Effective Date: | Last updated:
Who this covers, and who it does not
This policy is about the personal data Sovereign Sports L.L.C. handles as a result of you visiting this website or sending us an enquiry. We are the controller of that data. You can reach us through the contact form, or by post to our registered office, which is listed on the about page and in the legal notice.
It does not cover data we process for a team under a contract. When we hold athlete, performance or operational data on a client's behalf, that client is the controller and we act on their instructions under the terms of that agreement. Our whole argument is that a team should own its own data, and this policy is not the document that governs it.
What we collect
Four things, and nothing else.
What you send us
If you use the contact form: your name, your email address, your message, and optionally a phone number and an organization. We ask for what we need to reply and understand who is asking. The optional fields are genuinely optional.
Server logs
Our servers record requests, including your IP address, the page requested, the time, and your browser's user agent string. This happens whether or not you accept analytics, because it is how a web server works rather than a choice we layer on top.
We use it for two things: keeping the site available and diagnosing faults, and stopping abuse of the contact form. The form allows five submissions per address in five minutes, and the address is how it counts. That is a security measure, not a way of profiling anyone.
Analytics, only if you accept
Nothing analytics-related is collected until you accept the banner. If you do, Google Analytics records page views and approximate location derived from your IP address. See the cookies policy for exactly what is set.
Venue survey information
If your venue asks us to run a radio signal survey, we collect what we need to plan and carry it out safely and legally. That is the names, job titles, reporting lines and work contact details of the venue staff involved, and the answers your colleagues give to the survey questionnaire. Those answers are commercially sensitive to the venue, and only people the venue's own staff have been assigned to can see them.
We collect this from your venue rather than from you, so you may be in it without having given it to us yourself. It is work contact information, used for the survey and for the services a survey may lead to, and for nothing else. We do not use it for marketing.
Why we are allowed to
| Data | Why | Basis |
|---|---|---|
| Contact form submission | To read your enquiry and reply to it | Your request, and our legitimate interest in answering it |
| Server logs | Availability, fault diagnosis, abuse prevention | Our legitimate interest in a site that works and is not abused |
| Analytics | To see which pages are read | Your consent, which you can withdraw at any time |
| Venue survey information | To run a radio signal survey at your venue safely and legally, and to provide the services it may lead to | Our legitimate interest, and your venue's, in providing the service they asked for |
Who else sees it
We use Google Cloud to host this site, run the contact form and hold the venue survey, in a database that is not reachable from the internet, Google Workspace to receive the mail it sends, and Google Analytics if you have accepted it. Google processes that data on our behalf as our supplier. Both companies are in the United States, and so is the infrastructure, so your data is handled there.
We do not sell your data. We do not share it with advertisers or data brokers. We do not add you to a marketing list because you asked us a question, and we do not use an enquiry to build a profile of you.
How long we keep it
| Data | Kept for |
|---|---|
| Your enquiry | While we are talking to you, and deleted afterwards. If it becomes a contract, it is kept under that contract instead |
| Request logs | About 30 days |
| Administrative and audit logs | Up to 400 days, as our platform retains them |
| Venue survey information | One year, or one year past the end of any contract with that venue to provide a service, whichever is later. A job deletes it, rather than a diary note |
| Analytics | Per Google's retention for the property, if you accepted |
Your rights
Depending on where you live you may have the right to ask for a copy of the personal data we hold about you, to have it corrected, to have it deleted, to object to our using it, to receive it in a portable form, and to withdraw consent you have given.
Ask through the contact form. There is no charge and you do not need to explain why. Withdrawing analytics consent needs no request at all: use the analytics preferences control in the footer of any page.
How long we take
We will respond within 45 days of receiving your request. If it is genuinely complicated we may take one further period of up to 45 days, and if we do we will tell you inside the first 45 days, along with why. That is the outside limit rather than the target; most requests here are answerable in days, because there is not much data to search.
Checking that it is you
Before we hand over or delete anything we need to be reasonably sure the request comes from you. Handing your data to somebody who claims to be you would be a worse failure than being slow about it.
Usually that means replying from the address the data is attached to, or telling us something that matches what we already hold, such as roughly when you contacted us and what about. We ask for the least we can: we will not require an identity document, and we will not use anything you send for verification for any other purpose.
If we cannot verify a request we will tell you so and explain what would help, rather than refusing without a reason. You may also use an authorised agent, in which case we need reasonable proof that you authorised them.
If we say no, you can appeal
If we decline a request, in whole or in part, we will tell you why and we will tell you how to appeal. You have 45 days from our decision to appeal it, through the contact form, marking it clearly as an appeal. An appeal is looked at by someone who did not make the original decision where we have the people to do that.
We will respond to an appeal within 45 days, in writing, explaining the reasons for our decision. If we still decline, you may complain to your state attorney general or the equivalent data protection authority where you live, and we will give you a means of contacting them.
Asking costs you nothing
We will not treat you differently for exercising any of these rights. No worse service, no different price, no penalty, and no effect on a live enquiry or an existing contract. If you are a client, asking a question about your personal data has no bearing on the work we do for you.
Practical limits
Worth stating rather than leaving you to discover. We can only find what we can identify, so an enquiry sent from an address you no longer control is hard for us to tie to you. Server logs are keyed on IP address rather than identity, so we generally cannot pick out one visitor's records from them without more information than we would want to hold. Where we cannot act for a reason like that, we will say so plainly instead of leaving the request unanswered.
Security
The site is served only over HTTPS. The contact form validates and rate limits submissions, strips anything that could be used to inject mail headers, and screens automated submissions. Credentials are held in a secrets manager rather than in code or configuration, and the infrastructure is described openly in how this site is built.
No system is beyond compromise. If something happens that affects your data and we are required to tell you, we will, and we would rather tell you than not.
Children
This site is aimed at people running sports organizations and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has sent us something, tell us and we will delete it.
Changes
We may update this policy as the site or the business changes. The version published here is the one that applies, and the date at the top says when it last changed.