01Who we are
WRDRB™ is a trading name of The Mother Goose Group Ltd, a company registered in England and Wales (Company No. 17250953), registered office 5 St. Nicholas Place, East Challow, Wantage, Oxfordshire, OX12 9SP, United Kingdom.
WRDRB is a kit and uniform management platform used by sports clubs, facilities teams and workwear-issuing organisations ("Customers") to track what's issued, to whom, and what's returned. We provide this through a paid platform (my.wrdrb.org.uk) and a free grassroots tier (grassrootswrdrb.lovable.app).
Throughout this policy, "we", "us" and "WRDRB" mean The Mother Goose Group Ltd.
02Two roles: controller & processor
Because WRDRB is a B2B platform, we sit in two different positions depending on whose data it is. This distinction matters for your rights, so it's worth being upfront about it.
We are the data controller for:
- Your account details if you sign up as a Customer (name, work email, organisation, billing contact)
- Billing and subscription records (via Stripe)
- Website visitor and enquiry data (contact forms, demo bookings, live chat)
- Marketing communications you've opted into
We are the data processor for:
- The staff, player or member records your organisation enters into WRDRB — names, contact details, sizing, kit issued, department/group, requests
Here, your organisation is the data controller. They decide what's collected and why; we process it strictly on their instructions, under a Data Processing Agreement. If you're a staff or team member with a question about your own kit record, your first port of call is your club or organisation's admin — not WRDRB directly, though we'll always help route the request.
03What data we collect
| Who | What we hold | Where it comes from |
|---|---|---|
| Customer account holders / admins | Name, work email, password (hashed), organisation name, role, phone (optional) | You, at signup |
| Billing contacts | Billing name, email, address, payment method (held by Stripe — we never see full card numbers) | You, via Stripe Checkout |
| Staff / team members on a Customer's roster | Name, email, role, department/group, clothing sizes, kit issued/returned, requests, policy acknowledgements | Entered by the Customer's admin, or by the individual via the staff portal |
| Website visitors | Pages viewed, general location (country/region), device/browser type, referrer | Cookies/analytics — see §11 |
| Support & enquiries | Name, email, message content, live chat transcripts | You, via email or Tawk.to live chat |
| Platform activity | Login times, audit log of actions taken (who issued/returned what, when) | Generated automatically by the platform |
| People who turn on notifications | A push address for that browser or device, the encryption keys the browser provides for it, the browser/device type, and which WRDRB account it belongs to | Your browser, only when you tap "Turn on" for notifications (see §11) |
| Organisations on a free trial | Which screens are opened and which key features are used (for example issuing kit, transferring stock or exporting a report), with the date and time. Recorded against the organisation, not against any individual user, and containing no details about staff or players | Generated automatically during a free trial only — see §11 |
We don't collect special category data (health, religion, ethnicity etc.) by design. Clothing sizes and department/role are not special category data under UK GDPR.
04Children's data
Grassroots clubs may include players or dependants under 18. Where a Customer enters records for a minor, we process that data too — always as a processor, on the Customer's instructions, never as the controller.
We apply extra safeguards to this data specifically:
- We never use children's data for marketing, profiling, or any purpose beyond kit/uniform administration
- We collect the minimum needed — typically name, size, and department/squad; we do not ask Customers to enter a minor's date of birth, home address, or emergency contact details unless they choose to for their own administrative purposes
- Minors' records carry the same access controls as any other record: only their club's authorised admins can see them, enforced at the database level
- It is the Customer's responsibility, as controller, to establish the lawful basis for entering a minor's data (typically legitimate interests in running the club, or a parent/guardian's consent under the club's own membership terms) and to ensure a parent or guardian is aware their child's kit record is held digitally
- Customers should not enter data about a child that isn't necessary for kit administration
If you're a parent or guardian and want to know what's held about your child, contact your club or organisation directly — they hold the record. If you believe WRDRB itself is processing a child's data unlawfully, contact us at hello@wrdrb.org.uk and we'll investigate directly with the Customer.
05Why we process it (lawful basis)
| Purpose | Lawful basis |
|---|---|
| Providing the platform to Customer accounts | Contract (performing our contract with the Customer) |
| Processing staff/member kit records on a Customer's instruction | We act on the Customer's lawful basis, as their processor |
| Billing and subscription management | Contract, and legal obligation (accounting/tax records) |
| Platform security, fraud prevention, audit logging | Legitimate interests (keeping the platform and Customer data secure) |
| Understanding which features organisations use during a free trial, to improve WRDRB | Legitimate interests (improving our product). Recorded at organisation level only, with no details about individuals |
| Responding to support enquiries | Legitimate interests / contract |
| Marketing emails to prospects or account holders | Consent (opt-in), or legitimate interests for existing Customers with an opt-out on every email |
| Website analytics | Consent, via cookie banner — see §11 |
06Who we share it with
We use a small number of trusted sub-processors to run the platform. We don't sell personal data, and we don't share it with anyone for their own marketing purposes.
