Privacy Policy

This Privacy Policy explains how KICKWISE LTD, trading as Kickwise (“Kickwise”, “we”, “our”, or “us”), processes personal data when you visit, register for, or use the Kickwise platform, contact us, or interact with our recruitment and related services.

KICKWISE LTD is the controller of personal data for the processing activities described in this Policy unless another controller is expressly identified.

• Company: KICKWISE LTD

• Registered in: England and Wales

• Company number: 17430326

• Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

• Website: https://kickwise.net

• Privacy contact: privacy@kickwise.co.uk

Our processing is governed, where applicable, by the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, as amended, including by the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR). The EU General Data Protection Regulation (“EU GDPR”) may also apply to particular processing activities involving people in the European Economic Area (“EEA”). Other national or regional privacy and data-protection laws may apply to particular processing depending on the people, services and jurisdictions involved.

This Policy applies to candidates, football players, employers, clubs, academies, federations, leagues, organisation representatives, website visitors, contributors, and people who contact our support or other communication channels.

Depending on how you use Kickwise, we may collect the following categories of personal data:

• Account data: name, email address, authentication information, account type, preferred language, settings, and account status.

• Social sign-in data: where you choose Google, LinkedIn, or another supported sign-in provider, identifiers and profile information made available by that provider in accordance with your settings and permissions.

• Profile and career data: biography, location, work history, football roles or positions, qualifications, skills, CVs, certificates, portfolio materials, images, videos, and other professional information you choose to provide.

• Employer and organisation data: organisation name and details, professional contact information, job listings, logos, verification information, organisation profiles, and recruitment-related content.

• Application and communication data: applications submitted through Kickwise, supporting documents, saved or shortlisted activity where available, messages, notifications, correspondence, and support requests.

• Payment and transaction data: purchased credits or packages, transaction and payment references, amounts and currency, billing details, payment status, invoices, refunds, chargebacks or disputes, and limited payment-method information made available by our payment provider. Payment credentials entered in Stripe-hosted or Stripe-powered checkout fields are provided directly to Stripe; Kickwise does not store full card numbers or card verification values.

• Technical and usage data: IP address, browser and device information, operating system, language, pages viewed, referral information, approximate location derived from technical data where applicable, security logs, fraud and abuse-prevention signals, timestamps, cookie and consent choices, and interaction data.

• Marketing and preference data: newsletter choices, communication preferences, consent records, and information about engagement with communications where legally permitted.

• Public and third-party data: professional information supplied by service providers, employers, organisations, payment processors, analytics or advertising providers, or obtained from publicly accessible professional sources where lawful.

Please do not provide personal data that is unnecessary for the service you are using.

We may obtain personal data:

• directly from you when you create an account, complete a profile, apply for a role, contact support, communicate with another user, make a purchase, or change your settings;

• automatically from your use of the website or platform, including through essential logs, cookies, or similar technologies;

• from supported authentication providers such as Google or LinkedIn when you choose to use social sign-in;

• from employers, clubs, organisations, or other users when they interact with you or provide information necessary to use the service;

• from payment providers such as Stripe and from hosting, network, security and analytics providers such as Cloudflare, as well as consent-management, email, advertising and other service providers; and

• from public professional sources, such as official club or organisation websites, careers pages, public job advertisements, public professional profiles, federation or league websites, and other publicly accessible recruitment sources where lawful.

Where we obtain personal data from a source other than the person concerned, we provide the information required by applicable data protection law within the required timeframe unless a lawful exception applies.

We only process personal data where we have a lawful basis. The basis depends on the purpose and circumstances.

• Accounts, profiles, platform functions and requested services: to create and manage accounts, profiles, listings, messages, applications and support. We generally rely on performance of a contract or steps requested before entering into a contract.

• Recruitment and applications: to enable candidates and employers to find opportunities, communicate and manage applications. We generally rely on contract or pre-contract steps and, where appropriate, our legitimate interests in operating a reliable recruitment platform.

• Employer and organisation verification: to review organisations, listings and professional information. We generally rely on legitimate interests in platform integrity, fraud prevention and user trust.

• Payments, credits, invoicing and refunds: to process purchases, apply purchased credits to your account or enable paid features, handle refunds, payment disputes and chargebacks, prevent payment fraud, and maintain financial records. We rely on contract and, where relevant, legal obligations and legitimate interests relating to accounting, tax, fraud prevention, dispute handling and record keeping.

• Security, abuse prevention and moderation: to authenticate users, protect forms and accounts, distinguish legitimate traffic from automated abuse, detect misuse, prevent fraud, investigate security events, enforce our terms and protect users. We generally rely on legitimate interests and, where relevant, legal obligations.

• Service communications: to send account, application, security, transaction, support or policy messages that are necessary to operate the service. We generally rely on contract, legitimate interests or legal obligations.

