Privacy Policy
1. Who We Are and How to Contact Us
Sporting Assets Ltd (“Sporting Assets”, “we”, “us” or “our”) is the data controller responsible for your personal data.
This policy explains how we collect, use, share and protect personal data, and sets out your rights under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.
Registered address: W106 Vox Studios, 1–45 Durham Street, London SE11 5JH
Company number: 09038426. Sporting Assets Ltd is a company registered in England and Wales.
Website: www.sportingassets.co.uk
General enquiries: enquiries@sportingassets.co.uk
2. What Personal Data We Collect and Why
We collect and use personal data across a number of activities. For each activity, we set out the data involved, our purpose, the lawful basis we rely on under the UK GDPR, and where we do not obtain the data directly from you, the source it comes from.
2.1 Website Visitors and Enquiries
When you visit our website or contact us through it, we may collect:
- your name, email address, telephone number, and the content of your message (via our contact form or direct email enquiries); and
- technical data, including your IP address, browser type, and pages visited, collected via cookies and similar technologies (see section 3).
Purpose: to respond to your enquiry and to understand how our website is used so we can improve it.
Lawful basis: legitimate interests (responding to enquiries); consent (analytics and other non-essential cookies, which are set only if you accept them via our cookie consent tool).
Where this data comes from: Directly from you, or generated automatically when you use our website.
2.2 Fund Applicants and Investees
When an organisation applies for funding through one of our funds, we collect personal data about the individuals involved, principally directors, trustees, officers, and other representatives acting in a formal capacity on behalf of the organisation. This may include:
- names and job titles / roles;
- organisational contact details (club email addresses, club telephone numbers, registered addresses);
- financial information relating to the organisation (accounts, forecasts, business plans);
- information provided in the course of due diligence (company filings, board minutes, grant documentation);
- identity documentation (such as passport or driving licence details) where required for anti-money laundering and Know Your Customer (KYC) checks; and
- correspondence during the application, assessment, and loan management process.
Purpose: to assess and manage investment applications and to administer loans and ongoing monitoring across our funds.
Lawful basis: contract (where a loan agreement is in place); legitimate interests (during assessment and due diligence); legal obligation (where retention is required for regulatory or accounting purposes).
Where this data comes from: Mostly directly from the applicant organisation and its representatives. Some information is obtained from other sources, including publicly available registers and records (such as Companies House and the Charity Commission), board and governance documents provided to us, partners and co-funders involved in a project, and due diligence and verification checks.
Providing this data: Where you apply for funding, providing the information we request is necessary for us to assess the application and, if funding proceeds, to enter into and administer the loan or investment agreement, and in some cases to meet our legal and regulatory obligations (for example anti-money-laundering checks). If the information is not provided, we may be unable to assess or progress the application.
2.3 Advisory Clients
When we provide advisory services, we collect personal data about the individuals involved, typically officers, trustees, and representatives of the client organisation. This may include:
- names and roles of key contacts;
- organisational contact details;
- financial, operational, and governance information provided during the engagement; and
- correspondence and meeting notes.
Purpose: to deliver advisory services and maintain our client relationship.
Lawful basis: contract; legitimate interests (managing and delivering our advisory services and client relationships).
Where this data comes from: Directly from you and your organisation, and where relevant from colleagues, project partners, and publicly available sources.
Providing this data: Where we are engaged to provide advisory services, providing the information we request is necessary to enter into and perform that engagement. If it is not provided, we may be unable to deliver the services.
2.4 Investors, Co-Funders, and Sector Partners
We work with fund investors and co-funders, as well as sector partners. Where we hold personal data about individuals at those organisations, we do so in the context of managing our business relationships.
Lawful basis: contract; legitimate interests (administering and maintaining our business relationships with investors, co-funders and partners).
Where this data comes from: Directly from those individuals and organisations, and from publicly available professional sources.
2.5 Job Applicants and Staff
We collect personal data about job applicants and employees in the course of recruitment and employment. This is governed by a separate staff privacy notice, available on request.
Lawful basis: contract; legal obligation; legitimate interests.
Where this data comes from: Directly from you and, where relevant and with appropriate notice, from referees and recruitment partners.
Special category data. We do not generally seek to collect special category data (such as data about health, racial or ethnic origin, or religious beliefs). Where we do process such data — for example, limited information in a recruitment context — we will only do so where a condition under Article 9 of the UK GDPR and the Data Protection Act 2018 applies.
Criminal offence data. Where our due diligence includes anti-money-laundering, sanctions or adverse-media screening, we may process information relating to actual or alleged criminal offences. We process such data only where we have a lawful basis and a condition under Article 10 of the UK GDPR and the Data Protection Act 2018, supported by an appropriate policy document where required.
