Last updated: April 2026
1. Data Controller
The data controller for personal data processed through ScoreBracket is:
We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. What Data We Collect
We collect and process the following categories of personal data:
Account Information
- Email address (required for registration).
- Name or display name (if provided).
- Password (stored in hashed form; we never store plain-text passwords).
Event Data
- Tournament and event names, configurations and settings.
- Participant names, team names and division assignments.
- Scores, brackets, fixtures and match results.
Payment Data
- Payments are processed by Stripe. We do not store your full card number on our servers. We receive and store a transaction reference, payment amount, date and the last four digits of your card for record-keeping purposes.
Technical and Analytics Data
- IP address, browser type, operating system and device information.
- Pages visited, timestamps and referring URLs.
- Basic usage analytics collected via a lightweight server-side tracking pixel (track.php), if enabled.
3. Lawful Basis for Processing
We process your personal data on the following legal grounds under the UK GDPR:
- Contract (Article 6(1)(b)): Processing necessary to provide the ScoreBracket service you have signed up for, including account management, event creation and payment processing.
- Legitimate interests (Article 6(1)(f)): Analytics and platform improvement, fraud prevention, and security monitoring. We balance our interests against your rights and freedoms.
- Consent (Article 6(1)(a)): Marketing emails and non-essential cookies, where applicable. You can withdraw consent at any time.
- Legal obligation (Article 6(1)(c)): Where we are required to retain data for tax, accounting or regulatory purposes.
4. How We Use Your Data
- To create and manage your account and events.
- To process payments and issue receipts.
- To deliver real-time scoring, bracket and fixture functionality.
- To send transactional emails (event confirmations, password resets).
- To send marketing communications (only with your consent; unsubscribe at any time).
- To monitor and improve platform performance, security and reliability.
- To respond to support requests and enquiries.
5. Data Sharing
We do not sell your personal data. We share data only with the following third-party service providers, who process data on our behalf:
| Provider | Purpose | Data Shared |
|---|
| Stripe | Payment processing | Payment details, email, transaction data |
| Brevo | Transactional and marketing email | Email address, name |
| Ably | Real-time WebSocket communication | Event channel data, connection metadata |
| Cloudflare | CDN, DDoS protection and performance | IP address, request headers |
| Google Fonts | Web font delivery | IP address (via font requests) |
Each provider processes data in accordance with their own privacy policies and applicable data protection laws. We ensure appropriate safeguards are in place for any transfers outside the UK/EU.
6. Data Storage and Retention
- Your data is stored on servers located in the United Kingdom and European Union.
- Event data (scores, brackets, fixtures, participant information) is retained for 150 days after the event concludes, then permanently deleted.
- Account data (email, profile) is retained for as long as your account remains active.
- Payment records are retained for up to 7 years as required by UK tax and accounting regulations.
- You may request earlier deletion at any time (see Your Rights below).
7. Your Rights
Under the UK GDPR, you have the following rights regarding your personal data:
- Right of access: Request a copy of the personal data we hold about you.
- Right to rectification: Request correction of inaccurate or incomplete data.
- Right to erasure: Request deletion of your personal data where there is no compelling reason for continued processing.
- Right to data portability: Request a machine-readable copy of data you have provided to us.
- Right to object: Object to processing based on legitimate interests, including direct marketing.
- Right to restrict processing: Request that we limit how we use your data in certain circumstances.
- Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, email us at info@webmatter.co.uk. We will respond within 30 days.
8. Cookies
ScoreBracket uses cookies for essential functionality and, with your consent, for analytics. For full details on the cookies we use and how to manage them, please see our Cookie Policy.
9. Children's Data
ScoreBracket is not directed at children under 13. Tournament organisers are responsible for ensuring they have appropriate consent to enter participant names for minors. We do not knowingly collect personal data from children under 13. If you believe a child's data has been submitted without appropriate consent, please contact us and we will delete it promptly.
10. Data Security
We implement appropriate technical and organisational measures to protect your data, including:
- HTTPS encryption for all data in transit.
- Hashed password storage.
- Regular security reviews and updates.
- Access controls limiting who within our organisation can access personal data.
No system is completely secure. If you discover a security vulnerability, please report it to info@webmatter.co.uk.
11. Third-Party Advertising
ScoreBracket does not display third-party advertising. We do not share your data with advertising networks or data brokers.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the Platform. The "Last updated" date at the top of this page indicates when the policy was last revised.
13. Complaints
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the UK's supervisory authority:
- Information Commissioner's Office (ICO)
- Website: ico.org.uk
- Helpline: 0303 123 1113
We encourage you to contact us first at info@webmatter.co.uk so we can try to resolve your concern directly.
14. Contact
For any questions about this Privacy Policy or your personal data: