Privacy policy

1. Who we are

Trophy is a trading name of Cube Systems Limited, part of Crushed Ice Group. We are registered in England and Wales with company number 17220899, and our registered office is Unit 11, Olney Business Park, Osier Way, Olney, Buckinghamshire, MK46 5FP.

We are the controller of the personal data described in this policy. We are registered with the Information Commissioner’s Office under registration number ZC216972.

For privacy questions or to use your rights, email hello@trophyapp.co.uk or call 01234 672 617.

2. Organisers and the people at their events

An organiser decides who is in their tournament, what they enter about each team or player, who can score and what the public board shows. We hold that information to run Trophy and follow the organiser's settings. If you have a question about an event you played in, the organiser is usually the quickest person to ask. We will help them, or you, if needed.

Organisers should enter only what the event needs and must not add special category data, such as health information, that the event does not need.

3. What we collect

When you visit the website

Like any web server, ours keeps a log of each request: your IP address, the date and time, the page requested, the page that linked to it, and the browser and operating system your device reports. We use these logs only to keep the site secure and working.

Your browser also keeps a short note of your visit in its session storage, under the name visit_journey: the page you arrived on and when, the site that sent you, any campaign tags or ad click IDs in that first link, the previous page and how many pages you have viewed. It stays in that browser tab, is deleted when you close it and only reaches us if you send the contact form.

If you allow analytics

A banner asks whether you allow Google Analytics. If you choose “Allow analytics”, Google Analytics 4 sets its _ga and _ga_<container-id> cookies and records which pages you view, how you arrived, the type of device, browser and screen you use, your approximate location (such as the country and city, worked out by Google from your IP address), and interactions such as scrolling, following a link to another website, clicking a phone number or email address, signing up and sending a form. GA4 does not log or store IP addresses. We see the results as reports about visits in general and do not use them to identify anyone. Advertising features are switched off.

The Google Analytics script only loads after you allow analytics, so if you choose “Essential only” nothing is sent to Google. If you withdraw your consent through Cookie settings, Google Analytics stops and its _ga cookies are removed. Google Analytics is provided by Google Ireland Limited, with Google LLC.

When you get in touch

If you use the contact form we collect your name and email address, your club or organisation and phone number if you give them, what the enquiry is about, your message and the page you sent it from.

With the form, your browser also sends details about your visit. They help us route your enquiry to the right person, spot misuse of the form and understand which pages lead people to get in touch. They are:

• your IP address;
• your browser and operating system, read from the user agent your browser reports, and the type of device;
• your language, time zone and local time, your screen and window size, whether your device has a touch screen and whether cookies are enabled;
• the note of your visit described above: the page you arrived on and when, the site that sent you, campaign tags and ad click IDs, the previous page and the number of pages viewed; and
• if you allowed analytics, your Google Analytics client ID, which lets us match the enquiry to the analytics for that visit.

The enquiry is sent by email through Amazon Simple Email Service, in the UK, to the Cube Systems enquiries mailbox, with your email address set as the reply address. If you email or call us, we keep what you tell us and the details you contact us from.

When you register interest in a sport

We keep your email address and the sport you chose, so we can send you one email when that sport is ready.

When you create an account

We keep your email address and display name, how you sign in (an emailed sign-in link, or your Google account ID and email address if you choose Google), the sessions you are signed in on so you can see and end them, your notification choices, and any browser alert subscription you turn on. We send sign-in links and account notices by email through Amazon Simple Email Service.

When you organise or take part in a tournament

We keep the tournament's name, settings and plan, the teams and players in it, the games and scores, and who sent, confirmed or corrected each result. Results are never overwritten: a correction is saved as a new version with who made it, when and why. We also keep the names helpers use, reactions and crowd chat messages, and an audit record of changes.

A player can join with a code without an account, an email address or a password. The display name they give is shown in the event, and a join token is stored on their device so it can see their games and send their scores.

When you pay

When passes are on sale, payment is taken by Stripe on its own checkout pages. We receive a payment reference and what was bought, never your full card details.

4. Why we use it and our lawful bases

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can object at any time (see section 10).

5. Children and junior events

A child does not need an account, an email address or a password to take part. They join through a code or link the organiser shares, and the organiser, coach, club or guardian stays responsible for the event. Organiser accounts are for adults.

Junior mode is designed for these events: records held by a guardian, redacted public names on public boards and scoring limited to staff. Our features page shows its current status. Whatever is switched on, organisers should use a first name and initial or another approved display name on public boards and keep scoring with trusted helpers. Read Keeping kids safe for the full approach and how to report a concern.

6. Who we share it with

We use a small number of suppliers, each under a contract that limits what they may do with the data:

• Amazon Web Services (Amazon Web Services EMEA SARL) hosts the Trophy servers, database and backups in the UK, and sends our email.
• Google provides “Sign in with Google” if you choose it, and Google Analytics only if you allow it.
• Stripe takes payment for passes when they are on sale.
• Your browser's push service (run by Google, Apple, Mozilla or Microsoft, depending on your browser) delivers browser alerts if you turn them on.

Information an organiser puts on a public board can be seen by anyone with the code or link. We may disclose information where the law requires it, to protect someone from harm or to investigate misuse of the service. We do not sell personal data or use it for advertising.

7. Where your data is held

Trophy is hosted in the UK on Amazon Web Services (AWS). Our servers, database and backups are in the UK, and our email is sent through Amazon Simple Email Service in the UK.

Some providers, such as Google and Stripe, may process limited data outside the UK. Where that happens the transfer is protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for Google Analytics), the UK International Data Transfer Agreement or Addendum, or equivalent safeguards.

8. How we protect it

We use encrypted connections, sign-in cookies that page scripts cannot read, restricted and audited staff access, rate limits and separate staff sign-in with two-step verification. No online service can promise perfect security, so tell us straight away if you think someone has accessed your account.

9. How long we keep it

Backups roll over on their own schedule, so deleted information can remain in a backup for a short time before it is overwritten.

10. Your rights

Under UK data protection law you can ask for a copy of your data, ask us to correct or delete it, restrict how we use it, object to our use of it, or ask for a copy to take elsewhere. Where we rely on consent, such as for analytics, you can withdraw it at any time without affecting anything done before.

Account holders can download their data and delete their account from the account settings in the Trophy app. For anything else, email hello@trophyapp.co.uk. We may ask for something that confirms it is you, and we reply within one month. If the request is about information an organiser entered, we may involve the organiser.

11. Complaints

If you are unhappy with how we have handled your data, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection, quoting our registration number ZC216972:

• online at ico.org.uk/make-a-complaint;
• by telephone on 0303 123 1113; or
• by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

12. Cookies and browser storage

Trophy uses a sign-in cookie, a cookie that remembers your theme and browser storage that keeps a player's place in an event. Google Analytics runs only if you allow it. The cookie policy lists every item and how to change your choice.

13. Changes to this policy

We will update this policy, and the date at the top, when what we collect or who we share it with changes. If a change is significant, we will tell account holders by email before it takes effect.