Introduction

This Privacy Notice describes how we will collect, use, share and otherwise process your personal data in connection with:

• your use of the nettla platform, which is available either as mobile application software or on our website www.nettla.co or integrated into the platform of a provider of sports and leisure facilities and other services (an "Operator") (App);
• your use of any of our services that are accessible through the App (Services), unless such Services state that a separate or additional Privacy Notice applies to a particular Service, in which case only that Privacy Notice applies; and
• any other engagement with us, whether preparatory to entering into, or during the operation of a contract with us, or otherwise.

The App is not intended for children and we do not knowingly collect data relating to children.

Please read the following carefully to understand our practices regarding your personal data and how we will treat it.

This Privacy Notice is provided by ToppTech Limited (trading as "nettla") (nettla, we, us or our in this notice).

As a provider of services to individual users, and to Operators, we may be the controller of your personal data, or we may be the processor. If you are in any doubt as to who the controller is please contact us.

We are not the providers of any facilities or associated services ourselves, but provide a link between end users and the Operators. Therefore, when you use the App, you will be seeing information provided by an Operator, and when you place a booking or order we will transmit it to the Operator, who will process it.

We have appointed a data privacy manager. If you have any questions about this privacy notice, please contact this person using the details set out below.

Contact details

Our full details are:

• Full name of legal entity: ToppTech Limited, incorporated under the laws of England and Wales, with company number 15810475
• Email address: privacy@nettla.co
• Postal address: The Carriage House, Mill Street, Maidstone, Kent, United Kingdom, ME15 6YE

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues and, where relevant, certain other EU regulatory authorities.

Changes to the Privacy Notice and your duty to inform us of changes

We keep our Privacy Notice under regular review.

This version was last updated on 12 March 2025. It may change and, if it does, those changes will be posted on this page and notified to you when you next start the App or log onto your account. You may be required to read and acknowledge the changes to continue your use of the App or the Services.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during our relationship with you.

Third party links and sites

Our App and Services may, from time to time, contain links to and from the websites of third parties, such as including those of third party Operators. Please note that these websites (and any services accessible through them) are controlled by those third parties and are not covered by this privacy notice. You should review their own privacy notices to understand how they use your personal data before you submit any personal data to these websites or use these services.

The data we collect about you

We collect, use, store and transfer different kinds of personal data about you. To make it easier for you to use this privacy notice, we group these into the following categories. Each of these categories is described in more detail below.

Please be aware that the data we collect about you may depend upon which elements of the Nettla service you use. Basic registration requires limited data, but activities, matches, becoming a member, and other purchases may require additional data.

Further, if you are an Operator, the data we collect and the way in which we use it is different from that of an individual user.

Description of categories of personal data

• Identity Data: first name, last name, gender, date of birth and Profile Data.
• Contact Data: first name, last name, contact address, email address, geographic location (if location services are enabled) and telephone numbers, your communication preferences and copies of the communications between you and us.
• Profile Data: your email address, username and password.
• Usage Data: logs and detail of your use of our Apps and Services, being the dates and times on which you download, access and update the App and our Services, any error or debugging information, and the actions we and you take in relation to them and Cookies Data.
• Cookies Data: the information collected through the cookies and similar technologies listed in our Cookies Notice available here.
• Direct Marketing Data: your direct marketing preferences, consents for receiving direct marketing from us and/or our third parties and the history of the direct marketing communications we have sent to you.

We do not collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data).

Please note that payment and transaction information is managed and processed by third party payment process providers. Nettla does not have access to card information, even if the payments and transactions are processed through the App.

How is your personal data collected?

