Privacy Policy

1. Introduction

ClubMe.me (the “Platform”) is a sports academy management system operated by Tiba Group (“we,” “our,” or “us”). We provide scheduling, attendance tracking, subscription management, financial administration, and communication services for sports academies and their members.

This Privacy Policy explains how we collect, use, store, share, and protect the personal data of all users of the Platform, including athletes (“Players”), their parents or legal guardians (“Guardians”), coaching staff, and academy administrators, in compliance with the laws of the United Arab Emirates.

Important: Our Platform processes personal data of minors (individuals under 18 years of age). We are committed to the highest standards of protection for children's data in accordance with UAE Federal Decree-Law No. 26/2025 on Child Digital Safety and Federal Law No. 3/2016 on Child Rights (Wadeema's Law).

2. Legal Basis for Data Processing

We process personal data on the following lawful bases under the UAE Personal Data Protection Law (PDPL), Article 5:

2.1 Consent

We obtain explicit, informed, and freely given consent from Guardians before processing any personal data of a minor (Player). Consent is collected at registration through a clear affirmative action (checkbox acknowledgment). Consent is specific to the purposes described in this Policy and can be withdrawn at any time (see Section 8).

2.2 Contractual Necessity

Certain data processing is necessary to perform our contractual obligations, including managing subscriptions, scheduling sessions, processing payments, and maintaining attendance records.

2.3 Legitimate Interest

We may process data where necessary for our legitimate interests, such as platform security, fraud prevention, and service improvement, provided such interests do not override the rights of data subjects, particularly minors.

2.4 Legal Obligation

We process certain data to comply with applicable UAE laws, including financial record-keeping requirements and child safety reporting obligations under Wadeema's Law.

3. Personal Data We Collect

3.1 Player (Athlete) Data

• Full name and date of birth
• Gender
• Photograph (for identification purposes)
• Medical notes relevant to physical activity (allergies, conditions, injuries)
• Attendance records and session history
• Skill assessments and progress notes
• Branch assignment and group enrollment

3.2 Guardian (Parent) Data

• Full name
• Email address
• Phone number(s)
• Emergency contact information
• Relationship to Player
• Account credentials (encrypted)

3.3 Financial Data

• Subscription and package details
• Invoice records and payment history
• Session wallet (credit/debit ledger)
• We do NOT store credit card numbers, bank account details, or payment card data on our servers. All payment processing is handled by certified third-party payment processors.

3.4 Staff Data

• Employee name, email, phone, and role
• Branch assignments and access permissions
• Attendance and scheduling data

3.5 Technical Data

• IP address and browser/device information
• Session cookies and authentication tokens
• Platform usage logs (for security and troubleshooting)

4. Purposes of Data Processing

We process personal data strictly for the following purposes:

We do NOT use personal data for targeted advertising, behavioral profiling, commercial sale to third parties, or any purpose not explicitly stated above. This prohibition is absolute for minors' data in accordance with Federal Decree-Law No. 26/2025.

5. Special Protections for Children's Data

As our Platform primarily serves sports academies with minor athletes, we implement the following enhanced protections in compliance with UAE law:

5.1 Parental/Guardian Consent

• No minor's account is created without verified Guardian consent.
• Consent is recorded with a timestamp and version number.
• Guardians may withdraw consent at any time, which will result in the deactivation and anonymization of the minor's data.

5.2 Data Minimization for Minors

• We collect only the minimum data necessary for safe academy participation.
• Medical notes are limited to information directly relevant to physical activity safety.
• We do not collect social media profiles, biometric data, or geolocation data of minors.

5.3 Prohibited Uses

• No commercial use of minors' data.
• No targeted advertising or behavioral tracking of minors.
• No sharing of minors' data with marketing or advertising partners.
• No profiling of minors for any non-educational purpose.

5.4 Access Controls

Access to minors' data within the Platform is restricted to authorized personnel only (academy administrators and assigned coaching staff within the relevant branch). All access is logged and auditable.

6. Data Sharing and Third Parties

We do not sell, rent, or trade personal data to any third party. We may share limited data with the following categories of service providers, strictly for the purposes of operating the Platform:

• Hosting Provider (Vercel Inc.) — for application hosting and deployment
• Database Provider (Supabase / AWS) — for secure data storage
• Rate Limiting Service (Upstash) — for security infrastructure
• Payment Processors — for processing financial transactions (we do not store payment card data)

All third-party service providers are contractually bound to process data only as instructed by us and to implement appropriate security measures. We ensure that any cross-border data transfer complies with the PDPL's requirements, including adequacy assessments and standard contractual clauses where applicable.

Disclosure by Law: We may disclose personal data if required by UAE law, a court order, or a lawful request from a competent government authority, including child protection authorities acting under Wadeema's Law.

7. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Policy, or as required by law:

8. Your Rights as a Data Subject

Under the UAE PDPL (Articles 13–18), you have the following rights:

• Right of Access: You may request confirmation of whether your personal data is being processed and obtain a copy of such data.
• Right to Rectification: You may request correction of inaccurate or incomplete personal data.
• Right to Erasure: You may request deletion of your personal data when it is no longer needed for its original purpose, or upon withdrawal of consent. Financial records may be retained as required by law.
• Right to Data Portability: You may request a copy of your personal data in a structured, machine-readable format (JSON).
• Right to Restrict Processing: You may request restriction of processing in certain circumstances.
• Right to Object: You may object to data processing, particularly for direct marketing (which we do not conduct).
• Right to Withdraw Consent: You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing conducted prior to withdrawal.
• Right to File a Complaint: You may file a complaint with the UAE Data Office if you believe your data protection rights have been violated.

How to Exercise Your Rights: Contact us at privacy@clubme.me or use the built-in data export and account deletion features within the Platform. We will respond to all requests within 14 calendar days.

9. Data Security

We implement comprehensive technical and organizational security measures, including:

• Encryption in transit (TLS/HTTPS) and at rest for all personal data
• Password hashing using industry-standard algorithms (bcrypt)
• Role-based access control (RBAC) with branch-level data isolation
• Rate limiting on authentication endpoints to prevent brute-force attacks
• Server-side input validation (Zod schema) on sensitive API endpoints
• CSRF protection and secure session management
• Regular security audits and vulnerability assessments
• Audit logging of administrative actions

Breach Notification: In the event of a personal data breach that may compromise the privacy, confidentiality, or security of your data, we will notify the UAE Data Office within 72 hours and notify affected data subjects without undue delay, as required by the PDPL.

10. Cross-Border Data Transfers

The Platform is hosted on cloud infrastructure that may involve data processing in locations outside the UAE. We ensure that any cross-border data transfer is conducted in compliance with the PDPL (Article 22), including:

• Ensuring the receiving jurisdiction provides an adequate level of data protection
• Implementing standard contractual clauses with all service providers
• Conducting transfer impact assessments where required

11. Cookies and Similar Technologies

The Platform uses only essential cookies required for authentication and session management. We do not use tracking cookies, advertising cookies, or analytics cookies that profile user behavior. No third-party marketing trackers are embedded in the Platform.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated through the Platform (in-app notification) and, where required, we will obtain fresh consent. The version number and effective date are displayed at the top of this document. Continued use of the Platform after notification constitutes acceptance of the updated Policy.

13. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data subject rights, or have a complaint:

• Email: privacy@clubme.me
• Organization: Tiba Group (operating Tiba Academy)
• Jurisdiction: United Arab Emirates
• Regulatory Authority: UAE Data Office (Federal Decree-Law No. 44/2021)

This Privacy Policy is governed by and construed in accordance with the laws of the United Arab Emirates.