.co.uk and we will delete it.

05How we use your personal data and our legal bases

Under GDPR we must have a lawful basis for processing your personal data. We rely on the following bases:

5.1 Performance of a contract (Article 6(1)(b) GDPR)

To create and operate your account, deliver the Service, manage leagues, teams, fixtures and matches, process payments and subscriptions, provide customer support, and otherwise perform our obligations under our Terms of Service.

5.2 Legitimate interests (Article 6(1)(f) GDPR)

To keep the Service secure, prevent fraud and abuse, maintain audit and session logs, debug technical issues, analyse aggregated usage to improve the Service, and (where permitted) send service-related announcements. We have balanced these interests against your rights and freedoms.

5.3 Legal obligation (Article 6(1)(c) GDPR)

To comply with applicable laws and regulations, including tax, accounting, and consumer-protection obligations, and to respond to lawful requests from public authorities.

5.4 Consent (Article 6(1)(a) GDPR)

Where we send you any non-essential marketing emails (we do not currently do so) or use any non-essential cookies, we will only do so on the basis of your consent, which you can withdraw at any time.

06Who we share your personal data with

We do not sell your personal data. We share it only with the following categories of recipients, and only as needed:

• Hosting and infrastructure providers: the providers that host our servers and database.
• Payment processor: Stripe, for processing subscriptions, billing, and refunds.
• Email/communication providers: for sending transactional emails such as password resets.
• Other Service users: your display name, username, player profile, and match/league data are visible to other members of leagues or teams you participate in. This is essential to the functioning of a league platform.
• Professional advisers and authorities: lawyers, accountants, auditors, regulators, or law-enforcement bodies where required by law or to defend our legal rights.
• Successors in interest: if we are ever involved in a merger, acquisition, or sale of assets, your data may be transferred, subject to this Policy.

All processors act on our documented instructions under written data-processing agreements that meet the requirements of Article 28 GDPR.

07International transfers

Some of our service providers (notably Stripe) may process personal data outside the European Economic Area or the United Kingdom. Where this happens, we rely on appropriate safeguards under Articles 44–49 GDPR, such as the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where relevant), or on the recipient’s certification under a recognised adequacy mechanism. You can request a copy of the relevant safeguards by emailing admin@treblo.co.uk.

08How long we keep your personal data

We keep your personal data only for as long as necessary for the purposes set out in this Policy, including any period required to comply with our legal, accounting, or reporting obligations.

• Account data: for as long as your account is active, plus a reasonable period after closure (typically up to 12 months) to handle disputes, refunds, or chargebacks.
• Match, league, and statistics data: may be retained even after individual accounts close, in anonymised or pseudonymised form, where it forms part of league records relied on by other users.
• Payment and tax records: retained for the period required by applicable tax and accounting law (typically 6 years in the UK and 7–10 years in many EU member states).
• Security and session logs: typically retained for up to 12 months.

When personal data is no longer required, we delete it or irreversibly anonymise it.

09Your rights under GDPR

Subject to certain conditions, you have the following rights:

• Right of access: to obtain a copy of the personal data we hold about you.
• Right to rectification: to have inaccurate or incomplete data corrected.
• Right to erasure (“right to be forgotten”): to have your personal data deleted in certain circumstances.
• Right to restriction of processing: to limit how we use your data in certain circumstances.
• Right to data portability: to receive certain data in a structured, commonly used, machine-readable format.
• Right to object: to object to processing based on legitimate interests.
• Right to withdraw consent: where we process data based on your consent, you may withdraw it at any time.
• Right not to be subject to solely automated decisions: we do not currently make decisions about you that have legal or similarly significant effects based solely on automated processing.

To exercise any of these rights, email admin@treblo.co.uk. We will respond within one month, as required by Article 12 GDPR. We may need to verify your identity before acting on your request.

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner’s Office (ico.org.uk). In the EU, you may complain to the supervisory authority of your habitual residence, place of work, or place of the alleged infringement.

10Cookies

We use a small number of strictly necessary cookies, including a session cookie that keeps you logged in. We do not currently use advertising or third-party tracking cookies. If this changes, we will update this Policy and, where required, ask for your consent through a cookie banner.

11Security

We take appropriate technical and organisational measures to protect your personal data, including encrypted connections (HTTPS), bcrypt-hashed passwords, restricted internal access on a need-to-know basis, regular backups, and logging of session and security events. No system is perfectly secure; if you believe your account has been compromised, please contact support@treblo.co.uk immediately.

12Changes to this Policy

We may update this Policy from time to time. The “Last updated” date at the top reflects the most recent version. Where changes are material, we will notify you by email or through the Service before they take effect.

13Contact us

If you have any questions about this Policy or wish to exercise your rights, please contact:

[COMPANY LEGAL NAME] (trading as Throw)
Email: admin@treblo.co.uk
Address: [REGISTERED ADDRESS]