Privacy policy.

Last updated: 12 November 2026

Maldon & Tiptree Football Club Limited (“the club”, “we”, “us”) is responsible for the personal information we collect through maldontiptreefc.com, our online shop, and when you contact or deal with the club. This notice explains what we collect, why, who we share it with, how long we keep it and the rights you have.

Who we are

The data controller is Maldon & Tiptree Football Club Limited, registered in England and Wales, company number 07479835. Registered office: Maldon Stadium, Park Drive, Maldon, Essex CM9 5JQ. ICO registration number: ZB096106.

For any privacy question or request, email info@maldontiptreefc.com or write to the Data Protection Lead at the address above. Our data protection lead is the Club Secretary.

Information we collect

• Contact and enquiry details: name, email, phone, message, event or venue booking details, dates and guest numbers. These come from you, through forms, email, phone or social media.
• Shop orders: name, billing and delivery address, email, phone, items ordered, kit personalisation (name and number), returns and refunds. These come from you, at checkout.
• Limited payment details: payment status, card type, last four digits and card country. These come from Stripe, our payment provider. We never see or store your full card number or security code.
• Your account: your email address and the orders and bookings linked to it. You sign in with a code we email you, so there is no password to keep.
• Marketing preferences: newsletter sign-ups, and your opt-ins and opt-outs. These come from you and Mailchimp, our email provider.
• Sponsorship and commercial contacts: name, job title and business contact details. These come from you or your organisation.
• Photos and video: supporters appearing in matchday and event photos, and Jammers TV footage. These come from club photographers and media volunteers.
• Website and device information: IP address, browser, device type, pages visited and security logs; analytics data only if you opt in. This comes from your device, our hosting and security providers, and Google Analytics (with your consent).
• Accessibility or health information you choose to share: for example accessible seating needs, or dietary requirements for hospitality. This comes from you.
• CCTV images: recordings made at Maldon Stadium on matchdays, for security, in areas marked by signs.

If you apply for a job or volunteer role, see our separate job and volunteer applicant privacy notice.

How we use your information and our lawful bases

• Process, deliver and support shop orders, including returns and refunds: contract.
• Send order confirmations, delivery updates and service messages: contract.
• Let you sign in to see your orders and bookings: contract.
• Answer enquiries and give club, ticket, sponsorship and venue information: legitimate interests, or steps before entering a contract.
• Prevent fraud and keep payments secure: legitimate interests and legal obligation.
• Keep accounting and tax records: legal obligation.
• Send newsletters and club or shop news by email: your consent, or for existing customers the “soft opt-in” for similar products. You can unsubscribe at any time.
• Run, secure and improve the website: legitimate interests.
• Website analytics with Google Analytics: your consent.
• Take and publish matchday and event photos and video for news, social media and Jammers TV: legitimate interests in promoting the club and recording its history.
• Meet accessibility or dietary needs you tell us about: your explicit consent.
• CCTV on matchdays, for safety, security and crime prevention: legitimate interests, including preventing and detecting crime.
• Safeguarding children and adults at risk: legitimate interests (safeguarding) and legal obligation.
• Comply with the law, respond to lawful requests from authorities, the FA or our league, and protect our legal rights: legal obligation and legitimate interests.

Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for details of that balancing, and you can object (see Your rights).

Online payments and Stripe

All online payments are processed by Stripe. You pay on Stripe’s secure checkout page, and your card details go straight to Stripe; the club does not receive or store them. Stripe is certified to PCI DSS Level 1, the highest standard for card security.

Stripe uses your information to process the payment on our behalf and, as an independent controller, to prevent fraud and meet its own legal obligations. Stripe’s automated fraud checks may decline a payment that looks high risk. If this happens, contact us and we will help you complete your order another way. You can read Stripe’s privacy policy. If you pay with Apple Pay, Google Pay or Link, those providers’ privacy terms also apply.

Email marketing

We only send marketing emails if you have opted in, or if you have bought from us and did not opt out of similar shop and club news at the time. Every email has an unsubscribe link. If you unsubscribe, we keep your email on a suppression list so we don’t contact you again by mistake. We do not share or sell our mailing list.

