Privacy Policy
1. Who we are
RiskSQOR Ltd ("RiskSQOR", "we", "us") is the data controller for personal data collected through this website and in delivering our clinical risk assessment services. We are registered in England and Wales (Company No. 17197702), registered office 14/2e Docklands Business Centre, 10–16 Tiller Road, London, E14 8PX, and registered with the Information Commissioner's Office (ICO registration number: [ICO NUMBER]). Contact for anything in this policy: adam@risksqor.com.
2. Personal data we collect
- Enquiries and callbacks: name, role, club, email address, phone number and anything you include in the callback form or emails to us.
- Bookings and payments: billing name, club, email and payment confirmation. Card details are collected and processed by Stripe; we never see or store full card numbers.
- Assessment evidence: documents your club submits for assessment (for example staffing plans, credentials, qualifications and training records of club medical staff, emergency action plans, governance records) and notes made during the match-day observation. Some of this contains personal data about your club's staff and volunteers. Your club is responsible for ensuring it may lawfully share this with us; we use it only to conduct the assessment.
- Research data: anonymised assessment results (scores, domain results, club level, sport, region). These are used for research only where your club has signed the separate Research Participation Consent Form, and only in aggregate. No club or individual is identifiable in any research output.
- Website data: basic technical data needed to serve the site. See Cookies below.
3. Why we use it and our lawful bases
- To respond to enquiries and arrange callbacks, our legitimate interest in responding to people who contact us.
- To deliver assessments, reports and annual rescores, and to take payment, performance of a contract with your club.
- To keep accounting and tax records, legal obligation.
- To use anonymised assessment data in research, consent, given via the Research Participation Consent Form and withdrawable at any time before publication.
- To send occasional updates about RiskSQOR or the ISMG standard, legitimate interest for existing clients and enquirers; you can opt out at any time by replying or emailing us.
4. Who we share it with
We use a small number of service providers to run RiskSQOR, acting as processors on our behalf: Stripe (payments), Jotform (callback and intake forms), Google Workspace (email, document storage and the shared evidence folder for your assessment), and our accounting software provider. We may also share data where required by law or with professional advisers under confidentiality. We do not sell personal data and we do not share your assessment evidence or your score with any third party without your club's written consent.
5. International transfers
Some providers listed above store data outside the UK. Where they do, transfers are protected by UK adequacy regulations or the providers' UK International Data Transfer Addendum / standard contractual clauses.
6. How long we keep it
- Enquiries that do not become clients: up to 12 months, then deleted.
- Client contracts, reports and payment records: 6 years after the end of the engagement, to meet legal, tax and insurance obligations.
- Assessment evidence submitted by your club: for the duration of the engagement plus 12 months, then deleted, unless your club asks us to hold it for the next annual rescore.
- Anonymised research data: indefinitely; it no longer identifies anyone.
7. Your rights
Under UK GDPR you can ask us for access to your personal data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interests. Where processing is based on consent you can withdraw it at any time. Email adam@risksqor.com and we will respond within one month. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
8. Cookies
This site sets no advertising or analytics cookies of its own. Embedded services on the site, the Jotform callback form and the Stripe checkout, may set cookies strictly necessary for those services to function (for example fraud prevention and form session cookies). By using those forms you accept those essential cookies. If we add analytics in future, this policy and the site will be updated first.
9. Children
Our services and website are directed at sports clubs and their officers, not at children. We do not knowingly collect personal data from anyone under 18. Assessment evidence should not include player medical records or identifiable data about minors; our evidence checklist tells clubs what to exclude.
10. Changes
We will post any changes to this policy on this page with a new effective date. Material changes will be notified to current clients by email.