What we keep, and why.
This is the whole notice. We collect what the site needs to work and nothing that it doesn't.
Who is responsible
Up The Villa, Birmingham, United Kingdom, is the data controller for this website. Questions and requests go to the address on the contact page.
Reading the site
You can read every page without an account. Our web server records the standard request log (IP address, page, time, browser string) for security and to keep the site up; those logs are rotated and deleted within 30 days. We do not run third-party analytics, advertising trackers or social-media pixels. There is no consent banner because there is nothing to consent to.
The daily brief
If you subscribe, we store your email address, the time you signed up, which page you signed up from, and whether you have confirmed. That is all. It is stored in our own database in the United Kingdom and is never shared, sold or used for anything other than sending the brief. Every email carries a one-click unsubscribe. When you unsubscribe we keep the address on a suppression list so we cannot accidentally re-add it; ask and we will delete it entirely.
Goods orders
To fulfil an order we need your name, delivery address, email and what you bought. Payment is taken by our payment provider; we never see or store your card number. Your address and order lines are passed to our print partner solely to make and ship your items. Order records are kept for six years because tax law requires it.
Accounts
An account is optional and holds your email, a password hash, your saved addresses and your order history. Delete it from the account page or by email; we remove everything except the order records the law requires.
Match alerts
If you turn on match alerts, your browser gives us an endpoint — a long web address belonging to your browser maker’s push service (Google, Apple, Mozilla or Microsoft) — and two keys we use to encrypt each message so only your device can read it. We store that, plus which alerts you asked for. We do not store your name, email, phone number, device model or location, and the endpoint tells us nothing about who you are. Alerts are sent from our own server; there is no notification company involved.
Turn them off at any time from the switch on the matchday page, and we delete the record outright — we do not keep a copy. If your browser tells us the endpoint is dead, we delete it straight away without being asked.
Cookies
Functional cookies only: a session cookie, a cart cookie and an admin cookie for staff. Details on the cookies page.
Your rights
Under UK GDPR you can ask for a copy of what we hold about you, ask us to correct it or delete it, and object to any processing. Email us; we reply within a month and usually within a day. You can also complain to the Information Commissioner’s Office.
Changes
If this notice changes in a way that matters, the date at the top changes and the brief will say so.