Photography, filming and Jammers TV

Matches and club events are public occasions and may be photographed or filmed. Crowd shots may include you. We use these images for match reports, news, social media, Jammers TV and the club archive. If you’d prefer a particular image of you not to be used, email us and we’ll consider removing it. We won’t publish close-up, identifiable images of a child as the focus of a story without a parent’s or guardian’s consent.

Children

Our website is for a general audience, including young fans. Shop orders must be placed by someone aged 18 or over. We don’t knowingly collect personal information online from children under 13 without a parent’s or guardian’s involvement. We don’t use children’s information for profiling or targeted advertising. Information about children involved in club activities is handled under the club’s safeguarding children policy.

Who we share information with

We share personal information only where needed, and we never sell it.

• Qivo builds, runs and supports the club’s website, shop and admin system. Processor.
• Vercel hosts the website and the admin system. Processor.
• Supabase provides the website’s database and file storage, which hold forms, orders, bookings and photos. Processor.
• Cloudflare keeps backup copies of the website’s database, and checks that forms are sent by people rather than bots. Processor.
• Resend sends the website’s emails, such as order receipts, booking confirmations and sign-in codes. Processor.
• Stripe takes payments and prevents fraud. Processor and independent controller.
• Mailchimp sends our newsletters. Processor.
• Microsoft 365 runs club email. Processor.
• Google Analytics, only if you opt in, gives us website statistics. Processor and, for some purposes, independent controller.
• ProKit UK Limited, our kit partner, and its couriers (such as Royal Mail) pack, personalise and deliver shop orders and handle returns. ProKit receives your name, delivery address, phone, email and order details. ProKit is a processor; couriers are independent controllers.
• Kaizen Ticketing and Pitchbooking, when you buy tickets or book facilities through them. Independent controllers.
• The FA, our league, police, HMRC, insurers and professional advisers, where required by law or football rules, or to protect legal rights. Independent controllers.

Transfers outside the UK

Some of our providers, including Stripe, Google, Mailchimp, Microsoft, Vercel, Supabase, Resend and Cloudflare, may process information in the United States or elsewhere. When that happens we rely on UK adequacy regulations (including the UK–US data bridge) or approved contract terms such as the ICO’s International Data Transfer Agreement or Addendum, so your information keeps an equivalent level of protection.

How long we keep information

• Enquiries and correspondence: 2 years after our last contact.
• Shop orders, payment and refund records: 6 years after the end of the financial year they relate to (tax and legal claims).
• Marketing list: until you unsubscribe; we review inactive subscribers every 2 years. Suppression records are kept so we honour opt-outs.
• Google Analytics data: 14 months.
• Website security logs: usually no more than 90 days.
• Backup copies of the website’s database: 30 days.
• CCTV: 30 days, unless needed to investigate an incident.
• Accessibility or dietary information: deleted once the booking or event is over.
• Published photos and video: kept in the club’s news and history archive; we’ll consider removal requests.

After these periods we delete or anonymise information.

Your rights

You have the right to:

• ask for a copy of your personal information
• ask us to correct information that is wrong or incomplete
• ask us to delete your information
• ask us to restrict how we use it
• object to our use of it where we rely on legitimate interests, and to stop direct marketing at any time
• ask for information you gave us to be transferred to you or another organisation, in a reusable format
• withdraw consent at any time, where we rely on consent
• not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you

To use any right, email info@maldontiptreefc.com. It is free. We will reply within one month, or up to three months for complex requests (we’ll tell you if so). We may need to confirm your identity, and if we ask you to clarify your request, the time limit pauses until you reply.

Keeping information secure

We use access controls, two-step sign-in for staff systems, encrypted connections and trusted providers to protect your information. Only people who need information for their role can see it. If a breach happens that affects you, we will tell you and the ICO where the law requires.

Complaints

If you’re unhappy with how we’ve handled your personal information, please tell us first. You can complain by email to info@maldontiptreefc.com (with “Data protection complaint” in the subject), by post to the address above, or any other way you choose. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, helpline 0303 123 1113.

Links to other websites

Our website links to ticketing, facility booking, video and social media services run by other organisations. They have their own privacy notices, and we are not responsible for how they use your information.

Cookies

See our cookie policy for the cookies and similar technologies we use and how to change your choices.

Changes to this notice

We update this notice when our services or the law change. The latest version and its date are always on this page. If a change significantly affects you, we will tell you directly where we can.