Legal
Privacy policy
Last updated: 31 October 2026
1. Who is who
Whistlenote is software for coaches and sports academies (“academies”). When an academy records information about its athletes and their parents or guardians in Whistlenote, the academy is the data controller and Whistlenote is its data processor. The academy decides what is collected and why. Whistlenote stores and handles it on the academy’s instructions.
For the personal data of academy staff who sign up to Whistlenote (name, email, billing details) and for visitors to this website, Whistlenote is the controller.
2. What data we process
- Athletes (often children): name, date of birth or age group, sport and level, attendance, package balances, session notes, skill scores and progress reports.
- Parents and guardians: name, phone number, email, payment status for their child’s lessons, sign-in codes.
- Academy staff: name, email, role, login activity.
- Website visitors: basic technical data such as IP address and browser type in server logs. We do not use advertising cookies or third-party trackers on this site.
We do not collect special-category data (such as health data) unless an academy chooses to put it in free-text notes. Academies should avoid doing so.
3. Children and parental consent
Most athletes are under 18. Academies must have the consent of a parent or guardian before adding a child to Whistlenote. Whistlenote provides a consent record on each athlete so the academy can show when and by whom consent was given. Parents can ask the academy to see, correct, export or delete their child’s data at any time, and the academy can do this in Whistlenote. Whistlenote does not allow children to create their own accounts, and we never use children’s data for advertising or profiling.
4. Why we process data (legal bases)
- Academies (as controllers) usually rely on contract (providing lessons) and the consent of parents or guardians for progress reports and messages.
- Whistlenote (as controller of account data) relies on contract (running your account), legitimate interests (security, product improvement) and legal obligation (tax records).
5. Where data is stored and who sees it
Access inside Whistlenote is limited to staff who need it for support or security, and data is sent over encrypted connections. Each academy’s data is kept separate from every other academy’s.
We use a small number of sub-processors for hosting, email and message delivery (for example WhatsApp or SMS for sign-in codes). A current list is available on request. We do not sell personal data.
6. How long we keep data
We keep data for as long as the academy has an active account. If an account is cancelled, we keep the data for 30 days so it can be restored or exported, then delete it. Billing records are kept for as long as tax law requires.
7. Your rights
Under UK and EU GDPR you have the right to access, correct, delete, restrict, object to and port your personal data, and to withdraw consent at any time. If your data is held by an academy, please contact the academy first. They are the controller and can act on your request directly. We will help them respond promptly. You can also complain to your data protection authority, such as the UK Information Commissioner’s Office (ico.org.uk).
8. International transfers
We aim to keep data inside the UK and EU. If a sub-processor ever transfers data elsewhere, we require an appropriate safeguard such as standard contractual clauses.
9. Security
We use encrypted connections and role-based access controls. No system is perfect. If we become aware of a breach affecting personal data we will tell affected academies without undue delay and help them meet their own notification duties.
10. Changes
If we change this policy in a meaningful way we will tell account owners by email before the change takes effect.
11. Contact
Questions or requests: [email protected]. [Registered company name, address and registration number to be added before launch.]