Privacy notice
Last updated Wed 7 Oct '26
This notice explains what we do with personal information. It covers visitors to this website, staff at clubs that use ClubDock, and parents and children whose details a club holds in it.
Who we are
ClubDock is a trading name of Pigeonhole Early Years Ltd, a company registered in England and Wales (number 17014216) with its registered office at 12 Cooper Road, Bristol, BS9 3RA, United Kingdom. We are registered with the Information Commissioner's Office under reference ZC136329.
You can contact us about anything in this notice at support@clubdock.co.uk, or by post at the address above.
Who is responsible for what
This is the most important part of this notice, because ClubDock holds different kinds of information under different responsibilities.
Information a club holds about its families
When a club uses ClubDock to record children, parents, bookings and registers, the club is the data controller and we are its data processor. The club decides what to collect and why; we hold it and make it usable, on the club's instructions. Our data processing agreement sets out the terms, and forms part of our contract with every club.
If you are a parent and you want to know what a club holds about you or your child, to correct it, or to have it deleted, ask the club first — it is their record. We will help them, and if you cannot reach them you can contact us.
Information we hold about our own customers and this website
For club staff accounts, billing, support conversations and visits to this website, we are the controller. That is what the rest of this notice describes.
Tax-Free Childcare
If you are a parent and you choose to pay a club from your Tax-Free Childcare account, we are the controller of what we exchange with HMRC to do it. We are the payment provider registered with HMRC, under HMRC's data sharing agreement, and HMRC and NS&I are responsible for the account itself.
- What we send HMRC: your child's childcare reference and date of birth, and for a payment, the amount and the club's own Tax-Free Childcare details.
- What HMRC sends us: your child's name as HMRC holds it, your account balance (shown to you, not kept), and each payment's reference and expected date.
- Why, and our lawful basis: only to link your account and make the payments you confirm — performance of a contract with you.
- Who else sees it: the club you pay sees each payment's amount, status and HMRC reference, so it can match the money. Nobody else, beyond the suppliers listed below.
- How long: HMRC's permission until you disconnect, it expires after 18 months, or the club leaves ClubDock; the rest until twelve months after the club closes its account.
Our Tax-Free Childcare impact assessment sets this out in full.
What we collect, and why
| Information | Why we have it | Our lawful basis |
|---|---|---|
| Your name and email address, when you create a club or are invited to one | To give you an account and sign you in | Performance of a contract |
| Your club's name, address and settings | To run the service you have asked for | Performance of a contract |
| Billing details, held by Stripe on our behalf | To take payment of a club's monthly bill | Performance of a contract |
| What you send us through the contact form or by email | To answer you | Legitimate interests — replying to the person who wrote to us |
| Your email address, if you asked us to tell you when ClubDock opened | To email you about ClubDock and what changes in it. Nothing else, and we never pass it to anyone | Consent |
| Your email address, when you create a club | To tell you about changes to ClubDock. This is the same list as the row above, so you are on it once however you arrived | Legitimate interests — telling a customer about the service they are using. Every message carries an unsubscribe link |
| Technical logs: IP address, browser, pages requested, errors | To keep the service working and secure | Legitimate interests — running a reliable, secure service |
| Analytics about how this website is used, if you consent | To see which pages help people decide | Consent |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights. You can object at any time — see your rights below.
Payments
We never see a card number. Clubs pay us by card through Stripe, which collects and holds the card details itself; we receive only confirmation that a payment succeeded and the last four digits shown on your billing screen.
Parents do not pay ClubDock at all. They pay their club directly by bank transfer, Tax-Free Childcare, childcare vouchers, cash or cheque. That money never passes through us, and we do not hold parents' bank details.
Where a club uses ClubDock Pay, parents can also pay it by card or from their Tax-Free Childcare account when they book. A card payment is taken by Stripe on the club's own Stripe account: the card details go to Stripe and never to us, and we pass Stripe only what the payment needs — the amount, the booking and the parent's email address. For Tax-Free Childcare, a parent signs in to HMRC and allows the club's booking system to pay from their childcare account; we then send HMRC the child's childcare reference and date of birth, and keep the permission HMRC gives us, encrypted, until it expires or the parent's account is closed. For that exchange we are the controller, as described above.
Who else is involved
We use a small number of suppliers, and only where they are needed to provide the service.
| Supplier | What they do | Where |
|---|---|---|
| Microsoft Azure | Hosts the service and stores the data | United Kingdom |
| Stripe | Takes payment of clubs' monthly bills, and card payments from parents to clubs that use ClubDock Pay — on the club's own Stripe account | Ireland and the United States |
| Resend | Delivers the emails the service sends, and holds our mailing list — the people who asked to be told when ClubDock opened, and the people who have started a club | United States |
| Microsoft (Azure OpenAI) | When a club brings its families across from a spreadsheet, suggests what each column is. It sees the column headings and a few example values from each column — never the whole file — and returns only its suggestion. Nothing it is sent is used to train its models | United Kingdom |
| Google (reCAPTCHA) | Tells people apart from automated scripts on our public forms | United States |
| Google (Analytics) | Counts visits to this website and which pages are read — only if you accept analytics cookies, and never inside the ClubDock app | United States |
| Termly | Shows the cookie banner on this website and remembers your choice | United States |
Where a supplier is outside the UK, the transfer is covered by the UK's international data transfer addendum to the European Commission's standard contractual clauses, or by an adequacy decision. We do not sell personal information, we do not share it for advertising, and we do not use it to train machine learning models.
Where your data is kept
Children's and parents' records are stored on Microsoft Azure in the United Kingdom, encrypted in transit and at rest.
How long we keep it
- While your club uses ClubDock — for as long as the club keeps it. What a club deletes or archives is the club's decision.
- After a club closes its account — twelve months, so you can come back or export what you need, and then it is permanently deleted. That deletion runs automatically; it does not rely on anyone remembering.
- Billing records — six years after the end of the accounting period, which is how long HMRC requires.
- Support emails and enquiries — two years.
- Our mailing list — until you unsubscribe, using the link on every message we send. Unsubscribing is what removes you; we do not keep a second copy anywhere else.
- Technical logs — 30 days.
Keeping it safe
- Encrypted in transit and at rest.
- No passwords. Signing in uses a single-use code sent to your email address, or a passkey on your own device, so there is no password database to steal.
- One club can never see another club's families. Every request is scoped to a single club, and a parent registered with one club is a stranger to the next.
- Access to production systems is limited to those who need it, and is logged.
More detail is on our security page. If you believe you have found a security problem, please tell us at support@clubdock.co.uk.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of the personal information we hold about you;
- correct anything that is wrong;
- delete it, where we have no continuing reason to keep it;
- restrict or object to how we use it;
- provide it in a portable format;
- stop relying on consent you previously gave.
Email support@clubdock.co.uk and we will respond within one month. If your request is about information a club holds about you or your child, we will pass it to the club, because that record is theirs.
If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. We would rather you told us first, so we can put it right.
Children
ClubDock holds information about children because that is what running a club requires — who is booked in, who has arrived, who may collect them, and any allergy or medical detail staff need to keep them safe. That information is provided by their parents to their club, and the club decides what to collect. We hold it on the club's behalf and do not use it for anything else.
Accounts in ClubDock belong to adults. Children do not sign in and are not contacted by us.
Cookies
Our cookie policy lists every cookie we set and what it does.
Changes
If we change this notice we will update the date at the top, and tell clubs by email where the change is significant enough to matter.