Privacy policy
Privacy Policy
Last updated: 8 March 2026
What does this Privacy Policy cover?
Total Football Limited (referred to in this Privacy Policy as “Centre Circle”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.
We want to be transparent about how we collect and use your personal data in connection with our platform (“Platform”) and services (the “Service”). This Privacy Policy is designed to give you clear information on how we collect and process your personal data, including any data you provide when you sign up as a user or customer.
We process your personal data exclusively on the basis of applicable legislation, including the UK GDPR and the Data Protection Act 2018.
Note on our role: Centre Circle acts as a data controller in respect of personal data we collect and use for our own purposes (such as operating accounts, providing the Service and marketing). Where we process personal data on behalf of a club, league, County FA or other organisation that uses our Platform (“Customer”), we act as a data processor for that Customer. This distinction is explained further below.
Who we are and how to contact us
Total Football Limited, a company incorporated and registered in England with company number 11906184, whose registered office is at Ashbury Works, Gorton Road, Manchester, England, M12 5AD, is the controller of your personal data where we process it for our own purposes.
You can contact us with any privacy-related queries or complaints at: dataprotection@centrecircleapp.com.
Your rights relating to your personal data
Under applicable data protection law, you have the right to:
· request access to your personal data (a “data subject access request”), to receive a copy and verify that we are processing it lawfully;
· request correction of any incomplete or inaccurate personal data we hold about you;
· request erasure of your personal data where there is no good reason for us to continue processing it, subject to our legal obligations to retain certain records (including financial and accounting records);
· object to processing where we rely on legitimate interests as our legal basis, or where we process your data for direct marketing;
· request restriction of processing in certain circumstances, for example where you contest the accuracy of the data;
· request transfer of your personal data to you or a third party of your choice in a structured, machine-readable format, provided that we have processed your personal data after you initially provided your consent or in order to perform a contract; and
· withdraw consent at any time where we rely on consent to process your data. Withdrawal will not affect the lawfulness of processing before the withdrawal and, if you withdraw your consent, we may not be able to provide certain services to you.
To exercise any of these rights, please contact us at dataprotection@centrecircleapp.com. We will not charge a fee unless your request is clearly unfounded, repetitive or excessive. We aim to respond to all legitimate requests within 30 calendar days, or we will notify you if we need longer.
Children and minors
Children cannot register for or access Centre Circle independently. For any user under the age of 18, the following three-stage process applies before the child can use the Service:
1. a parent or legal guardian creates their own Centre Circle account;
2. the parent or guardian links their account to the child’s account;
3. the relevant football governing body, a County FA or affiliated club, reviews and approves the relationship between the two accounts before access is granted.
This means that by the time any personal data is collected from a child, a parent or guardian has actively participated in creating the account. This constitutes the lawful framework for processing the child’s personal data on the Platform.
Guardian control. A parent or legal guardian linked to a child’s account retains full access to that account and may at any time view, correct, update or request deletion of any personal data held about the child - including special category data such as equality data or performance and health data. This ongoing control applies for the duration of the child’s registration. Parent or guardians can access the linked account directly or contact us at dataprotection@centrecircleapp.com.
Under-13s. Where a user is under the age of 13, the parent or legal guardian linked to the account provides consent on the child’s behalf for Centre Circle to process the child’s personal data in accordance with this Privacy Policy.
Governing body safeguards. The requirement for governing body approval as part of the account linking process means that a child’s participation in the Service is subject to the safeguarding policies of the approving County FA or club, in addition to Centre Circle’s own procedures.
Our role: controller and processor
Where Centre Circle is the controller
Centre Circle acts as a data controller when it determines the purposes and means of processing your personal data. This applies to:
· creating and managing your user account;
· providing access to and operating the Service;
· payment processing for Centre Circle’s own services (such as Platform subscriptions and fees);
· sending you communications in relation to the Service and, where you have given your consent or there is another lawful basis we rely on, marketing;
· analytics, security, troubleshooting and fraud prevention.
Where Centre Circle is the processor
Where a Customer (such as a football club, league or County FA) provides personal data to Centre Circle in connection with the Customer’s own services - for example, player membership records, referee data or match administration - Centre Circle processes that data as a processor on behalf of the Customer, acting on the Customer’s documented instructions.
