Contents
- Who we are
- Data we collect
- Why we use data and legal basis
- Children's data and parental consent
- Who can access the data
- Storage location and transfers
- Retention periods
- How we protect data
- Your rights
- Mobile app permissions
- Cookies and tracking
- Account and data deletion
- Changes to this policy
- Contact and complaints
1. Who we are
Al Madam Cultural Sports Club ("the Club", "we") is a licensed sports club in the Emirate of Sharjah, located at Al Madam, Emirate of Sharjah, United Arab Emirates. The Club is the data controller for personal data processed through its website https://almadamclub.com and its mobile application (together, "the Platform").
The Platform is the Club's internal management system, used by management, coaches, administrators, players and their parents to manage memberships, attendance, matches, rewards and finance. We do not sell or rent personal data and we do not use it for advertising.
2. Data we collect
We collect only what is needed to run club membership and activities.
| Category | Examples | Source | Required? |
|---|---|---|---|
| Identity data | Full name, date of birth, nationality, Emirates ID number, profile photo | Player or parent at registration, or club management | Yes (photo optional) |
| Contact data | Phone number, email, emirate and area | User | Yes |
| Parent/guardian data | Guardian name and phone number | Parent/guardian | Yes for players under 18 |
| Sports data | Sport, age group, position, jersey number, federation ID, attendance, match participation | Coaches and administrators | Yes |
| Limited health data | Injury status and date (no medical details) | Coaches and administrators | No |
| Financial data | Rewards due, allowances, salaries (staff), payment receipts | Finance management | Depends on role |
| Account data | Username, password (stored hashed and unreadable), role and permissions | User and management | Yes |
| Technical data and logs | IP address, device and browser type, login time, actions performed in the system | Automatically during use | Automatic |
| Notification data | Device token for push notifications (mobile app only) | Automatically when notifications are allowed | No |
3. Why we use data and legal basis
| Purpose | Legal basis |
|---|---|
| Registering membership and managing player or staff profiles | Performance of the membership or employment contract |
| Recording attendance, forming squads, organising matches | Contract performance and the Club's legitimate interest |
| Calculating and paying rewards and salaries, issuing receipts | Contract performance and legal accounting obligations |
| Communicating schedules, matches and notifications | Legitimate interest; consent for push notifications |
| Registering players with accredited sports federations | Legal obligation and sports regulations |
| Securing the system, preventing fraud, audit logging | Legitimate interest and legal obligation |
| Internal reporting and statistics | Legitimate interest (aggregated where possible) |
We do not make solely automated decisions with legal effect on individuals. Any analytics or AI tool used in future only supports a human decision and does not replace it.
4. Children's data and parental consent
Most of the Club's players are under 18. We process their data with the consent of a parent or legal guardian, given at club registration. Parents may access, correct and request deletion of their child's data at any time through the contact channels below.
- No login account is created for players under 13; the parent manages their profile.
- We show no advertising to minors and never share their data with advertisers.
- Player photos are used inside the system for identification only and are not published externally without written parental consent.
5. Who can access the data
Access is governed by role-based permissions: each user sees only what their role and team allow. We share data with external parties only in the following cases:
| Recipient | Purpose | What is shared |
|---|---|---|
| Hosting provider | Running servers and storing data | Stored data, encrypted in transit; the provider does not process it for its own purposes |
| Google Firebase | Delivering push notifications to the mobile app | Device token only, no name or personal data |
| Email delivery provider | Sending password-reset emails | Email address and message content |
| Accredited UAE sports federations | Player registration and competitions | Player data required for official registration |
| Government and judicial authorities | Compliance with a valid legal order | Only what the law requires |
All service providers are contractually bound to process data on our instructions with appropriate security measures.
6. Storage location and transfers
Data is stored on servers in the United Arab Emirates or in data centres with equivalent protection standards. Where data leaves the UAE (for example, notification tokens to Firebase), we ensure adequate safeguards in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.
7. Retention periods
| Data | Period |
|---|---|
| Active player or staff profile | For the duration of membership or employment |
| Profile after membership ends | Archived, then deleted or anonymised within 24 months of the end of membership, unless deletion is requested earlier |
| Financial records and receipts | 5 years, per UAE accounting requirements |
| Login and audit logs | 12 months |
| Notification tokens | Deleted when the app is uninstalled or notifications are disabled |
8. How we protect data
- All connections to the Platform are encrypted with HTTPS.
- Passwords are stored with a strong hashing algorithm and cannot be read by the Club.
- Role-, team- and age-group-based permissions, with automatic blocking of repeated login attempts.
- An audit log of every sensitive operation (who, what, when).
- Regular encrypted backups and a server firewall.
- Access to sensitive data (identity, finance) is restricted to authorised management.
If a data breach likely to harm individuals occurs, we notify the competent authority and affected persons without undue delay, as required by law.
9. Your rights
You, and a parent on behalf of a minor, have the following rights. We respond within 30 days at most and free of charge:
- Access: obtain a copy of your data.
- Rectification: correct inaccurate data; this can be requested directly in the Platform via "Request data update".
- Erasure: have your data deleted when it is no longer needed for its purpose, subject to legal retention duties.
- Restriction and objection to processing where the law allows.
- Portability: receive your data in a common electronic format.
- Withdraw consent at any time, such as disabling notifications, without affecting prior lawful processing.
- Complain to the competent data protection authority.
10. Mobile app permissions
| Permission | Purpose | Optional? |
|---|---|---|
| Notifications | Attendance, match and reward alerts | Yes, can be disabled in device settings |
| Camera | Taking a profile photo or scanning an attendance QR code | Yes, requested only when used |
| Photos | Choosing a profile photo | Yes, requested only when used |
| Internet | Connecting to the Club's server | Required to function |
The app does not run in the background to collect data and does not access location, contacts or files.
11. Cookies and tracking
We use a single essential session cookie (login and protection against request forgery) that expires on logout or when the session ends. We use no third-party analytics and no advertising trackers. We do not respond to "Do Not Track" signals because we do not track.
Embedded content: the public home page may show posts from the club Instagram account inside a frame served by Instagram (Meta). When that frame loads, your browser connects to Instagram directly, and Instagram may set its own cookies and see your IP address under its own privacy policy. We send it no data about you, and this content does not appear on the internal system pages.
12. Account and data deletion
You can request deletion of your account and data by:
- Emailing info@almadamclub.com from the email or phone registered with us, with the subject "Data deletion request".
- Submitting a written request to club management.
We confirm receipt within 7 days and complete deletion within 30 days. Financial records that the law requires us to keep are excluded and anonymised when their retention period ends. Uninstalling the app does not delete your account automatically.
13. Changes to this policy
We may update this policy when our services or the law change. The new version is published on this page with its update date, and users are notified in the Platform of any material change at least 14 days before it takes effect.
14. Contact and complaints
For any question, request or complaint about your data:
- Email: info@almadamclub.com
- Address: Al Madam, Emirate of Sharjah, United Arab Emirates
If you are not satisfied with our response, you may lodge a complaint with the UAE Data Office or the competent personal data protection authority.