Privacy Notice
1. Who we are
Rebel Combat Sports is run by Rebel Combat Sports Ltd, company number 17320284, registered in England and Wales. Registered office: Unit 27–29, Mountney Bridge Business Park, Eastbourne Road, Westham, Pevensey BN24 5NJ.
We are the data controller for the personal information described in this notice — the organisation legally responsible for it. Contact us at hello@rebelcombatsports.com.
2. What we collect and why
| Data | Why we need it | Lawful basis |
|---|---|---|
| Name, contact details, date of birth, emergency contact | To run your membership and keep you safe | Contract |
| Health declaration (medical conditions, injuries) | To coach you safely and respond in an emergency | Health information gets extra legal protection. We hold it only because you explicitly agree — and in a real emergency, to protect your life |
| Parent/guardian details for under-18s | To get parental consent and stay in touch about their child | Contract and legal obligation |
| Photos and video | Club social media and website | Consent — a genuine opt-in, withdrawable at any time. Withdrawing stops new use; we take down existing posts where practical, but copies others have already shared or screenshotted can't be recalled |
| How you heard about us (optional) | To learn which ways of finding us actually work | Consent — you can leave it blank |
| Email address, when you opt in to club news | To send club news and schedule changes | Consent — opt-in, unsubscribe any time |
| Payment records | Accounting | Legal obligation |
| Incident records | Insurance, safety review, defending legal claims | Legitimate interests; for health content, defending legal claims |
| Class attendance — classes you check in to or we record on the register, your training hours, streaks and belt | To run classes, track progress and prepare for gradings, and to show the members-only leaderboard | Legitimate interests. On the leaderboard you appear as first name and surname initial; you can hide your name, and under-18s are always shown anonymously |
| Competition results you or a coach record — competition, date, level, division and result | To recognise members' competing and show the members-only medal table and milestones | Legitimate interests. Medals appear on the members-only medal table as first name and surname initial; you can hide your name, and under-18s are always shown anonymously |
| Learn activity — which pages of Learn, our members-only training notes, you open, and when | So coaches can see how the notes are used and who might need a nudge | Legitimate interests. Only club coaches with admin access can see it |
| Questions you ask in Learn's Ask feature, and the answers it gives | To answer your question from the club's notes and about your own training, and so coaches can see what's missing from the notes | Legitimate interests. Only club coaches with admin access can see them. Don't put health details or anything about other people in a question; tell a coach instead |
| Questions you ask in the website chat, and the answers | To answer them and improve the site's information | Legitimate interests. Typed contact details are removed before storage. Kept 90 days |
Don't put your contact details, health details or anything about other people in a chat question; email us instead.
We use a daily-salted one-way hash of your IP address only to limit how many questions one visitor can send in a day. It is deleted after 2 days.
3. Who we share it with
- Our insurer — if there is a claim.
- BMABA (British Martial Arts & Boxing Association) — for licensing and affiliation.
- Emergency services — in an emergency.
- Instagram/Meta — if you've consented to photos, the photos we post are public.
Service providers — Netlify (our website forms), Supabase (our member records system), Resend (sends our automated emails), Google (our file storage and email) and Anthropic (the AI service that writes Ask's answers) — hold data on our behalf. Anthropic receives the text of your question and the conversation so far, and, so it can answer questions about your own training, a summary of your attendance, streaks, belt, milestones, competition results and leaderboard places, but not your name or email address. It deletes them within 30 days, unless it needs them longer to enforce its usage policy or the law requires it, and it doesn't use them to train its AI models. For the website chat, Anthropic receives the text of website chat questions, the conversation so far and the page you're on, but no IP address or other identifier.
No one else. We never sell your data.
4. How long we keep it
| Data | Kept for |
|---|---|
| Membership data | 6 years after your membership ends |
| Incident records (adults) | 3 years from the incident |
| Incident records (under-18s) | Until the person's 25th birthday |
| Consent records | For as long as your consent lasts, plus 1 year |
| Payment records | 6 years |
| Learn activity (pages viewed) | 12 months, then deleted automatically |
| Ask questions and answers | 12 months, then deleted automatically |
| Website chat questions | 90 days |
5. Your rights
You have the right to:
- access the data we hold about you;
- correct it if it is wrong;
- have it erased — we will do this unless the law requires us to keep it (see section 4);
- restrict how we use it;
- object to our use of it;
- withdraw consent at any time, where consent is the basis we rely on. Withdrawal stops new use straight away. For photos already posted, we take them down where practical — but copies others have already shared or screenshotted can't be recalled.
To use any of these rights, email hello@rebelcombatsports.com.
If you think we have handled your data badly, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.
6. Where it lives
Form submissions are stored with Netlify (our website platform), copied to our club inbox, and recorded in our member records system, hosted with Supabase in the EU. Emails we send you — confirmations when you book a trial or join, and club news if you've opted in — go through Resend, a US-based email service that keeps a copy for 30 days. Records we write ourselves are stored in Google Workspace. Questions you ask in Ask, with a summary of your own training record, and questions you ask in the website chat, with the conversation so far and the page you're on, are sent to Anthropic, a US AI company, which processes them under its data processing addendum to write the answer. All five hold data on our behalf under their own data-processing agreements. Netlify, Resend and Google are US companies. Where your data leaves the UK, the transfer is covered by the provider's standard contractual clauses with the UK addendum, or by its certification under the UK Extension to the EU-US Data Privacy Framework.
7. Cookies and analytics
The public site works without cookies and sets none by default. Learn, the members-only area, sets essential sign-in cookies so you stay signed in; it can't work without them. We'd like to use Google Analytics to understand how people find and use the site — which pages they read, and whether they go on to book a trial or set up a membership. Google Analytics sets cookies and processes some of that data (including an approximation of your location) on our behalf.
We only load Google Analytics if you accept it on the cookie banner. If you decline, nothing is loaded and no analytics cookies are set. You can change your mind at any time by clearing this site's storage in your browser, which brings the banner back. We don't use advertising cookies, and we don't sell your data.