Data Rights

Your Rights Under UK GDPR

As a user of YesGaffa, you have the following rights regarding your personal data. Where possible, you can exercise these directly from your account settings.

Right of Access (Article 15)

You can request a copy of all personal data we hold about you. Self-service export is temporarily unavailable while we finish building the background worker. In the meantime, email privacy@yesgaffa.com with subject “Data Access Request (Art. 15)” and we will respond within the 30-day statutory window.

Right to Rectification (Article 16)

You can correct inaccurate personal data directly in your profile settings or by contacting your club administrator. If you cannot make the correction yourself, contact us and we will update it within 30 days.

Right to Erasure (Article 17)

You can delete your account from Settings → Account → Delete Account. Account deletion has a 14-day cooling-off period during which you can cancel. After 14 days, your authentication credentials and personal profile are permanently deleted. Financial records are anonymised (not deleted) as required by UK tax law for 7 years.

Right to Data Portability (Article 20)

You can request your data in machine-readable format (JSON) — including profile, transactions, match events, members, sponsors, fan app data, and audit logs — by emailing privacy@yesgaffa.com with subject “Data Portability Request (Art. 20)”. Self-service export is temporarily unavailable while we complete the background worker that fulfils these requests.

Right to Restrict Processing (Article 18)

You can request that we limit how we process your data while a dispute is being resolved. Contact dpo@yesgaffa.com to make this request.

Right to Object (Article 21)

You can opt out of non-essential communications via Settings → Notifications. You can also withdraw consent for analytics and marketing from Settings → Privacy. Billing-related emails cannot be opted out of while you have an active subscription.

How to Submit a Request

1. Self-service (fastest): Use your account settings to export data, delete your account, or manage notification preferences.
2. Club administrator: Contact your club admin for corrections or access to club-level data.
3. Email: Send a request to dpo@yesgaffa.com with subject “Data Rights Request”, your name, club name, and the right you wish to exercise.

Response Timeline

We respond to all data rights requests within 30 calendar days, subject to identity verification. Complex requests may be extended by a further 60 days — we will notify you if this applies.

Complaints

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).