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database, authentication, file storage | All platform data (EU/UK hosted) |
| Stripe | Payment processing | Billing contact, payment method (Stripe never shares full card numbers with us) |
| Resend | Transactional email (welcome, billing, policy notifications) | Name, email, notification content |
| Netlify | Website & application hosting | Site delivery — no database access |
| Tawk.to | Live chat support | Name, email, chat transcript, if you use live chat |
| Browser push services (Apple, Google, Mozilla or Microsoft, depending on your device) | Delivering notifications you've turned on | An encrypted message they cannot read, and the push address to deliver it to. Only used if you turn notifications on |
| Lovable | Hosting for the free grassroots tier | Grassroots tier data only — never paid-platform data |
Each provider is contractually bound to process data only for the purpose we specify and to appropriate security standards. We may also disclose data where required by law, to enforce our terms, or to protect the rights and safety of WRDRB, our Customers, or others.
A supplier connected to a Customer's account (e.g. a kit supplier) only ever sees order and catalogue data — never staff or member personal data.
07International transfers
Our core database (Supabase) is hosted in the EU/UK, and Resend's email infrastructure runs on EU/Ireland servers, so this data does not routinely leave the UK/EEA. Some sub-processors (for example, elements of Stripe's or Netlify's infrastructure) may process data outside the UK/EEA. Where that happens, we rely on Standard Contractual Clauses, the UK International Data Transfer Addendum, or an equivalent adequacy mechanism, as required under UK GDPR.
08How long we keep it
| Data | Retention |
|---|---|
| Customer account & billing records | Duration of the contract, then 6 years (statutory limitation/accounting requirements) |
| Staff/member records (roster data) | Duration of the Customer's subscription; deleted or exported within 30 days of account closure, per the Customer's instruction |
| Audit logs | 12 months |
| Notification push addresses | Until you turn notifications off on that device, sign out on it, the browser tells us the address has expired, or the account is closed |
| Free trial feature usage | Recording stops as soon as the organisation moves to a paid plan. Deleted along with the organisation's other data if the account is closed |
| Support & chat transcripts | 24 months |
| Marketing/enquiry data | 24 months, or until you unsubscribe/object |
| Website analytics | As set by the analytics tool in use — see §11 |
Where a Customer closes their account, we delete or irreversibly anonymise the staff/member data associated with it, except where we're required to retain it for legal or accounting purposes.
09Keeping it safe
- Every organisation's data is isolated at the database level using row-level security — one Customer cannot access another's data, even in the event of an application-layer bug
- Access to production data is limited to what's needed to operate the platform
- Card payment data is handled entirely by Stripe; we never store full card numbers
- Passwords are hashed, never stored in plain text
- Data is encrypted in transit (HTTPS/TLS) and at rest
No system is 100% secure, and we maintain a breach response process to investigate and, where required, notify the ICO and affected parties without undue delay, and within 72 hours of becoming aware of a qualifying breach.
10Your rights
Under UK GDPR you have the right to:
- Access the personal data we (or, for staff/member records, your organisation) hold about you
- Rectify inaccurate data
- Erase your data, subject to legal retention requirements
- Restrict or object to certain processing
- Port your data to another provider in a common format
- Withdraw consent at any time, where processing is based on consent
- Complain to the ICO (see §14)
If your data was entered by your club or employer as part of a roster (staff/member records), please contact them first — they control that data and can action most requests directly within the platform. If they're unable to help, or you're not sure who to contact, email us at hello@wrdrb.org.uk and we'll assist.
11Cookies & tracking
We use only the cookies necessary to keep you logged in and the platform functioning, plus (where you consent via our cookie banner) basic analytics to understand site usage. We do not use third-party advertising trackers. A full cookie list is available on request at hello@wrdrb.org.uk.
Notifications
Notifications are off until you turn them on yourself, on each device, and your browser or phone will ask your permission first. When you do, your browser gives us a push address and encryption keys for that device, which we store against your account. We use them only to send WRDRB notifications about kit requests (for example, that your kit is ready to collect, or that someone has requested kit).
Each notification is encrypted on our server so that only your device can read it. It travels through your browser's push service (Apple, Google, Mozilla or Microsoft), which can see the push address but not the message. No cookies are involved. You can turn notifications off at any time from the Notifications button in WRDRB or in your browser or phone settings, and signing out on a device turns them off for that device.
Product usage during free trials
While your organisation is on a free trial, we record which screens of WRDRB are opened and which key features are used (for example issuing kit, transferring stock or exporting a report), with the date and time. This is recorded against your organisation, not against any individual user, and contains no details about your staff or players. It is stored in our own database, uses no cookies, and is not shared with any third party.
We use it only to understand which features are most useful and to improve WRDRB. We stop recording it as soon as you move to a paid plan, and it is deleted along with your organisation's other data if your account is closed. If you'd like us not to record it during your trial, email hello@wrdrb.org.uk.
12Automated decisions
WRDRB does not use automated decision-making or profiling that produces legal or similarly significant effects on individuals. Low-stock alerts, reorder thresholds and request routing are operational automations, not decisions about people.
13Changes to this policy
We'll update this page when our processing changes, and update the "Last updated" date at the top. For material changes, we'll notify Customer admins by email.
14Contact & complaints
Data protection contact: hello@wrdrb.org.uk
Postal address: The Mother Goose Group Ltd, 5 St. Nicholas Place, East Challow, Wantage, Oxfordshire, OX12 9SP, United Kingdom
If you're unhappy with how we've handled your data, you have the right to lodge a complaint with the UK's supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
ico.org.uk · 0303 123 1113