ITFC Women Privacy Policy

Last updated: 9 November 2026  ·  Version privacy-auth-itfc-women-r4  ·  Earlier versions: version history

This Privacy Policy explains how personal data is collected, used and protected across ITFC Women digital services.

These services include websites and online services that use your ITFC Women account.

When you create or use a ITFC Women account through one of these services, your core account information is held centrally so that you can use the same login across participating ITFC Women digital services. This central account also helps us manage authentication, security, communication preferences, consents and data protection rights across those services.

Some ITFC Women digital services may collect additional information for that specific service. Where this happens, the relevant service may provide a short supplementary privacy notice explaining the additional personal data used for that service. Those supplementary notices should be read together with this Privacy Policy.

1. Who we are

Ipswich Town Women's Football Club (company number 16321223, registered address Ipswich Town Women's Football Club Ltd, Ipswich Town Stadium, Portman Road, Ipswich, Suffolk, England, IP1 2DA ) is the Data Controller for all personal data collected through our digital services. References to "ITFC Women", "we", "us" and "our" mean Ipswich Town Women's Football Club.

HotLizard Limited (company number 03811966, registered office Tower Business Park, Kelvedon Road, Tiptree, Essex, CO5 0LX) provides and operates the digital services platform on behalf of ITFC Women. HotLizard Limited processes personal data as a processor, in accordance with ITFC Women's written instructions and under a Data Processing Agreement.

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact ITFC Women:

ITFC Women — Data Protection contact

2. About this policy

This policy applies to personal data collected through ITFC Women's digital services including websites and online services that use your ITFC Women account.

It explains how your ITFC Women account works across those services, how your personal data is used, how your preferences and rights are managed, and how we keep your information secure.

Some ITFC Women digital services, may collect additional information for that specific service. Where this happens, the relevant service may provide a short supplementary privacy notice explaining that additional processing.

This policy does not cover:

• third-party websites we may link to.
• services provided directly by ITFC Women outside this digital platform.
• other clubs, venues or organisations, even if they use similar technology operated by HotLizard Limited.

We may update this Privacy Policy from time to time. Significant changes will be notified to you through a notification in the service, by email, or both. Minor changes are reflected only in the "Last updated" date at the top of this policy. Previous versions of this policy will remain available at https://itfcwomen.solelysecured.com/privacy/versions.

3. What information we collect and why

3.1 Your account

We collect and use personal data to create and manage your ITFC Women account at https://itfcwomen.solelysecured.com, provide the digital services you use, keep your account secure, manage your preferences and meet our legal obligations.

Some personal data is needed so that we can create and manage your ITFC Women account, provide the services you request, keep your account secure, or meet legal requirements. If you do not provide information that is required for a particular service, we may not be able to provide that service to you.

We do not store full card numbers or bank account details. Card payments are processed by our payment provider, and full card details do not reach or remain in our platform storage.

Responses to polls open to everyone are not linked to your ITFC Women account. Responses to polls or surveys requiring sign-in are linked to your account while retained.

Poll and vote results are published only as totals or percentages and only where there are enough responses to avoid identifying participants. We do not publish participants’ names or written answers.

We do not design polls or surveys to collect special-category personal data. Please do not include personal or sensitive information in written answers unless we specifically ask for it.

3.2 Automatically collected information

When you use ITFC Women digital services, we may automatically collect information such as your IP address, browser type, operating system, pages visited and cookie identifiers. More information about cookies and similar technologies is set out in Section §8.

4. How we use your information

Under UK data protection law, we must have a lawful basis for using your personal data. The table below explains the main purposes for which we use personal data and the lawful basis we rely on.

Where we rely on legitimate interests, our interests include keeping our services secure, administering and supporting the platform, preventing misuse, maintaining accurate records, and sending relevant service-related communications where permitted by law. We only rely on legitimate interests where we have considered your rights and interests.

Taking part in a poll or survey does not subscribe you to marketing or change your existing communication preferences.

5. How your information is shared within our services and with others

5.1 Inside our services

When you sign into any of our services using your account, your core account information (name, email address) is provided to that service to identify you. Each service only receives the information necessary for its function. For example, a food and beverage service does not receive your postal address, as it is not required for that service. Each product then keeps a local mirror of those details, kept in step with the Account Management service by signed system-to-system updates. No product ever holds your password or your multi-factor-authentication secret — those remain only with the Account Management service.

5.2 Cross-brand separation

Your data is never shared between different clubs or organisations. Your ITFC Women account is entirely separate from any accounts you may hold with other clubs or venues using similar services operated by HotLizard Limited.

5.3 Outside our services

We share personal data only where necessary to provide, support and protect ITFC Women digital services, comply with the law, or administer ITFC Women’s services. This may include sharing personal data with the following categories of recipient:

Some recipients process personal data on our behalf, while others act as independent or joint controllers. Where another controller is involved, we will explain its role when we collect your information and, where appropriate, link to its privacy information.