We collect your personal data in the following way:

• Registration. We collect your Identity Data and Contact Data when you register your account with us either as an end user, or as an authorised user for an organisation who has subscribed to our services. We may also obtain your data from an Operator or another third party organisation with whom you already have an arrangement (such as part of a client list from operator's previous provider)
• Communications. When you communicate with us via email, telephone, one of our online forms or chat we collect your Contact Data. If the communication relates to an error or problem you are having with the App or one of our Services, we will also collect usage data for diagnosis and improvement.
• Information you generate when using our App and Services. Each time you access and use our App and Services we collect Content, Device, Cookies, Personalisation and Usage Data. We collect Content Data where you upload it to the App or interact with the content available on the App. We collect Device, Cookies, Personalisation and Usage Data by firebase and using cookies and other similar technologies. Please see our cookie notice for further details.
• Information we collect through monitoring the use of our App, Sites and Services. Each time you access and use our App and Services we collect information about that access and use, being Device, Content, Cookies, and Usage Data.
• Identity and Contact Data from any Operator who has subscribed for our services and who wishes to enable your access to the App.

Cookies

We use cookies (small files placed on your device) and other tracking technologies on the App to improve your experience and our development of the App and our Services. For detailed information on the cookies we use, the purposes for which we use them and how you can exercise your choices regarding our use of your cookies, see our cookie notice.

How we use your personal data

We will only use your personal data when we have a lawful basis to do so. Our lawful basis for each purpose for which we use your personal data is specified below. Most commonly we will use your personal data in the following circumstances:

• Consent. Where you have freely consented before the processing in a specific, informed and unambiguous indication of what you want. You can withdraw your consent at any time by accessing the My Profile → Settings section of your Account, or contacting us (see Your legal rights below).
• Performance of a contract. Where we need to process your personal data to perform a contract with you or the organisation you represent, or the Operator with whom you have a contractual relationship or where you ask us to take steps before we enter into a contract with you or the organisation you represent or the Operator with whom you have a contractual relationship. Where we rely on performance of a contract and you do not provide the necessary information, we will be unable to perform your contract.
• Legitimate interests. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.
• Legal obligation. Where we need to use your personal data to comply with a legal or regulatory obligation. Where we rely on legal obligation and you do not provide the necessary information, we may be unable to fulfil a right you have or comply with our obligations to you, or we may need to take additional steps, such as informing law enforcement or a public authority or applying for a court order.

Delivery and improvement of our App and purchases

Purpose or activity: To permit you to install the App and register you as a new App user whether as an end user or as an Authorised User of an Operator
Type of personal data: Identity; Contact; Profile; Device
Lawful basis for processing: Performance of a contract OR Legitimate interests (delivering our App to you)

Purpose or activity: To take steps towards providing you with services at your request, to process and fulfil in-App orders/purchases and to deliver services to you, or the organisation you represent, including sending you service communications
Type of personal data: Identity; Contact; Profile; Device
Lawful basis for processing: Performance of a contract

Purpose or activity: To provide you with your subscription benefits and fulfil your purchase
Type of personal data: Identity; Contact; Transaction
Lawful basis for processing: Performance of a contract

Purpose or activity: Enforce our terms and conditions, including to collect money owed to us
Type of personal data: Identity; Contact; Profile
Lawful basis for processing: Legitimate interests (to recover debts due to us)

Purpose or activity: To allow you to use all of the services within the App
Type of personal data: Content
Lawful basis for processing: Performance of a contract

Account management and profiling

Purpose or activity: Combining the information we collect about you into a single user account profile
Type of personal data: Contact, Direct marketing
Lawful basis for processing: Legitimate Interests (to publicise and grow our business)

Troubleshooting, improvement and security

Purpose or activity: To administer, monitor and improve our business, Services and this App including troubleshooting, data analysis and system testing
Type of personal data: Identity; Contact; Device
Lawful basis for processing: Legitimate interests (for running our business, provision of administration and IT services, network security, maintaining the security of our App and Services, providing a secure service to users and preventing fraudulent and other misuse of our App)

Purpose or activity: Applying security measures to our processing of your personal data, including processing in connection with the App
Type of personal data: All personal data under this Privacy Notice
Lawful basis for processing: Legal obligation (applying appropriate technical and organisational measures under Article 32 of the UK GDPR and the EU GDPR)

Purpose or activity: Otherwise monitoring use of the App and deploying appropriate security measures
Type of personal data: Contact; Security; Transaction
Lawful basis for processing: Legitimate interests (running our business, provision of administration and IT services, network security, maintaining the security of our App and services, providing a secure service to users and preventing fraudulent and other misuse of our App)

