Privacy Policy

ISR-GEM provides governance advisory and licence readiness assurance to football clubs. We are the data controller for personal data collected through this website and platform.

Contact details you submit (name, role, club, email, phone), account details for authorised users, audit and evidence data entered by your club, and security logs (sign-ins, exports, changes).

To respond to enquiries, provide the platform under contract, issue invoices, keep the service secure, and meet legal obligations. We never sell data or use it for advertising.

Data is held in secured cloud infrastructure with encryption in transit and at rest, strict per-club access controls, and daily automated backups.

Club data, including audits, audit records, evidence references and invoices, is kept for the contract term plus six years after the subscription ends. This matches UK record-keeping practice and lets us support defensible board assurance. It is then securely deleted. You may ask us to delete it sooner where the law allows.

User account details are deleted when access is removed. We keep only the minimum needed in audit trails (name, email and the action taken). Security logs are kept for six years. Enquiries that do not lead to a contract are deleted after 24 months.

Our hosting provider takes automatic daily backups, and administrators may take encrypted full exports. Backups are held securely with restricted access and are overwritten or deleted on a rolling basis. Data deleted from the live service may stay in backups until they expire, and will not be restored except to recover the service.

Every erasure or other data subject request is recorded in a permanent deletion log. The log shows what was deleted, when, by whom and on what legal basis. Where records must be kept by law or for the retention period above, we tell you what we kept and why.

You can ask to access, correct, export or delete your personal data, or object to processing. Submit a request through our contact form choosing “Data protection request”. We respond within one month. You may also complain to the ICO (ico.org.uk).

See our Cookie Policy.