• Platform and technology providers — including HotLizard Limited, which provides and operates the digital services platform on behalf of ITFC Women.
• Hosting and infrastructure providers — to host, secure and maintain the platform.
• Payment providers — to process payments, reconcile transactions and issue refunds
• Communications providers — to support SMS, service, security or transactional communications where needed.
• Mobile wallet providers — where tickets, passes or similar items are issued to mobile wallet services.
• Delivery partners — where merchandise or other items need to be delivered.
• Professional advisers, regulators, law enforcement, courts and other authorities — where required by law or necessary to protect legal rights.
• Official sporting authorities or venue/safety bodies — where required for competition administration, venue access, safety or security.
• Video platforms — where you choose to play embedded content, providers such as YouTube or Vimeo receive technical information, including your IP address and device information, and process it under their own privacy information.
• Poll and survey partners — where we run a poll or survey with or for another organisation, the relevant page will identify that organisation, explain its role, describe any information shared with it and link to its privacy information where appropriate.

We do not sell, rent or trade your personal information to third parties for their marketing purposes.

5.4 International transfers

Some of our service providers may process personal data outside the UK. Where this happens, we ensure that appropriate safeguards are in place as required by UK data protection law, such as relying on UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism.

6. How we protect your information

ITFC Women is committed to protecting your personal data and requires HotLizard Limited, as the platform provider acting on our behalf, to apply appropriate technical and organisational security measures.

These measures include secure connections, password and authentication protections, multi-factor authentication, account lockout and rate limiting, session management, access controls for staff, monitoring and logging of security-sensitive actions, and secure communication between ITFC Women digital services.

We review our security measures and update them where appropriate.

You should keep your login details confidential and contact us promptly if you believe your account has been accessed without permission.

Although we make every effort to protect your personal information, no online service or method of electronic storage can be guaranteed to be completely secure.

7. How long we keep your information

We keep your personal data only for as long as is necessary for the purposes it was collected for, or for as long as the law requires.

We may keep personal data for longer where this is required by law, needed to resolve disputes, enforce our terms, prevent fraud or misuse, or establish, exercise or defend legal claims. Where we no longer need personal data, we delete it or anonymise it.

8. Cookies and similar technologies

We use cookies and similar technologies on https://itfcwomen.solelysecured.com to provide and protect our service and, with your permission, to understand how it is used and to personalise content. We group cookies in four categories:

• Strictly necessary — required for the service to work at all (for example, keeping you signed in, protecting forms against attack, remembering which Brand's site you are on). These are always set.
• Functional — remember your preferences and make the service easier to use. Set only with your consent.
• Analytics — help us understand how the service is used, so we can improve it. Set only with your consent.
• Marketing — help us understand the effectiveness of our communications and, where applicable, deliver relevant advertising. Set only with your consent.

On your first visit you will see a cookie banner where you can accept all, reject all, or choose your preferences. You can change your choices at any time from our Cookie Preferences page, reachable from every footer. 

Poll and survey pages use strictly necessary cookies to protect response forms, maintain signed-in sessions and prevent repeat voting. The repeat-vote cookie used for polls open to everyone lasts for 30 days, the form-security cookie lasts until the browser closes, and the session cookie used for signed-in polls may last for up to one month. These cookies are not used for marketing or analytics.

If you choose to play embedded video content, the video provider may set cookies or use local storage under its own privacy and cookie information.

9. Your rights

You have rights under UK data protection law. Many of these can be exercised through your ITFC Women account or by contacting us using the details in Section §1.

• Right of access — request a copy of the personal data we hold about you. You can trigger this from your profile; you will receive a signed download link to a machine-readable export covering your account data and data from every ITFC Women product you have used. Signed-in poll and survey responses are included in access requests. Responses to polls open to everyone are not linked to your account and may not be identifiable as yours.
• Right to rectification — correct your account details on your profile or contact us.
• Right to erasure — you can request deletion of your ITFC Women account. If you request account deletion, this relates to your ITFC Women account across the participating digital services you use. We operate a 14-day grace period during which you can cancel the request. If you do not cancel, we will delete or anonymise your account and ask the relevant ITFC Women digital services to do the same, except where we need to keep limited information for legal, financial, operational, security or suppression purposes. Linked poll and survey responses are deleted or anonymised as part of this process; aggregate results may remain.
• Right to restrict processing — ask us to limit how we use your personal data while a query is being resolved.
• Right to data portability — the subject access export is provided in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests. Where the processing is for direct marketing, your right to object is absolute — we will stop, with no balancing test. You can also withdraw any marketing consent you have given. Both actions are available per channel and per product stream directly from your profile at https://itfcwomen.solelysecured.com.
• Right to withdraw consent — for anything we do on the basis of your consent, you can withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing we carried out before you withdrew it.
• Rights in relation to automated decision-making and profiling — you have the right not to be subject to solely automated decisions that have legal or similarly significant effects on you. ITFC Women does not make such decisions about you. Automated processing that affects access to the service is limited to security-related measures, such as account lockout after repeated failed sign-in attempts, rate limiting and bot detection.

There is normally no charge for exercising any of these rights.