• Analytics and service improvement: to understand website and platform performance and improve the service, including through privacy-focused analytics such as Cloudflare Web Analytics. We rely on consent where required for storage or access technologies; where the law permits a consent exemption for limited statistical or functional technologies, we may rely on that exemption together with an appropriate UK GDPR lawful basis such as legitimate interests.

• Advertising: to display, measure or personalise advertising where enabled. We obtain consent where required for advertising cookies, similar technologies, or personalised advertising.

• Marketing: to send newsletters or promotional communications where you have asked to receive them, or where another lawful basis is available and electronic-marketing rules permit it. You can opt out at any time.

• Legal compliance and claims: to comply with law, regulatory requirements, lawful requests, audits, and to establish, exercise or defend legal claims. We rely on legal obligations and/or legitimate interests as appropriate.

• Public professional and recruitment information: to identify relevant football organisations, vacancies, or professional contacts and to support recruitment outreach and platform operations. We rely on legitimate interests, subject to necessity, fairness, reasonable expectations and applicable transparency requirements.

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

Where we rely on legitimate interests, those interests may include:

• operating and improving a specialist football recruitment and career platform;

• keeping the platform, users, accounts and systems secure;

• preventing fraud, payment abuse, chargebacks, spam, fake listings and other misuse;

• verifying employers and organisations and maintaining the quality of listings;

• responding to users and providing effective support;

• understanding service performance in a proportionate way;

• protecting our legal rights and enforcing our terms; and

• identifying publicly available professional recruitment information that is reasonably relevant to Kickwise services.

We consider whether the processing is necessary and balance our interests against the rights, interests, expectations and freedoms of the people affected. You may have a right to object to processing based on legitimate interests; see Your Right to Object below.

Kickwise may support more than one application route.

Applications through Kickwise: if you submit an application through Kickwise, the relevant employer or organisation may receive the application information and documents you choose to submit. The employer may act as an independent data controller for its own recruitment activities and may have its own privacy notice and retention rules.

Applications on an external website: some job listings direct you to the employer’s own website, email address, applicant-tracking system, or another external service. In those cases, the external organisation receives the information you submit there under its own privacy terms. Kickwise does not receive the contents of an external application merely because you followed an external application link, although we may process limited technical interaction data about the referral where lawful.

Employers are responsible for using applicant information lawfully and only for appropriate recruitment purposes.

If you choose to sign in using Google, LinkedIn, or another supported provider, that provider authenticates you and may send Kickwise information such as your name, email address, account identifier, profile image, or other information you have authorised it to share.

The provider processes information under its own privacy terms. Kickwise only uses information received from a sign-in provider for the purposes described in this Policy and according to the permissions associated with the connection.

Kickwise uses Stripe to process certain payments for employer credits, job listings, and other paid platform features. When you enter payment details through Stripe-hosted or Stripe-powered checkout, those payment details are provided directly to Stripe rather than stored by Kickwise. Depending on the payment method and integration, Stripe may process your name, email address, billing address, payment-method details, IP address, browser or device information, transaction details, and fraud or risk signals.

Kickwise may receive and retain limited payment information returned by Stripe, such as transaction and payment identifiers, amount and currency, billing details, payment status, refund or chargeback information, and records of credits or packages purchased. We do not store full card numbers or card verification values when Stripe handles those details directly.

Depending on the processing activity, Stripe may act as a processor or service provider on our behalf and may also act as an independent controller for certain activities, including fraud prevention, regulatory compliance, payment-network requirements, and the operation and improvement of its services. Stripe may share data with banks, card networks, payment-method providers, affiliates, and service providers where necessary to process or secure a transaction.

We process payment and financial records as necessary to perform our contract with you, provide purchased services, handle refunds or disputes, prevent fraud and abuse, comply with accounting and tax obligations, and establish, exercise or defend legal claims.

More information about Stripe's handling of personal data is available in the Stripe Privacy Policy.

Where permitted, we may send newsletters, platform news, product information, recruitment-related updates, or other marketing communications.

You can unsubscribe from marketing email by using the unsubscribe mechanism provided in the message or by contacting us. Withdrawing from marketing does not prevent us from sending necessary service messages, such as security notices, application-related messages, purchase confirmations, support responses, or important changes to our legal terms and policies.

We do not use consent for one purpose as permission for unrelated marketing.

Kickwise uses cookies and similar storage or access technologies for essential functions, security, preferences, consent records and, where enabled, analytics and advertising. More detail is provided in our Cookie Policy and consent-management interface.

We use Cloudflare for network delivery, performance and security services, which may include CDN, DNS, DDoS protection, web-application security and related traffic protection. In providing these services, Cloudflare may process IP addresses, request and connection metadata, browser or device information, and security signals needed to route traffic, detect abuse and protect Kickwise.

