Privacy Policy

Version: 2026-08-06

This policy explains how AthlyraX handles personal information for its website, coach accounts and software service.

1. Who is responsible for the information?

AthlyraX is the controller for public website enquiries, coach and administrator accounts, billing, support, service-security records and records showing acceptance of AthlyraX legal documents.

For swimmer information uploaded and managed by a Club, the Club normally decides why and how the information is used and is therefore the controller. AthlyraX processes that information for the Club under the Data Processing Agreement.

2. Information we handle

Coach and administrator accounts: username, full name, email, phone, Club and team name, city, country, role, authentication information, account status and billing information.

Legal acceptance records: the account and Club accepting the documents, acceptance date and time, document versions, tenant or team identifier, IP address and browser or user-agent information.

Service and security information: login events, audit records, device and browser information, technical logs, support messages and information needed to prevent misuse or investigate faults.

Club swimmer information: information selected and entered by the Club, which may include name, full date of birth, gender, squad, attendance, training, tests, competition results, performance information and coach observations.

3. Children’s information

The current coach platform is used by authorised adults. Children do not create coach accounts and there is no coach-child messaging function in the current service. Clubs may use AthlyraX to manage child swimmer information and must have an appropriate lawful basis, provide suitable privacy information and limit access to authorised personnel.

A Club should collect a full date of birth only where the exact date is necessary, for example for age-group eligibility, accurate identification or competition administration.

4. Why we use information and our lawful bases

We use account and service information to provide and administer the service, authenticate users, maintain team separation, deliver support, communicate service information, manage billing, protect the platform, keep evidence of contractual acceptance and comply with legal obligations.

Depending on the activity, our lawful basis is performance of a contract, legitimate interests in operating and securing the service, compliance with a legal obligation, or consent where a genuinely optional activity requires it.

The Club, rather than AthlyraX, selects and documents the lawful basis for its swimmer-management purposes. Further practical wording is available in the Club Data Protection Guidance.

5. Who receives information?

Information is available to authorised Club users within the applicable team account and to authorised AthlyraX personnel where access is necessary for security, maintenance or support. We may use service providers for application hosting and persistent storage, frontend delivery, transactional email, payment processing and essential technical support.

We do not sell swimmer personal information or use children’s dates of birth for advertising.

6. International transfers

Where a service provider processes information outside the United Kingdom, AthlyraX uses an applicable transfer mechanism and safeguards required by UK data-protection law.

7. Retention

Account and legal-acceptance records are retained for the life of the account and for an appropriate period afterwards where needed to establish the agreement, resolve disputes, meet legal obligations or protect the service.

Club swimmer information is retained according to the Club’s instructions and retention policy. When a Club ends the service, information is returned or deleted in accordance with the Data Processing Agreement. Protected backup copies may remain beyond ordinary use until the applicable backup-destruction cycle completes.

Security and audit records are retained only for periods proportionate to account security, incident investigation and legal requirements.

8. Security

AthlyraX uses authenticated access, role controls, separate tenant storage, restricted administration, secure session controls, audit logging, rate limiting and controlled backup and recovery processes. No online service can eliminate every risk, and authorised Club users must protect credentials and remove access that is no longer needed.

9. Your rights

Depending on the circumstances, you may have rights of access, correction, deletion, restriction, objection and data portability. Where the request concerns information controlled by a Club, contact that Club first. AthlyraX will assist the Club as required by the Data Processing Agreement.

You may complain to the Information Commissioner’s Office if you believe personal information has been handled unlawfully.

10. Contact

Email: athlyrax@outlook.com

Use the subject “Data Request” for privacy or individual-rights enquiries.

11. Changes

We may update this policy to reflect changes in law, service functions, security practices or providers. The version date identifies the policy currently in effect.