Privacy policy

Last updated: 10 June 2026.

1. Who we are, and our two roles

Adminished is operated by Slashbit Ltd (“we”, “us”), a company registered in England & Wales, the provider of https://adminished.com. We handle personal data in two roles:

As a data controller — for account, billing, security-log and platform-usage data of the people who run a club (coaches, admins) and of visitors to our site.
As a data processor — for the data a club enters about its members and their children (student records, attendance, consents, payment requests). The club is the controller for that data and decides how it’s used; we process it on the club’s instructions to provide the service.

2. What we collect

Account data: email address, display name, hashed password.
Student / member data: names, dates of birth, sex (where provided), emergency contacts, medical and dietary notes (special-category health data), signed consent-form versions, attendance records. Sex is collected where needed to administer sex-restricted classes under the UK Equality Act 2010 sporting exemption.
Payment data: when a club takes payments, these are processed by Stripe. Stripe handles card details; we do not store full card numbers. We hold payment references, amounts, status and payout records to run reconciliation.
Operational data: session cookies, IP addresses and user-agent strings in server logs for security and troubleshooting.
Feedback: anything you submit through the report-a-bug form.

3. Why we process it, and our lawful bases

To provide the service you or your club signed up for — UK GDPR Article 6(1)(b) (contract).
To keep the platform secure and prevent abuse — Article 6(1)(f) (legitimate interests).
To meet legal duties (e.g. consent-form and safeguarding records, tax) — Article 6(1)(c) (legal obligation).
For special-category data (medical/health notes): processed on the basis of explicit consent captured by the club from the parent or member (Article 9(2)(a)), and where necessary to protect someone’s vital interests in an emergency (Article 9(2)(c)).
For optional updates (tips, announcements): consent, withdrawable at any time.

4. Children's data

Student records often belong to children. A parent or guardian registers the child, signs the consent form on their behalf, and confirms the information is accurate. The club relies on that parental consent as the lawful basis for processing the child’s data, including any special-category health information. Consent can be withdrawn at any time by contacting the club.

5. Who we share it with (sub-processors)

We do not sell your data. We share it only with the service providers we need to run Adminished, under contracts that require them to protect it:

Stripe — card and Direct Debit payment processing, identity verification of clubs, and payouts.
Resend — delivery of transactional and (where opted in) optional emails.
Our hosting provider — to store and run the service.
Your club (the coach and any team members they authorise).
Authorities, where required by law.

6. International transfers

We aim to keep data in the UK/EEA. Some sub-processors (notably Stripe) may process data outside the UK/EEA, including in the United States. Where they do, the transfer is protected by appropriate safeguards — UK International Data Transfer Agreement / Addendum or EU Standard Contractual Clauses, plus the provider’s own measures.

7. How long we keep it

Active account and student data are kept while your club is active. If a club closes its account, we delete or anonymise data within 30 days unless the law requires us to keep it longer (e.g. tax and accounting records, typically up to 6 years). Signed consent forms and their version strings are retained for the limitation period for personal-injury claims.

8. How we protect it

Access is restricted to those who need it, data travels over encrypted (TLS) connections, passwords are stored only as salted hashes (we never see them), and payment card details are held by Stripe rather than us. No system is perfectly secure, but we take reasonable technical and organisational measures appropriate to the data.

9. Data breaches

If a personal-data breach is likely to risk people’s rights, we will report it to the Information Commissioner’s Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of it, and we’ll inform affected people where the law requires.

10. Your rights

Under UK GDPR you have the right to:

Access your data and get a copy of it.
Correct inaccurate data.
Ask us to delete data we no longer need to keep.
Object to processing and restrict it.
Complain to the ICO (ico.org.uk).

To exercise these rights over member data, contact your club first (it controls that data); for account data, or if your club can’t help, write to us at [email protected].

Email preferences. Optional emails — class reminders, club announcements, and occasional tips — can be switched off at any time. Every such email carries a one-click unsubscribe link, and logged-in members can manage their choices under Settings → Notifications. Essential service emails (receipts, booking confirmations, password resets) are always delivered.

11. Cookies

We use a first-party session cookie to keep you logged in and a first-party CSRF cookie to protect forms from cross-site attacks. Both are essential and don’t require consent. We don’t load third-party analytics or advertising trackers on the parent-facing pages.

12. Changes

We’ll update this page when the service changes materially. The “last updated” date above tells you when it was last revised.