In those circumstances, the Customer is the data controller and is responsible for ensuring it has the appropriate legal basis to share that personal data with Centre Circle. The Customer’s own privacy notice should explain how it processes data about its members and users.
The scope and terms of Centre Circle’s processing as processor on behalf of Customers are set out in clause 9 and Schedule 3 of the SaaS Customer Agreement.
What personal data we collect
We collect and process the following categories of personal data:
Identity Data
Full name; title; date of birth; gender; FA Number (FAN); FA registration number.
Contact Data
Home address; billing address; postcode; email address; telephone numbers.
Services Data
Information generated through your use of the Service, including matches attended or assigned, quiz responses, meeting attendance, fixture management data and performance-related data. This list is non-exhaustive.
Financial Data
Bank account and payment card details, including account number, sort code, IBAN, BIC and bank address.
Bank account details (sort code and account number) may be collected in limited circumstances in connection with processing refunds where the original payment method does not support reversal (for example, certain Open Banking or account-to-account payments). In these cases, bank details are passed directly to the relevant PSP for the purpose of the refund payment and are not retained or reused by Centre Circle after the refund is processed.
Where you are registered on the Platform to receive payments (for example as a referee, match official, observer, or coach), you are a Payee. As a Payee, you provide bank account details through the Platform in connection with setting up your Payout Method. Those details are transmitted to our Custodial PSP (as defined in the Payee Terms), which holds and processes them for payment execution purposes. Centre Circle does not store your full bank account credentials. We may receive limited references from our Payment Service Providers such as the last four digits of a card or a payment method token for display and reconciliation purposes only. The Payee Terms explain in full how your payment data is handled and what rights you have in connection with payments made to you.
Transaction Data
Details of payments made to or from you, including payment references, amounts, dates, PSP references and transaction status.
Social Media Data
Profile picture, email address and name associated with your social media profile, where you choose to connect via social login.
Marketing and Communications Data
Your preferences for receiving marketing from us and your communication preferences.
Behavioural Data
Inferred or assumed information about your behaviour and interests based on your online activity, typically aggregated into audience segments.
Technical Data
IP address; login timestamps; browser type and version; time zone and city-level location (inferred from IP); browser plug-in types; operating system; and other technology data from devices used to access the Service.
Profile Data
Username; password; purchases or orders made by you; interests; preferences; feedback and survey responses.
We may also create and use aggregated or anonymised data derived from the above categories. Once genuinely anonymised, this data is not personal data under the UK GDPR and may be used for any lawful purpose, including service improvement and reporting.
Special Category Data
Your ethnicity and sexual orientation. We may also collect data relating to your political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometrics, and health.
How your personal data is collected
We collect personal data:
· directly from you, when you register for or use the Service, fill in forms, enter competitions or surveys, or contact us;
· automatically, as you use the Service, through server logs and similar technologies that collect Technical Data (as defined above);
· from third parties and public sources, including football clubs, leagues, County FAs, national associations, and organisations that operate fixtures or programmes you are associated with;
· from analytics providers, advertising networks and search information providers (“Technical Data”); and
· from PSPs and payment technology providers (“Financial and Transaction Data”).
How we use your personal data and why
In this section, the following definitions apply:
Compliance with Law: means where we need to comply with a legal or regulatory obligation.
Contractual Necessity: means where we need to perform a contract we are about to enter into or have entered into with you.
Legitimate Interests: means where it is necessary for our legitimate interests and your interests and fundamental rights do not override those interests.
We will only use your personal data for the purposes for which we collected it, or where we reasonably consider the new purpose is compatible with the original purpose. If we need to use your data for an unrelated purpose, we will update this Privacy Policy and explain the legal basis.
A. To provide the Service
Legal basis: Contractual Necessity; Legitimate Interests.
This includes: managing subscriptions and account access; passing information to other users, clubs, administrators and associations where necessary for the Service to function; providing customer support; and delivering all other Service functionality.
B. To process payments
Legal basis: Contractual Necessity; Legitimate Interests.