Rights and obligations

Purpose or activity: To comply with our other legal obligations, including compliance with tax legislation, judicial, law enforcement and government authorities' requests
Type of personal data: All personal data under this Privacy Notice
Lawful basis for processing: Legal obligation

Purpose or activity: To deploy and process personal data collected via Cookies that are strictly necessary, as set out in the cookies notice
Type of personal data: Cookies
Lawful basis for processing: Legitimate interests (delivering and securing the App and our Services)

Purpose or activity: To deploy and process personal data collected via Cookies that are not strictly necessary, as set out in the cookies notice
Type of personal data: Cookies
Lawful basis for processing: Consent

Purpose or activity: To deliver (personalised) advertisements to you
Type of personal data: Personalisation
Lawful basis for processing: Consent

Purpose or activity: To notify you of changes to the App, Services, your purchases and our terms and conditions for ongoing contracts
Type of personal data: Contact
Lawful basis for processing: For ongoing or prospective contracts, Performance of a contract. Otherwise, Legitimate interests (in servicing our users and prospective users)

Purpose or activity: To notify you of updates to this Privacy Notice
Type of personal data: Contact; Transaction
Lawful basis for processing: Legal obligation (to inform you of our processing under Articles 13 and 14 of the UK GDPR and the EU GDPR)

Purpose or activity: To respond to your requests to exercise your rights under this Privacy Notice
Type of personal data: As relevant to your request
Lawful basis for processing: Legal obligation (complying with data subject requests under Chapter 3 of the UK GDPR and/or the EU GDPR)

Purpose or activity: To ask you to complete a survey and process your response (where applicable, please also see the separate Privacy Notice)
Type of personal data: Contact
Lawful basis for processing: Legitimate interests (to analyse how users use our products or Services and to develop them and grow our business). Unless you have previously opted out, where we will rely on Consent

Purpose or activity: To otherwise respond to your enquiries, fulfil your requests and to contact you where necessary
Type of personal data: As relevant to your enquiry or request
Lawful basis for processing: Legitimate interests (service our users and prospective users)

Personal data sharing

Purpose or activity: Share personal data with our third-party providers for purposes not otherwise set out above (see Disclosures of your personal data)
Type of personal data: See "Disclosures of your personal data" in a section below
Lawful basis for processing: Legitimate interests (for the purpose relevant to the recipient, as set out at "Disclosures of your personal data")

Purpose or activity: Receive personal data from Operators and other third parties with whom an end user has a relationship
Type of personal data: Identity; Contact; Transaction
Lawful basis for processing: Legal obligation (to provide the services under an agreement)

Purpose or activity: Transmit personal data to Operators and other third parties with whom an end user has a relationship
Type of personal data: Identity; Contact; Transaction
Lawful basis for processing: Legal obligation (to provide the services under an agreement)

Business contacts

Purpose or activity: Process personal data relating to staff members of our business contacts, including suppliers, customers, operators and prospects
Type of personal data: Contact
Lawful basis for processing: Legitimate interests (servicing and receiving products or services, to or from our business contacts and carry out our B2B business)

Automated decision making and profiling

We do not make decisions based solely on automated processing or profiling that produce legal effects concerning you (or have similarly significant effects).

Special categories of personal data

We do not process any special categories of personal data about you.

Disclosures of your personal data

We may share your personal data with the following third parties:

(a.) External third parties.

• Your App Store Provider and mobile network operator to allow you to install the App.
• Service providers acting as processors based in US, Ireland, Belgium who provide IT and system administration services, hosting services for our App payment processing, fraud and identity verification providers, customer service support, email delivery and administration, and data storage and analysis.
• If you are an Operator, we may share your contact data with users and potential users who wish to get in touch with you directly to secure goods and services.
• Our professional advisors acting as controllers including lawyers, auditors, insurers, consultants and other advisors who provide legal, accounting, insurance and other services.
• Your service providers that you have appointed and we need to contact to fulfil your requests, such as your banking or payment card provider to process your transactions.

(b.) Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Notice.