3. Cookies and Website Analytics
3.1 What Cookies Are
Cookies are small text files placed on your device when you visit a website. They help websites function correctly and allow website owners to understand how their site is being used. Some cookies, or the information collected through them (such as online identifiers and IP addresses), may constitute personal data.
3.2 Cookies We Use
Essential cookies. These are necessary for the website to function and are set automatically. They do not require your consent.
Analytics cookies (consent required). We use Google Analytics (provided by Google LLC) to collect information about how visitors use our website. These cookies are only set if you accept them via our cookie consent tool when you first visit the site. You can withdraw your consent and update your cookie preferences at any time by clicking the cookie settings link in our website footer.
3.3 Google Analytics and International Transfers
Google Analytics may transfer data to Google LLC servers in the United States. This transfer takes place under Standard Contractual Clauses. Google’s privacy policy is available at policies.google.com/privacy.
3.4 Third-Party Cookies
Our website may include content from third-party providers (such as embedded video). Those providers may set their own cookies, which we do not control. Please refer to the relevant provider’s privacy policy.
3.5 Managing Cookies
You can control cookies through your browser settings. Disabling certain cookies may affect website functionality. Guidance is available for Google Chrome, Firefox, Safari, and Microsoft Edge.
3.6 The Cookies We Use
4. Who We Share Your Data With
We do not sell personal data to third parties. We may share personal data in the following circumstances:
- with fund investors and co-funders where required by fund agreements and governance obligations;
- with professional advisers (solicitors, surveyors, accountants) under appropriate confidentiality obligations;
- with technology and software providers who process data on our behalf as data processors, including Anthropic PBC (AI tools), Google LLC (analytics), Salesforce (loan management), and Egnyte (document storage), under Data Processing Agreements or equivalent contractual arrangements;
- with regulatory bodies or law enforcement where legally required; and
- in the event of a business sale or restructuring, with the acquiring party.
5. International Data Transfers
Some of our service providers are based outside the United Kingdom. Where we transfer personal data outside the UK, we ensure an appropriate safeguard recognised under the UK GDPR is in place. Current transfers include:
- Google LLC (United States) — Google Analytics. Transfer mechanism: Standard Contractual Clauses (UK Addendum).
You can ask us for more information about the safeguards we use.
6. How Long We Keep Your Data
We retain personal data only for as long as necessary for the purpose for which it was collected, and in accordance with our legal obligations. When data is no longer needed, it is securely deleted or anonymised.
| Category of data | Retention period | Lawful basis |
|---|---|---|
| Website enquiries / contact form submissions | 2 years from last contact | Legitimate interests |
| Fund application data — unsuccessful applicants | 3 years from decision | Legitimate interests |
| Fund applicant and investee data — active and completed loans | 6 years from end of loan | Legal obligation |
| Advisory client data | 6 years from end of engagement | Legal obligation / legitimate interests |
| Investor and co-funder data | 6 years from end of relationship | Legal obligation |
| Fund design client data | 6 years from end of engagement | Legal obligation / legitimate interests |
| Recruitment data — unsuccessful applicants | 6 months from decision | Legitimate interests |
| Staff / employee data | 6 years from end of employment | Legal obligation |
| Website analytics (Google Analytics) | 26 months (Google default) | Consent |
7. How We Protect Your Personal Data
We have appropriate technical and organisational measures in place to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. We limit access to personal data to those who need it, and we require our service providers to keep it secure. No transmission over the internet can be guaranteed to be completely secure, but we take reasonable steps to protect your information.
8. Your Rights
Under the UK GDPR, you have the following rights in relation to your personal data:
| Right | What it means |
|---|---|
| Access | You can ask us for a copy of the personal data we hold about you. |
| Rectification | You can ask us to correct inaccurate or incomplete data. |
| Erasure | You can ask us to delete your data where we no longer have a lawful reason to retain it. |
| Restriction | You can ask us to pause processing of your data while a dispute is resolved. |
| Portability | Where processing is based on consent or contract, you can ask for your data in a portable format. |
| Objection | You can object to processing based on legitimate interests, and at any time to direct marketing. We will stop unless we have compelling grounds that override your interests. |
| Withdrawal of consent | Where we rely on consent (e.g. analytics cookies), you can withdraw it at any time without affecting the lawfulness of prior processing. |
| Automated decision-making | You have the right not to be subject to decisions made solely by automated means that have a legal or similarly significant effect on you. We do not make such decisions. We will update this notice if this position changes. |
To exercise any of these rights, please contact us at enquiries@sportingassets.co.uk. We will respond within one month. We may need to verify your identity before processing your request. We will not charge a fee unless a request is manifestly unfounded or excessive.
9. How to Complain
If you have concerns about how we handle your personal data, please contact us at enquiries@sportingassets.co.uk in the first instance. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
- Website: ico.org.uk
- Telephone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
10. Changes to This Policy
We review this privacy policy at least annually. If we update this Privacy Notice, the most recent and up-to-date version will always be available here.