This includes processing payments for Centre Circle’s own services; facilitating payment collection on behalf of principals (e.g. clubs, leagues, County FAs) where Centre Circle acts as collection agent; and processing bank account details provided by Payees for the purpose of making outbound payments to them under the applicable Payee Terms. Payment data is passed to PSPs to execute transactions - Centre Circle does not store payment card data.
C. To process and record refunds
Legal basis: Contractual Necessity; Legitimate Interests; Compliance with Law.
This includes recording refund requests and outcomes, passing bank details to PSPs where required to execute a refund as a new outbound payment, and maintaining audit records of refund events.
D. To say sorry
Legal basis: Legitimate Interests.
If something goes wrong with your use of the Service, we may contact you. We have a legitimate interest in maintaining a good relationship with you.
E. Service insights and quality
Legal basis: Legitimate Interests.
We may record a small percentage of user interactions on the Service to identify issues with user journeys and improve the quality of the Service.
F. Aggregated data
Legal basis: Legitimate Interests.
We create aggregated and anonymised data derived from the use of the Service. Once genuinely anonymised in accordance with ICO guidance, this data is not personal data under the UK GDPR. We use aggregated data for:
· understanding and improving the Service;
· internal reporting and product development;
· providing participation, performance, and activity insights to football organisations such as County FAs, leagues, and national associations; and
· commercial data products and reporting services offered to authorised third parties, including football governing bodies in England, Wales, Jersey, Guernsey and the Isle of Man and authorised commercial partners approved by Centre Circle.
Where we provide aggregated data insights to third parties, we ensure that the data cannot reasonably be used to identify any individual. We do not sell personal data. Third parties receiving aggregated data products are contractually prohibited from attempting to re-identify individuals from the data provided.
G. Compliance, fraud prevention and safety
Legal basis: Compliance with Law; Legitimate Interests.
This includes enforcing our terms and conditions, protecting our rights and the rights of users, and detecting and deterring fraudulent or unlawful activity.
H. Gift Aid administration
Legal basis: Contractual Necessity; Compliance with Law.
Where you make a Gift Aid declaration through the Platform, we collect and retain your declaration, your taxpayer status confirmation, and the transaction details needed to support the relevant organisation's Gift Aid claim. This data is shared with the relevant organisation to enable them to claim Gift Aid from HMRC. We do not submit Gift Aid claims to HMRC directly. Gift Aid declarations are retained for a minimum of six years from the date of the relevant donation, in accordance with HMRC requirements.
I. Troubleshooting and security
Legal basis: Legitimate Interests.
To monitor and ensure the proper and secure operation of the Service and associated systems.
J. Marketing
Legal basis: consent (where you have subscribed); Legitimate Interests (where you are an existing user or customer and have not opted out).
We may send you information about services we think you may be interested in. You can opt out at any time - see marketing communications preferences below.
K. Equality of opportunity or treatment
Legal basis: Legitimate Interests; Substantial public interest (Article 9(2)(g) UK GDPR - see below).
We collect data about your ethnicity and sexual orientation. We may also collect data relating to your religious or philosophical beliefs, genetics, biometrics (where used for identification purposes), and health. We share data relating to ethnicity and sexual orientation with The Football Association Limited ("the FA") and Professional Game Match Officials Limited ("PGMO") who use it to identify and keep under review the existence or absence of equality of opportunity or treatment between groups of people with a view to enable such equality to be promoted or maintained. We may also share data relating to religious or philosophical beliefs, genetics, biometrics, and health with the FA and PGMO if there is a substantial public interest, such as for equality of opportunity or treatment, support for individuals with a particular disability or medical condition, preventing fraud, journalism, regulatory requirements and standards of behaviour in sport.
Substantial public interest: in collecting this data, we rely on the condition of substantial public interest in accordance with Article 9(2)(g) of the UK GDPR and Schedule 1, Part 2, paragraph 8 of the Data Protection Act 2018. Collecting this data is necessary in order to identify and keep under review the existence or absence of equality of opportunity or treatment between groups of people of different racial or ethnic origins or groups of people of different sexual orientation, with a view to enable such equality to be promoted or maintained. In respect of the talent identification processing described below, we also rely on Schedule 1, Part 2, paragraph 28 of the Data Protection Act 2018 (standards of behaviour in sport).
