Privacy Policy

This Privacy Policy explains how SSF Yardley Ltd, trading as Fives Yardley (“we”, “us”, “our”), collects, uses, stores and shares your personal data when you use our website, booking platform, venue facilities and related services. We are part of the Fives Soccer Centres group operated by Fives Leeds Ltd.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are committed to protecting your privacy and being transparent about what data we hold and why.

1. Who We Are

SSF Yardley Ltd is the data controller for personal data collected through Fives Yardley. Our registered address and contact details are set out at the end of this policy.

Our booking and payment platform is provided by 4nines, our technology partner. 4nines processes personal data on our behalf as a data processor. Payment processing is handled by Ryft, a regulated payment service provider. Neither 4nines nor Ryft use your data for their own marketing purposes.

2. What Data We Collect

We may collect the following categories of personal data:

Account and identity

• Name, email address
• Login credentials and authentication tokens (managed by our authentication provider, Stytch)
• Account preferences and home site selection

Booking and payment

• Booking details: date, time, pitch, product type, booking reference
• Payment information: amount, currency, payment status, payment method
• Contribution and split-payment records where you share the cost with other players
• Cancellation and refund records

We do not collect or store your card number, CVV or other raw payment card data. Card details are entered directly into Ryft's hosted checkout and are handled entirely by Ryft under PCI DSS requirements.

Communications

• Email address for booking confirmations, reminders and service communications
• Feedback or complaints you send us

Technical and usage data

• IP address, browser type, device type
• Pages visited, time spent on site
• Cookies and similar technologies (see Section 8)

Venue and safety

• CCTV footage captured at the venue for safety and security purposes
• Check-in and attendance records
• Emergency contact details where provided
• Medical information where voluntarily provided for safety purposes (e.g. for children's activities)

Filming and media (where enabled)

• Game footage captured by pitch cameras, where filming is enabled for the booking
• Consent records for filming, streaming and clip sharing
• Player tracking and statistics data, where opted in

3. How We Use Your Data

We use your personal data for the following purposes:

4. Who We Share Your Data With

We may share your personal data with the following parties:

• 4nines — our technology and platform partner, who processes data on our behalf to operate the booking platform, payment orchestration and operational tools.
• Ryft — our payment service provider, who processes card payments securely.
• Stytch — our authentication provider, who manages login and account security.
• Other players in your booking — where you share a booking or contribute to a split payment, other participants may see your name and payment status in relation to that booking.
• Law enforcement or regulators — where required by law or to protect our legal rights.

We do not sell your personal data. We do not share your data with third parties for their own marketing purposes.

5. How Long We Keep Your Data

• Account data: retained while your account is active, and for up to 2 years after your last booking or login.
• Booking and payment records: retained for 6 years after the booking date to meet financial and legal record-keeping obligations.
• CCTV footage: retained for up to 30 days unless required for an investigation or legal proceeding.
• Game footage and media: retained in accordance with the venue's media retention policy, typically up to 90 days unless extended by the booking holder.
• Dispute and chargeback evidence: retained for as long as necessary to resolve the dispute, plus a reasonable period thereafter.

6. Your Rights

Under UK GDPR, you have the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data, subject to our legal obligations.
• Restriction — ask us to restrict processing in certain circumstances.
• Portability — request your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interest.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us using the details at the end of this policy. We will respond within one month.

7. Children's Data

Where children participate in activities or bookings, we collect only the data necessary for safety, registration and service delivery. A parent or guardian must provide consent for any child under 13. For filming and media services involving children, additional safeguarding controls apply as set out in our Terms and Conditions.

8. Cookies

Our website uses the following cookies:

• Session cookie (yw_session) — an essential httpOnly cookie that maintains your login session. It does not track you across other websites and expires after 7 days.
• Authentication cookies — set by our authentication provider (Stytch) to manage the login flow.

We do not use advertising cookies or third-party tracking cookies. We may use anonymous analytics in future and will update this policy if we do.

9. Data Security

We take appropriate technical and organisational measures to protect your personal data, including:

• HTTPS encryption on all pages
• httpOnly, secure session cookies
• Server-side storage of authentication secrets and API keys
• Payment card data handled entirely by Ryft (PCI DSS compliant) — we never see or store card numbers
• Access controls and audit logging on administrative systems

10. International Transfers

Your data is primarily processed in the United Kingdom. Some of our technology partners (Stytch, Ryft) may process data in other jurisdictions. Where data is transferred outside the UK, we ensure appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via our website. The date of the last update is shown below.

12. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or want to make a complaint, please contact us:

• Email: info@football5s.com
• Phone: 0113 306 0810
• Post: Fives Leeds Ltd, Fives Soccer, Limewood Approach, Leeds LS14 1NH

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

SSF Yardley Ltd. Last updated: May 2026.