We use Cloudflare Turnstile on selected forms or flows to distinguish legitimate users from automated traffic and reduce spam and abuse. Turnstile may process signals such as IP address, browser or device characteristics, connection information, site key and origin, and related security signals. Cloudflare states that, for this security function, Turnstile does not access, store or transmit form entries, user communications or other page inputs. Depending on the configuration, strictly necessary cookies or browser storage may be used. Where applicable law permits, strictly necessary security processing may operate without consent because it is required to protect the service.

We also use Cloudflare Web Analytics for privacy-focused, aggregate measurement of website usage and performance. Cloudflare states that Web Analytics does not collect or use visitors' personal data. We use these aggregate insights to understand traffic and performance and to improve the service.

Kickwise may use Google AdSense and related Google advertising services. Google and other third-party vendors may use cookies or similar technologies to serve, limit, measure or personalise advertising where legally permitted.

Where consent is required, advertising cookies, personalised advertising and other non-essential storage or access technologies are not activated until a valid choice has been obtained through the consent-management mechanism used on Kickwise. Strictly necessary security technologies, and limited analytics technologies that qualify for a lawful consent exemption, may operate without consent where applicable law permits. Refusing non-essential cookies does not prevent access to core platform functions that do not require them.

You can review or change available choices through the Privacy and cookie settings control on Kickwise.

• Cloudflare Privacy Policy

• Cloudflare Turnstile Privacy Addendum

• Google Ads Settings

• Google Privacy Policy

We do not sell personal data. We may disclose personal data only where necessary and lawful, including:

• to employers, clubs, academies, federations, leagues, or other organisations when you apply, communicate, or intentionally make relevant information available;

• to candidates or users when an employer or organisation publishes recruitment or professional information through Kickwise;

• to Stripe and, where necessary for payment processing, relevant banks, card networks or payment-method providers, so that purchases, refunds, disputes, fraud checks and related payment functions can be handled;

• to Cloudflare where personal data is processed to provide network delivery, security, DDoS or application protection, or Turnstile bot-protection services;

• to service providers that support hosting, infrastructure, email, authentication, consent management, advertising, support, backups, or technical operations;

• to professional advisers such as accountants, auditors, insurers, lawyers or consultants where necessary;

• to courts, regulators, law-enforcement bodies, tax authorities or other public authorities where disclosure is required or legally justified; and

• in connection with a financing, merger, restructuring, acquisition, sale, insolvency process or transfer of all or part of the business, subject to appropriate confidentiality and data-protection safeguards.

Service providers acting as processors are required to handle personal data only for authorised purposes and under appropriate contractual and security requirements. As explained above, Stripe and Cloudflare may also act as independent controllers for certain processing activities carried out for their own legal, security or service-improvement purposes.

Kickwise is established in the United Kingdom and works with users and service providers internationally. Personal data may therefore be processed outside the country in which it was collected.

Some providers we use, including Stripe and Cloudflare, operate internationally and may process data in more than one country. The location and legal role of a provider can depend on the service, payment method and user location. Where Kickwise is responsible for an international transfer, we apply the safeguards required by applicable data-protection law.

Where the UK GDPR applies, we use lawful transfer mechanisms when personal data is transferred to a country that is not covered by applicable UK adequacy regulations. Depending on the circumstances, these may include approved contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with any required transfer-risk assessment or other safeguard.

Where the EU GDPR applies, transfers outside the EEA are made using an applicable adequacy decision or another lawful transfer mechanism, such as approved Standard Contractual Clauses, where required.

The European Commission has adopted an adequacy decision allowing personal data covered by the EU GDPR to flow to the United Kingdom subject to that decision. Transfers from the UK to other countries are assessed separately under UK law.

Where legally required, you may contact us to request further information about the relevant transfer safeguards and how to obtain a copy.

We keep personal data only for as long as it is reasonably necessary for the purpose for which it is processed, taking account of the nature of the data, account status, user choices, contractual requirements, security needs, disputes, limitation periods and legal obligations.

In general:

• account, profile, application and communication data is kept while needed to provide the relevant service and for a reasonable period afterwards where necessary for security, disputes, legal claims or compliance;

• information that you delete or that is removed from active use may remain temporarily in restricted backups or security logs until those systems are overwritten or the applicable retention period expires;

• consent and preference records may be retained for as long as necessary to demonstrate and respect your choices;

• fraud-prevention, abuse and security records may be kept for a proportionate period where needed to protect the platform and users; and

• company accounting and financial records are retained for the period required by UK law. Certain company accounting records must generally be kept for six years from the end of the financial year to which they relate, and longer in some circumstances.

When personal data is no longer required, we delete it, anonymise it, or restrict it from normal use where appropriate.