We may share referee performance, progression records, and relevant personal data (which may include health data) with The FA or PGMO for the purpose of identifying grassroots referees who demonstrate potential for progression into the professional game and supporting their entry into FA and PGMO development and talent pathway programmes. We rely on Article 9(2)(g) UK GDPR and Schedule 1, Part 2, paragraph 28 of the Data Protection Act 2018 (standards of behaviour in sport), on the basis that identifying and developing the highest-calibre match officials from the grassroots pipeline is necessary for the purposes of measures designed to protect the integrity of the professional game, and that this processing is carried out without consent in order not to prejudice the integrity of the talent identification process.
What if you do not provide the necessary personal data?
Where we need personal data to perform a contract with you or to comply with a legal obligation, and you do not provide it, we may not be able to open or maintain your account or provide the relevant service.
Personal data from third-party sources
In addition to personal data we collect directly from you, we may receive personal data from:
· clubs, leagues, County FAs, national associations and other organisations associated with your football activity;
· other users of the Service;
· social media platforms (where you use social login);
· analytics providers;
· advertising technology providers.
Who we share your personal data with and why
Football clubs, leagues and associations
To enable the Service’s core functions, including referee pools, fixture management, performance analysis, availability calendars, notifications and communication between clubs and referees.
County FAs and national football organisations
To interact with fixture and registration data provided by those organisations, comply with FA data-sharing obligations, and to enable County FA verification of guardian relationships.
Other users of the Service
To enable the Service’s communication and administrative functions.
Payment service providers (PSPs)
We share personal and financial data with our PSPs to process payments and refunds. Our current PSPs include:
· Stripe Payments Europe Limited
· Stripe Payments UK Ltd
· Ryft Pay Ltd
· TrueLayer Limited
· GoCardless Ltd
We may use other PSPs not listed above in the future. The current authoritative list of PSPs and their terms is set out in Schedule 4 of the SaaS Customer Agreement.
HM Revenue & Customs (HMRC)
Where users make Gift Aid declarations through the Platform, we share declaration data and relevant transaction details with HMRC to enable organisations to process Gift Aid claims. Centre Circle does not submit Gift Aid claims to HMRC directly, this data is shared with the relevant organisation for that purpose.
Hosting provider
All categories of personal data we process are stored on servers provided by our hosting provider, located within the EEA.
Analytics and advertising technology providers
To enable relevant content and improve our marketing communications.
Third parties in connection with a business transfer
If we sell, transfer or merge any part of our business or assets, the recipient may use your personal data in the same way as described in this Privacy Policy.
IT and software development partners
We may share personal data with UK-based third parties engaged to maintain, improve or secure the Service.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not permit third-party service providers to use your personal data for their own purposes.
The FA and PGMO
We may disclose special category personal data (including data relating to ethnicity, sexual orientation, religious or philosophical beliefs, political opinions, trade union membership, biometric data, health data and genetic data) to the FA and PGMO for the purpose of promoting or maintaining equality among groups of people with different racial or ethnic origins and people of different sexual orientation and for statistical purposes.
We also share referee performance records and relevant personal data (which may include health and biometric data) with the FA and PGMO for talent identification purposes. For further details of this processing and the legal basis on which it is carried out, see K. Equality of opportunity or treatment above.
How we keep your data secure
Personal data we collect is stored within the UK. Centre Circle has implemented technical and organisational measures to protect personal data against loss, unlawful processing and unauthorised access. Personal data is accessible only to those who need it to perform their role, and only on our instructions under an obligation of confidentiality.
We have procedures to deal with suspected personal data breaches and will notify you and the relevant supervisory authority where we are legally required to do so.
