Privacy policy

Last updated: 8 June 2026

1.Who we are

Ultimate Player Performance is a youth football coaching service operating in the United Kingdom. We are the "data controller" for any personal data we collect through our website and in the course of providing our coaching services.

If you have any questions about this policy or how we handle your data, please contact us at [email protected].

2.What data we collect

Depending on how you interact with us, we may collect the following types of personal data:

Information you give us

• Name of the parent, guardian, or adult booking a session
• Name and age of the player attending the session (where the player is a minor)
• Email address and phone number
• Billing details and transaction history (payment details are handled by our payment provider — we do not store full card numbers)
• Any health, medical, or safeguarding information you choose to share with us (e.g. injuries, medical conditions, allergies, special considerations)
• Communication you send to us via email, contact forms, social media, or messaging

Information collected automatically

• IP address and approximate location
• Device type, browser, and operating system
• Pages visited, time spent, and how you arrived at our site
• Cookies and similar tracking technologies (see Section 8)

3.How we use your data

We use your personal data for the following purposes:

Purpose	Lawful basis
Taking and managing bookings, processing payments, sending confirmations	Performance of a contract
Communicating with you about your sessions, cancellations, or changes	Performance of a contract
Keeping records for accounting, tax, and legal obligations	Legal obligation
Safeguarding minors who attend our sessions	Legitimate interests / Legal obligation
Sending occasional marketing emails about our sessions and offers	Consent (opt-in only)
Improving our website and services	Legitimate interests
Responding to enquiries you send us	Legitimate interests

4.Children's privacy and safeguarding

Because UPP works with players under the age of 18, we take particular care with data relating to children.

• Bookings on behalf of a minor must be made by a parent or legal guardian aged 18 or over.
• We only collect data about a child that is necessary to deliver our coaching service safely (e.g. age, relevant medical information, emergency contact).
• We never knowingly market to children directly.
• If we use photographs or video featuring minors (for example, on our website or social media), we will only do so with prior written consent from a parent or guardian.
• If you'd like us to remove any image or content relating to your child, please email us and we will action your request promptly.

5.Who we share data with

We never sell your data. We may share it with trusted third parties only where necessary to deliver our service or comply with the law. These include:

• Payment processors (e.g. Stripe) — to take payment for sessions securely
• Booking and CRM platforms (e.g. GoHighLevel) — to manage bookings, calendars, and communications
• Email and analytics providers — to send confirmations and understand site usage
• HMRC and regulators — where legally required
• Law enforcement or safeguarding bodies — where there is a legal duty to share, or where a child's safety is at risk

All third parties we work with are bound by contracts that require them to handle your data securely and only for the purposes we instruct.

6.How long we keep your data

We only keep personal data for as long as we need it for the purposes set out in this policy, or as required by law. As a general guide:

• Booking and customer records: up to 6 years (to meet HMRC requirements)
• Marketing data: until you opt out
• Website analytics: up to 26 months
• Safeguarding records: in line with applicable safeguarding guidance

Once we no longer need your data, we will securely delete or anonymise it.

7.Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct any data that's inaccurate or incomplete
• Erase your data ("the right to be forgotten") in certain circumstances
• Restrict or object to certain types of processing
• Withdraw consent at any time where we rely on it
• Receive a copy of your data in a portable format
• Lodge a complaint with the ICO at ico.org.uk

To exercise any of these rights, please email us at [email protected]. We will respond within one month.

8.Cookies

Our website uses cookies to make the site work, remember your preferences, and help us understand how visitors use the site. Cookies fall into the following categories:

• Strictly necessary cookies — required for the site to function (e.g. session, security)
• Analytics cookies — to help us understand site usage (only set with your consent)
• Marketing cookies — to measure ad performance (only set with your consent)

You can manage or withdraw your cookie consent at any time using the cookie banner on our site, or by adjusting your browser settings.

9.How we keep your data secure

We take appropriate technical and organisational measures to protect your data against unauthorised access, loss, or misuse. This includes secure hosting, encryption in transit, restricted internal access, and contracts with our service providers.

No method of transmission over the internet is 100% secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO and, where required, you directly within 72 hours.

10.International transfers

Some of the third parties we use (for example, certain cloud providers) may store or process data outside the UK. Where this happens, we ensure appropriate safeguards are in place — such as Standard Contractual Clauses or adequacy decisions — so your data remains protected.

11.Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of the page will always show when it was last changed. If we make any significant changes, we'll do our best to let you know directly.