Data Rights

Your Rights Under UK GDPR

As a user of YesGaffa, you have the following rights regarding your personal data. Where possible, you can exercise these directly from your account settings.

Right of Access (Article 15)

You can request a copy of all personal data we hold about you. Use the “Export My Data” feature in Settings → Account to download a complete archive as a ZIP file containing JSON data for every table.

Right to Rectification (Article 16)

You can correct inaccurate personal data directly in your profile settings or by contacting your club administrator. If you cannot make the correction yourself, contact us and we will update it within 30 days.

Right to Erasure (Article 17)

You can delete your account from Settings → Account → Delete Account. Account deletion has a 14-day cooling-off period during which you can cancel. After 14 days, your authentication credentials and personal profile are permanently deleted. Financial records are anonymised (not deleted) as required by UK tax law for 7 years.

Right to Data Portability (Article 20)

You can export your data in machine-readable format (JSON) via the full data export feature. The export includes: profile, transactions, match events, members, sponsors, fan app data, and audit logs. Exports are available for download for 7 days.

Right to Restrict Processing (Article 18)

You can request that we limit how we process your data while a dispute is being resolved. Contact dpo@yesgaffa.com to make this request.

Right to Object (Article 21)

You can opt out of non-essential communications via Settings → Notifications. You can also withdraw consent for analytics and marketing from Settings → Privacy. Billing-related emails cannot be opted out of while you have an active subscription.

How to Submit a Request

1. Self-service (fastest): Use your account settings to export data, delete your account, or manage notification preferences.
2. Club administrator: Contact your club admin for corrections or access to club-level data.
3. Email: Send a request to dpo@yesgaffa.com with subject “Data Rights Request”, your name, club name, and the right you wish to exercise.

Response Timeline

We respond to all data rights requests within 30 calendar days, subject to identity verification. Complex requests may be extended by a further 60 days — we will notify you if this applies.

Complaints

If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).