Privacy Policy

BPT Academy Limited · Company No. 16487239 · Last updated: 11 April 2026

1. Who We Are

BPT Academy Limited ("BPT Academy", "we", "us", "our") is a private limited company registered in England and Wales (Company No. 16487239). Registered office: 12 Lakeside Rise, Manchester, England, M9 8QD. For all data protection enquiries: office@bptacademy.uk

2. Our Commitment

We are committed to protecting your privacy. This Policy explains what personal data we collect, why we collect it, and your rights under UK data protection law, including the UK GDPR and the Data Protection Act 2018. By using our Platform you confirm that you have read and understood this policy.

3. What Personal Data We Collect

Account & Identity: Full name, date of birth, email address, phone number, profile photo, city of residence, and user role. Junior / Child Accounts: Where a parent registers on behalf of a child, we collect the child's name and date of birth only. All child accounts are created and managed by a parent or guardian. Sporting & Performance: Padel skill level, division, previous experience, attendance, training progress, coaching notes, and rankings. Payment Records: Payment amounts, dates, and programme. We do not store card details or bank account information. Communications: In-app messages, announcements, and notifications. Media: Training videos (hosted via Mux) and profile photographs. Technical Data: Device type, OS, app usage logs, and push notification tokens.

4. Why We Process Your Data

We process your data to: • Create and manage your account (contract) • Deliver coaching programmes and track progress (contract) • Process payments and maintain financial records (contract / legal obligation) • Send service notifications (contract / legitimate interests) • Safeguard children and verify parental consent (legal obligation) • Improve the Platform (legitimate interests) • Comply with legal obligations

5. How Long We Keep Your Data

Account & identity data: duration of account + 2 years Payment records: 7 years (UK tax law) Performance data: duration of account + 1 year Messages: 2 years from date Child account data: until age 18, or 1 year after closure Technical data: 12 months rolling After the applicable period, data is securely deleted or anonymised.

6. Who Has Access to Your Data

Access is strictly limited to: • Super Administrators — authorised BPT Academy personnel for operational and safeguarding purposes • Coaches — only data for students enrolled in their programmes • Parents / Guardians — only their linked child's profile and progress We do not sell your personal data to any third party.

7. Third-Party Service Providers

We use trusted technology providers to operate the Platform: • Supabase — database & authentication (EU) • Stripe Payments UK Ltd — payment processing (UK/EU) • Mux, Inc. — video hosting (USA, SCCs apply) • Resend — transactional email (USA, SCCs apply) • Expo Inc. — mobile app & push notifications (USA, SCCs apply) All providers operate under binding data processing agreements.

8. Data Security

We implement appropriate technical and organisational measures including: • Encryption in transit (TLS/HTTPS) • Encrypted data storage • Role-based access controls • Row-level database security • Regular security reviews If you suspect unauthorised access to your account, contact office@bptacademy.uk immediately.

9. Children's Privacy

Children under 18 may only use the Platform through an account created and managed by a parent or guardian. We collect minimal data about children — only name and date of birth. Parents have the right to access, correct, and request deletion of their child's data at any time. We do not knowingly collect personal data directly from children under 13.

10. Your Rights Under UK GDPR

You have the right to: • Access — request a copy of your personal data • Rectification — correct inaccurate or incomplete data • Erasure — request deletion in certain circumstances • Restrict processing — limit how we use your data • Data portability — receive your data in a structured format • Object — to processing based on legitimate interests To exercise any right, contact office@bptacademy.uk. We will respond within 30 days. You may also lodge a complaint with the ICO at ico.org.uk or on 0303 123 1113.

11. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will notify you via the Platform or by email. Continued use following notification constitutes acceptance of the updated policy.

12. Contact Us

BPT Academy Limited Email: office@bptacademy.uk 12 Lakeside Rise, Manchester, England, M9 8QD Company No. 16487239