(c.) HM Revenue and Customs, regulators, law enforcement, public authorities or other third parties based in the UK where necessary to exercise our rights or comply with a legal obligation.

International transfers

We do not transfer your personal data outside the UK or EEA.

Data security

All information you provide to us is stored on our secure servers and located in the EEA. Any payment transactions carried out by our chosen third-party provider of payment processing services Stripe will be encrypted using End-to-End Encryption (E2EE), Tokenisation, TLS and HTTPS Protocols. Where we have given you (or where you have chosen) a password that enables you to access certain parts of our App or Services, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Once we have received your information, we will use strict procedures and security features to protect your personal data from loss, unauthorised use or access.

We may collect and store personal data locally on your device using technologies such as application data caches, browser web storage (including HTML5 local storage), and similar tools. Please see our cookies notice.

Certain Services include social networking, chat room or forum features. Ensure when using these features that you do not submit any personal data that you do not want to be seen, collected or used by other users.

We have put in place procedures to detect and respond to personal data breaches and notify you and any applicable regulator when we are legally required to do so.

Data retention

By law we have to keep basic information about our customers (including Contact, Identity, Security and Transaction Data) for six years after they cease being customers for tax purposes.

In some circumstances you can ask us to delete your data: see Your legal rights listed below for further information.

Once we no longer have a legal right to hold your personal data, we will delete or, in some circumstances, we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

If you do not use the App for a period of 24 months then we will treat the account as expired and will delete your personal data.

Your legal rights

You have the following rights under data protection laws in relation to your personal data.

1. Access. Request access to and/or a copy of the personal data we process about you (commonly known as a data subject access request). This enables you to check that we are lawfully processing it.

2. Correction. Request correction of any incomplete or inaccurate data we hold about you. (We may need to verify the accuracy of the new data you provide to us.)

3. Deletion. Request us to delete or remove personal data where there is no good reason for us continuing to process it. You also can ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we have processed your information unlawfully or where we need to erase your personal data to comply with law. (In some cases, we may need to continue to retain some of your personal data where required by law. If these apply, we will notify you at the time of our response.)

4. Objection. Object to us processing your personal data where (a) we are relying on legitimate interests as the lawful basis and you feel the processing impacts on your fundamental rights and freedoms, or (b) the processing is for direct marketing purposes. In some cases, we may refuse your objection if we can demonstrate that we have compelling legitimate grounds to continue processing your information which override your rights and freedoms.

5. Restriction. Request that we restrict or suspend our processing of your personal data:

• if you want us to establish the data's accuracy;
• where our use of the data is unlawful, but you do not want us to erase it;
• where we no longer require it, but you need us to hold onto it to establish, exercise or defend legal claims; or
• you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.

6. Data portability. Request we transfer certain of your personal data to you or your chosen third party in a structured, commonly used, machine-readable format. This right only applies to information processed by automated means that we process on the lawful bases of consent or performance of a contract.

7. Withdraw consent. Withdraw your consent at any time where we are relying on consent to process your personal data. Please know that this does not affect the lawfulness of any processing carried out before you withdraw your consent, and after withdrawal, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

8. Complain to the UK and Belgium data protection regulator. If you are unhappy with how we process your personal data, we ask that you contact us first using the details below so that we have the chance to put it right. However, you also have the right to make a complaint to the ICO and any other applicable regulator at any time.

Privacy Policy Addendum: Linked Child Profiles

Children's Personal Data

When you create a child profile, we collect limited personal information such as name, age, booking history, and optionally, a profile photo. This data is treated with the same level of security and confidentiality as your own and is only shared in the following ways:

• With clubs where a purchase has occurred in the child's name/profile.
• With other players or guardians involved in the same scheduled event (e.g., group lessons, matches)
• With authorized personnel at the club for operational purposes

Use of Photos & Media

If you upload a profile photo of your child, or if a club takes photos/videos during an activity, that content may be used by the club under their own privacy and media policies. Nettla does not publish or distribute child media data independently. You can request removal or review of this content by contacting the respective club or Nettla support.

You can exercise any of these rights at any time by contacting us hello@nettla.co