Privacy
This notice describes what the Humber Squash Organisation actually does with personal data on this website: what is held, what is published, who else receives it, and what you can do about it.
Running a league means publishing results, and results are about identifiable people. Most of what we hold about you is therefore public by design, and we would rather say so plainly than imply otherwise.
Signed in? My data shows you every record we hold about you and lets you download it.
[TODO: the league to confirm the legal name, status and address of the organisation responsible for this data, and any ICO registration number.]
What we hold about you
Your player record
Your name, your club, and — only where they have been given to us — your email address and phone number. If you are a qualified referee we also hold the date you qualified and a count of the matches you have refereed.
Your registrations
For each season: your team, your division, your player number, the rank and rating you started the season on, and how many times you have played as a substitute.
Your results and rating
Every individual rubber you play: the date, the fixture, the division, your opponent, both teams, the games won by each of you, the score of every game including tie-breaks, and your rating immediately before and after the rubber. We also hold matches you refereed and any award recorded against your name. Your current rating and rank are recalculated from these results rather than stored as a running total.
Your login
A username, your email address if you have given one, your display name, an optional phone number, and your role (ordinary member, team captain, club admin, league officer or administrator). Your password is stored only as a one-way hash: it cannot be read back, by us or by anyone else with access to the database. Where we created an account on your behalf, a one-time claim code sits on the account until you redeem it and set your own password, at which point the code is deleted.
Messages, notifications and preferences
Notifications we have sent you and whether you have read them; direct messages between you and other signed-in members, including the message text and when it was read; and which notification types you have switched off for email. If you signed up to the newsletter in the site footer, we hold that email address and the date you gave it.
Email we are sending you is queued in our own database until it has been delivered — the address, the subject, the message, and the reason for any failed attempt.
League requests
Where a captain asks the league for permission to play someone outside their own division, we hold the request: who raised it, who it is about, the reason given in free text, the decision, and any note the deciding officer added.
Captain details from the previous website
Where you were a team captain on the old site, the captain name, email address and phone number recorded there were imported with the rest of the data and are held until your account on this site has been set up.
Technical logs
Our hosting provider and the application log ordinary web-server information, including IP addresses and browser user-agent strings. Requests to the results feed described below are also recorded in our own database, with the IP address that made the request.
What is published on this site
Anyone, signed in or not, can see: your name, your club and team, your division, your fixtures, every result you have played including game scores, your rating and your ranking position, and any award you have won. This is inherent to a league table — a division cannot be ranked anonymously.
Not published: your email address, your phone number, your login details, your messages, your notifications, and the content of league requests.
A league administrator can view the site as your account when helping with a problem. While they do, the site shows a banner saying so, and the action is written to our logs.
Who else receives it
SquashLevels
SquashLevels.com maintains the national squash rating used across the UK. We publish a results feed which SquashLevels collects. For each rubber it contains the date, both players' names, both players' internal id numbers from this site, both club names, the score of every game, and a fixture reference. It also sends the same fixed values on every row for county, country, age category and sex, carried over unchanged from the previous website; those are not held per player and are not personalised. [TODO: the league to confirm with SquashLevels whether those fixed category and sex values should be corrected or removed.] Once SquashLevels holds the results, their own privacy terms apply to what they do with them.
Email delivery
Email from this site — password resets, notifications, contact-form enquiries — is sent through SendGrid, which necessarily sees the recipient address and the message.
Hosting
The site and its database run on Microsoft Azure. [TODO: the league to confirm the Azure region, and whether the hosting or email providers store any of this data outside the UK or EEA.]
We do not sell personal data, and we do not share it for advertising. There are no analytics, advertising or social-media trackers on this site, and no third-party cookies. The only cookies we set are the one that keeps you signed in (it expires eight hours after your last visit) and the one that protects forms against cross-site request forgery. Both are necessary for the site to work.
Why we hold it, and for how long
[TODO: the league to state the lawful basis it relies on for running the league, for sharing results with SquashLevels, and for the newsletter.]
[TODO: the league to state how long it keeps results and ratings, player contact details, dormant accounts, messages and notifications, imported captain details, and the feed request log.]
We would rather leave these blank than guess at them. Historic results are kept indefinitely today, because the league's records and rankings depend on them. Our operational records — the change trail, the queue of notification emails and the log of results-feed requests — are also kept indefinitely at present: the site can delete them on a stated schedule, but no schedule has been set, and nothing is deleted until one is. This paragraph will say what those periods are once the league has decided them.
Your rights
Seeing what we hold
Sign in and open My data. It lists everything above that applies to you and gives you the whole record as a JSON file you can download and keep. That page is the same data the league sees, other than your password hash, which nobody can read.
Correcting it
Email , or tell your team captain. Names, clubs and teams are straightforward to fix. A wrong score has to be corrected by the league so the standings and ratings can be rebuilt from it consistently.
Email you do not want
Signed-in members can switch off email for each type of notification at notification settings; on-site notifications still appear in your inbox on the site. The newsletter has no automatic unsubscribe link yet — email us and we will take you off the list.
Erasure
We do not offer a self-service delete, and we want to be straight about why. Every rubber you played is also the record of your opponent, of both teams' match points, and of the ratings and standings that followed from it. Deleting a player mid-season would rewrite other people's matches and other people's league positions.
So: email and say what you want removed. Contact details, your login and the newsletter list are the straightforward part. For results, the league will tell you what it can do and explain what it cannot, and why. Requests are handled by a person, not by a button on this site. [TODO: the league to name who handles these requests and the time it commits to answering them.]
Under-18s
[TODO: the league to confirm whether players under 18 are registered on this site, and what consent and publication rules apply to them.]
Complaints
If you are unhappy with how we have handled your data, tell us first so we can put it right. If you are in the UK you can also complain to the Information Commissioner's Office at ico.org.uk.
Contact
Email or use the contact form.
[TODO: the league to add a postal address and the date this notice was last reviewed.]