10. Marketing communications

We operate two separate marketing streams. They rely on different legal bases, and each is managed independently in your communications preferences on your ITFC Women account. You can stop either stream at any time without affecting the other, and without affecting service and security messages.

We may use basic segmentation, such as selecting users who have used a particular service, bought a particular type of product or responded to a signed-in poll or survey, to select relevant marketing communications where permitted by law. Taking part in a poll or survey does not subscribe you to marketing or change your existing communication preferences. We do not use this to make solely automated decisions about you that have legal or similarly significant effects.

10.1 Service-related marketing (legitimate interests)

When you buy, or negotiate to buy, a product or service from ITFC Women, we may send you marketing about our own similar products or services where permitted by electronic marketing rules. For example, this may include upcoming fixtures, season-ticket renewals or related hospitality offers. We rely on our legitimate interests under data protection law and, where applicable, the electronic-marketing soft opt-in. You can object to these messages at any time.

You do not need to opt in to receive these messages, but you have an absolute right to object to them at any time. You can do this by:

• Using the "Stop these" controls in your communications preferences at https://itfcwomen.solelysecured.com, for the relevant product and available communication channel.
• Clicking the unsubscribe link in any such message.
• Contacting us using the details in Section §1.

Within a service-related marketing message, we may include brief, contextual references or links to other ITFC Women products — for example, a match-day email may include a link to the club shop so you can order from it before attending the fixture. These incidental references do not create a separate marketing stream: if you object to service-related marketing for a product, you will stop receiving those messages entirely, including the cross-product references inside them.

10.2 General marketing (your consent)

Marketing that goes beyond the products you already use — for example our newsletter, cross-product promotions, and third-party partner offers — is sent only where you have given your separate consent for the relevant communication channel. You can withdraw that consent at any time in your communications preferences at https://itfcwomen.solelysecured.com or by using the unsubscribe link in any such message.

10.3 Service and security communications

Stopping marketing of either kind does not affect service and security communications such as sign-in alerts, password-change confirmations, order confirmations, important account notifications, or material updates to this policy. We send these communications under the appropriate lawful basis, which may include contract, legal obligation or our legitimate interests in administering and protecting your account and the services you use. Essential service and security communications cannot be turned off while the relevant account or service remains active.

10.4 Brand isolation

Your communications preferences apply to your ITFC Women account only. If you also hold an account with another club or venue whose services are operated on the same platform by HotLizard Limited, your preferences and personal data there are held and managed entirely separately from ITFC Women. A marketing objection or consent set on one Brand never transfers to another.

10.5 Suppression record

If you withdraw consent, object to service-related marketing, or delete your account, we keep a minimal record of that fact (your email address and phone number, flagged as suppressed, with the stream and the date) so that we do not contact you by mistake in the future. This suppression record is kept indefinitely — see Section §7 — and applies equally whether the suppression arose from a withdrawn consent or an exercised right to object.

10.6 Emails we send you

Our emails do not contain tracking pixels, and we do not record whether you open them. When you select a link in one of our emails, we record that you selected it and which link it was.

For marketing emails, we use this information to understand which content is useful and to help select relevant future communications. For operational emails, click information is used only for service delivery, security, troubleshooting and audit purposes and is not used to select future marketing.

When you select a link or unsubscribe, we also retain your IP address and device type for 30 days to identify automated systems such as email-security scanners, after which that information is deleted.

Link-click information does not change your marketing preferences. You can object to marketing at any time through your communication preferences, by using the unsubscribe link in a marketing email or by contacting us.

11. Children

ITFC Women digital accounts are not available to children under the age of 13. You must be 13 or older to create your own account. Where we collect your date of birth, we use it only to check that this age requirement is met.

If you are a parent or guardian, you may use your own account to buy tickets or products for a child in your care. In that case, the products are issued through your account, and you remain responsible for the account.

We do not knowingly market products or services to users aged 13–17, and we do not allow children under 13 to create their own account. If we become aware that we hold a standalone account for a child under 13, we will close it and delete or anonymise the personal data unless we need to keep limited information for legal or safeguarding reasons.

12. Security incidents

If a security incident occurs that affects your personal data, ITFC Women — in its role as Data Controller — is responsible for assessing the incident and, where required by UK data protection law, notifying the Information Commissioner's Office and, where the incident is likely to result in a high risk to your rights and freedoms, notifying you. HotLizard Limited, as the platform provider acting on ITFC Women’s behalf, will support ITFC Women in identifying, investigating and responding to relevant incidents.

13. Complaints

If you are unhappy with how we have handled your personal information, please contact us using the details in Section §1 so that we can try to resolve the issue.

You also have the right to lodge a complaint with the UK's data protection supervisory authority, the Information Commissioner's Office (ICO):

14. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our services or the law. If we make material changes we will notify you through the relevant ITFC Women digital service, by email, or both. Minor changes are indicated only by an updated "Last updated" date at the top. The policy in force at the time of each previous publication is retained and accessible at https://itfcwomen.solelysecured.com/privacy/versions.

— End of Privacy Policy —