How long we store your personal data
We retain personal data only for as long as is reasonably necessary for the purposes for which it was collected, including any legal, regulatory, tax, accounting or audit obligations. The following principles apply:
· financial and accounting records (including transaction data, payment references and PSP records): retained for a minimum of seven years from the date of the transaction, in accordance with statutory accounting obligations;
· operational and service data (including account data, Services Data and Profile Data): retained for the duration of your relationship with Centre Circle and for a reasonable period thereafter, having regard to any applicable limitation periods for legal claims;
· football results, match records and performance data: retained indefinitely. Football results form part of the permanent historical record of the game and are retained on this basis, consistent with The FA’s own data retention practices. This processing is carried out in the public interest in accordance with Article 89 UK GDPR (which permits processing for archiving purposes in the public interest);
· payment instruction records (including PSP references and settlement records): retained indefinitely for audit purposes, in accordance with our obligations under applicable payment regulations;
· bank details provided for refund processing: not retained by Centre Circle after the refund is processed. Such data is passed to the PSP for the specific transaction only;
· Bank account details provided by Payees for payment receipt: transmitted to the Custodial PSP upon entry and not stored by Centre Circle. Limited payment method references (such as a payment method token) may be retained for audit and reconciliation purposes for the duration of the relevant transaction record.
· marketing data: retained until you opt out, after which it will be suppressed;
· special category personal data (including health, genetic, and biometric data): retained for the duration of the talent assessment process and for a period of three years following its conclusion, or the end of your active registration, whichever is later. Equality data (ethnicity, sexual orientation, political opinions, trade union membership, and religious or philosophical beliefs) is retained for the duration of your registration and for seven years thereafter.
We may retain personal data for longer than the above periods where there is a complaint, actual or threatened litigation, or a regulatory obligation to do so.
International transfers
Personal data is primarily stored within the UK. Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place in accordance with the UK GDPR, including standard contractual clauses approved by the UK Information Commissioner.
Our website: Shopify, Google Analytics and Microsoft Clarity
This section applies to visitors to our public website (centrecircleapp.com). It is separate from the Centre Circle Platform and applies whether or not you are a registered user.
Shopify
Our website is hosted and powered by Shopify Inc. Shopify processes certain technical and contact data on our behalf in connection with the operation of the website, including where you sign up for marketing communications via the website. Shopify acts as our data processor for these purposes. Shopify’s own privacy policy is available at shopify.com/legal/privacy.
Google Analytics
We use Google Analytics to understand how visitors use our website. Google Analytics collects Technical Data including your IP address, browser type, pages visited, time spent on pages, and referring URLs. This data is aggregated and used to improve our website and marketing.
Google Analytics cookies are non-essential and will only be placed with your consent via our cookie banner. You can withdraw consent or manage your preferences at any time through the cookie settings on our website. Google’s privacy policy is available at policies.google.com/privacy.
Microsoft Clarity
We use Microsoft Clarity, a behavioural analytics tool that records how visitors interact with our website through session replays and heatmaps. Clarity may capture mouse movements, clicks, scrolling behaviour, and how you interact with page elements including forms. This data helps us identify usability issues and improve the website experience.
Because Microsoft Clarity can capture interaction data from page forms, we take steps to mask sensitive input fields (such as password and payment fields) from session recordings. Microsoft Clarity cookies are non-essential and will only be placed with your consent via our cookie banner.
Microsoft’s privacy policy is available at privacy.microsoft.com/privacystatement.
Marketing sign-ups via the website
If you submit your details via the website to receive marketing communications, your name and email address will be processed by Centre Circle and by Shopify as our hosting provider. Website analytics tools (Google Analytics and Microsoft Clarity) may also record your interaction with the sign-up form, subject to your cookie preferences.
This website data processing is separate from your account on the Centre Circle Platform. You can unsubscribe from marketing at any time using the link in any marketing email or by contacting us at support@centrecircleapp.com.
Third-party links
The Service may include links to third-party websites or applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites or applications and are not responsible for their privacy statements. We encourage you to read their privacy policies when you leave our Service.
Changes to this Privacy Policy
We keep this Privacy Policy under regular review and will update it when our practices change or we are required to do so by law. Material changes will be notified to you by email or through the Service.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes.
Marketing communications preferences
You can ask us to stop sending you marketing messages at any time by following the “Unsubscribe” link on any marketing message sent to you by Centre Circle or the Service, or by contacting us at support@centrecircleapp.com.
Where you opt out of receiving marketing messages, this will not apply to service-related communications, which may include notifications about fixtures, account management, league or association operations, and updates to this Privacy Policy.
Complaints
If you wish to make a complaint about how we handle your personal data, please contact us at dataprotection@centrecircleapp.com. We will respond as soon as we can.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
· Telephone: 0303 123 1113
· Website: www.ico.org.uk/concerns