1. Who this policy covers
This policy covers the BoxMidfield public web app and account/subscription features. You can browse much of BoxMidfield as a guest. If you create an account or subscribe to Pro, additional account and billing-status information is processed.
2. Information we may process
- Account information such as email address, Firebase user ID and authentication status.
- Entitlement and subscription information such as plan, status, renewal/cancellation state, expiry date, Stripe customer/subscription identifiers and transaction references.
- Support information you choose to send when asking for help or reporting a problem.
- Technical and security information processed by hosting, authentication and payment providers, such as IP address, device/browser information, request logs and fraud/security signals.
- Local app information stored on your device, including My Picks and cached PWA files.
3. Why we use information and our lawful bases
Used where necessary to perform the contract with you or take steps you request before entering it.
Used to perform the contract and, where applicable, meet legal/accounting obligations.
Used for our legitimate interests in protecting BoxMidfield, users and systems, balanced against your rights.
Used to perform the service, respond to your request and pursue our legitimate interest in maintaining an accurate, reliable service.
Used where processing is necessary to comply with a legal obligation.
If introduced and consent is required, they will not be enabled until an appropriate consent mechanism and updated notice are in place.
4. Who information is shared with
BoxMidfield uses service providers including Firebase/Google for hosting, database and authentication functions and Stripe for hosted payment and subscription processing. Providers process information according to their own service terms and data-protection obligations. Information may also be disclosed where required by law, to protect legal rights, or in connection with a legitimate business transfer subject to appropriate safeguards.
5. International transfers
Some service providers may process information outside the UK. Where UK personal data is transferred internationally, BoxMidfield will rely on a lawful transfer mechanism required by UK data-protection law, such as UK adequacy regulations or appropriate contractual safeguards made available by the relevant provider.
6. How long information is kept
Information is kept only for as long as needed for the purpose for which it was collected, including providing an account, administering a subscription, handling disputes, maintaining security and meeting legal, tax or accounting obligations. Retention can therefore vary by record type. Local My Picks remain on your device until you remove them or clear site data. Historical football results are not personal account profiles and may be retained to maintain a transparent performance record.
7. Your UK data-protection rights
Depending on the circumstances, you may have rights to access your personal data, correct inaccurate data, request erasure, restrict processing, object to certain processing, receive eligible data in a portable format and withdraw consent where processing relies on consent. These rights are subject to legal conditions and exemptions.
8. Cookies, local storage and offline caching
BoxMidfield currently uses essential browser storage and caching for authentication, locally saved My Picks, app state and PWA/offline operation. The current public build does not include behavioural advertising cookies or Google Analytics. See Cookies & Storage.
9. Security
BoxMidfield uses access controls and third-party infrastructure designed to protect account and service data. No online system can be guaranteed completely secure, so users should use a strong unique password and should never send passwords or full payment-card details to BoxMidfield support.
10. Under-18s
BoxMidfield is intended for users aged 18 and over and is not designed for children. If you believe a person under 18 has provided personal information through a BoxMidfield account, contact support so the situation can be reviewed.
11. Complaints
If you have a privacy concern, contact BoxMidfield first through Contact & Support. You also have the right to complain to the UK Information Commissioner's Office (ICO). Information about making a complaint is available at ico.org.uk/make-a-complaint.
12. Changes to this policy
If BoxMidfield materially changes how personal information is used, this policy will be updated and additional notice will be provided where required.
Controller and operator details
Brand: BoxMIDFIELD
Data controller/legal operator: Frank Broodie, trading as BoxMIDFIELD
Service/contact address:
Suite 817
80A Ruskin Ave
Welling
DA16 3QQ
United Kingdom
Privacy contact: support@boxmidfield.co.uk.