MacronGeminiGalaxy DigitalIRENLedger

Privacy Policy.

Last updated: 1st August 2026 test

Real Bedford FC ("we", "us", "our") is committed to protecting your personal data. This policy explains what we collect, why, who we share it with, how long we keep it, and your rights. It covers our website (realbedford.com) and our mobile app (the Real Bedford app).

  • Data controller: Real Bedford Football Club Ltd", 13774571, 5 Goldington Road, Bedford, MK40 3JY.
  • ICO registration reference: 00011834182
  • Contact: hello@realbedford.com

---

What we collect on the website.

When you use realbedford.com, we and our providers may collect:

  • Account data - if you create a supporter account on the website, your email address, name, and a password you choose. Your password is stored securely (hashed) by our authentication provider and is never visible to us. Lawful basis: contract. (Note: the mobile app uses passwordless sign‑in - a one‑time code emailed to you - see the app section below.)
  • Purchases (tickets & merchandise) - when you buy, we collect your name, email, billing and delivery address, phone number, and order details. Card payments are processed by Stripe; Bitcoin payments by OpenNode. We do not see or store your full card details. Lawful basis: contract.
  • Contact & enquiry forms - if you get in touch, the details you submit (such as name, email and your message), so we can respond. Lawful basis: legitimate interests (responding to you).
  • Newsletter & marketing - if you opt in, your email address and marketing preferences. Lawful basis: consent. You can unsubscribe at any time.
  • Analytics - if you accept analytics cookies, Google Analytics 4 collects browser/device information, approximate location (from your IP, which Google truncates), and how you use the site. This does not run unless you accept it. Lawful basis: consent.
  • Error monitoring - Sentry collects technical error information so we can detect and fix faults. If you accept the relevant cookies, Sentry Session Replay also records a reconstruction of your on‑site activity to help us debug problems; this does not run unless you accept it, and personal data on screen is masked. Lawful basis: legitimate interests (site security & reliability) for error logs; consent for Session Replay.
  • Embedded content - some pages embed video (YouTube or Vimeo). When you choose to load an embedded video, the provider may set its own cookies. Lawful basis: consent.
  • Gated video - match replays and members' video are delivered through Bunny Stream to signed‑in supporters via short‑lived signed links. Lawful basis: contract / legitimate interests.

Fonts are served from our own servers, so using the site does not, by itself, share your data with a font provider.

---

The Real Bedford app.

This section explains what the Real Bedford mobile app ("the app") collects and why:

  • Email address - to create and sign you in to your membership account (passwordless: a one‑time code is emailed to you). Lawful basis: contract.
  • Name - to personalise your membership and matchday experience. Lawful basis: contract.
  • Date of birth (optional) - only if you choose to add it, used for birthday rewards and to apply age‑appropriate settings. Lawful basis: consent.
  • Profile photo (optional) - only if you add one. Lawful basis: consent.
  • Push‑notification token - a device identifier used to send match, ticket and points notifications, if you opt in. Lawful basis: consent.
  • Loyalty & purchase data - points you earn and the tickets/purchases linked to your account for the rewards scheme. Lawful basis: contract and legitimate interests.

We do not use your data for advertising or cross‑app tracking, and we do not sell it.

---

Payments.

Tickets and merchandise are for real‑world goods and services. Card payments are processed by Stripe; Bitcoin payments by OpenNode. Card and payment details are handled by these providers and are not stored by the club.

---

Who processes data for us.

We use trusted providers who process data on our behalf:

  • Vercel - website and application hosting.
  • Supabase - secure database and account/authentication hosting.
  • Stripe - card payment processing (tickets & merchandise).
  • OpenNode - Bitcoin payment processing.
  • Mailchimp - club emails and newsletters, if you opt in.
  • Resend - transactional and notification emails (e.g. form and order notifications).
  • GoDaddy - domain hosting for realbedford.com.
  • Bunny Stream - hosting and delivery of members' and matchday video.
  • Sentry - error monitoring and (with consent) session replay.
  • Google Analytics - website analytics, with consent.
  • Apple & Google - delivery of app push notifications.

---

International transfers.

Some providers may store or process data outside the United Kingdom. Where they do, we rely on appropriate safeguards (such as UK adequacy regulations or standard contractual clauses / the UK Addendum) to protect your data.

---

Children.

Real Bedford runs boys', girls', and academy football, so we recognise that some users are children, and we follow the UK's Age Appropriate Design Code (the Children's Code).

  • Our marketing communications are aimed at users aged 16 and over. We do not knowingly send marketing to children under 16 without appropriate parental consent.
  • Where a child registers or takes part in club activities (including youth teams and the academy), we expect a parent or guardian to be involved, and we collect the minimum personal data necessary for that activity.
  • We do not profile children or use their data for behavioural advertising.
  • Safeguarding records for youth participants are handled by the club's welfare team under our safeguarding procedures and are kept separate from marketing data.

---

How long we keep your data.

  • Account data - for as long as your account is active. You can delete your account at any time in the app's settings (or by emailing hello@realbedford.com), and we will erase your personal data except where the law requires us to keep certain records.
  • Order & payment records - retained as required for accounting and tax law (typically 6 years).
  • Marketing consent - until you withdraw it.
  • Analytics data - retained per our Google Analytics configuration.
  • Error / replay data - retained by Sentry for a limited period, typically 30–90 days.

---

Your rights.

Under UK data protection law you have the right to access, correct, delete, or restrict the use of your personal data, to object to processing, to data portability, and to withdraw consent at any time - in the app's settings, via the site's cookie preferences, or by emailing hello@realbedford.com. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk).

---

Changes to this policy.

We may update this policy from time to time. The date at the top shows when it was last revised.

---

Contact.

Questions about this policy or your data: hello@realbedford.com, or write to Real Bedford Football Club Ltd, 5 Goldington Road, Bedford, MK40 3JY.

---