Kickwise does not generally require users to provide sensitive information such as health information, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership, genetic or biometric data used for identification, or information about sex life or sexual orientation.

A CV, application or message may nevertheless contain sensitive information if a user chooses to include it. Where we process special category data, we do so only where an applicable legal condition is available in addition to an Article 6 lawful basis.

We do not ask users to upload criminal-conviction or criminal-offence information unless there is a specific lawful and necessary reason to do so. Users should avoid uploading sensitive or criminal-record information that is not required for the relevant recruitment process.

Kickwise may use automated tools to support functions such as search, ordering, recommendations, fraud detection, spam prevention, security or content moderation.

Kickwise does not currently make solely automated hiring or rejection decisions about candidates that produce legal or similarly significant effects without meaningful human involvement. Employers remain responsible for their own recruitment decisions.

If we introduce significant solely automated decision-making that is subject to additional legal safeguards, we will provide the information and protections required by applicable law, including any applicable rights to obtain human intervention, make representations or contest a decision.

We use proportionate technical and organisational measures intended to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, access, misuse or other unlawful processing.

Measures may include, where appropriate, access controls, authentication, encryption in transit, secure configuration, logging, backups, monitoring, least-privilege access and procedures for responding to security incidents.

No online service can guarantee absolute security. Users are responsible for protecting their credentials and should notify us if they believe their account or personal data has been compromised.

Kickwise is intended for users aged 18 or over. We do not knowingly permit individuals under 18 to create or use a Kickwise account.

References on Kickwise to academies, youth football, or roles involving young players do not mean that the platform is directed to children. Such listings and professional content are intended for adult professionals and organisations working in football.

If we become aware that personal data has been collected directly from a person under 18 in a way that is inconsistent with this rule, we will take reasonable steps to restrict or delete the account and related personal data as appropriate and as required by law. If you believe a person under 18 has provided personal data to Kickwise, please contact privacy@kickwise.co.uk.

Employers and organisations remain independently responsible for safeguarding, employment, recruitment and data-protection obligations that apply when their work involves children or young people.

Subject to applicable law and any lawful exemptions, you may have the right to:

• be informed about how your personal data is used;

• request access to personal data we hold about you;

• request correction of inaccurate or incomplete personal data;

• request deletion of personal data in certain circumstances;

• request restriction of processing in certain circumstances;

• receive certain personal data in a portable format and, where applicable, ask for it to be transferred to another controller;

• withdraw consent at any time where processing is based on consent;

• object to certain processing, including direct marketing and certain processing based on legitimate interests; and

• exercise applicable safeguards relating to significant automated decision-making.

You will not normally have to pay a fee to exercise a data-protection right. We may request information reasonably necessary to verify your identity or authority to act for another person. We respond within the timeframe required by applicable law and may extend that period where the law permits and the request is sufficiently complex or numerous.

To exercise a right, contact privacy@kickwise.co.uk.

You have the right to object at any time to the processing of your personal data for direct marketing. If you object to direct marketing, we will stop using your personal data for that purpose.

You may also object to processing based on legitimate interests in circumstances provided by law. In that case, we will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

You can object by contacting privacy@kickwise.co.uk.

If you believe we have handled your personal data incorrectly or infringed your data-protection rights, you may make a data protection complaint directly to Kickwise. You can do so by emailing privacy@kickwise.co.uk and stating that your message is a data protection complaint. You may also raise a complaint through another contact channel available to you; we will accept data-protection complaints regardless of the channel through which they reach us.

For complaints falling within the UK data-protection complaints regime, we will:

• acknowledge receipt within 30 days;

• take appropriate steps to investigate the complaint without undue delay;

• keep you informed about progress without undue delay; and

• communicate the outcome without undue delay.

If you are dissatisfied with our response, or otherwise wish to complain to the UK supervisory authority, you have the right to contact the Information Commissioner’s Office (ICO):

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom
Telephone: 0303 123 1113
https://ico.org.uk/make-a-complaint/

If the EU GDPR applies to the relevant processing, you may also have the right to complain to the competent data-protection supervisory authority in the EEA country where you live, work, or where you believe an infringement occurred.

KICKWISE LTD is established in the United Kingdom. Where we offer services to people in the EEA or carry out other processing that falls within the territorial scope of the EU GDPR, we comply with the EU GDPR for that processing.

Where Article 27 of the EU GDPR requires KICKWISE LTD to designate a representative in the European Union, the representative must be formally appointed in writing. We will publish the representative’s identity and contact details in this Policy and at appropriate data-collection points once that appointment is in place. Until such details are published, you may contact KICKWISE LTD directly using the contact details in this Policy for any EU GDPR request or complaint.

Nothing in this section limits your right to contact a competent EEA supervisory authority.

We may update this Privacy Policy when our services, technology, providers, business structure, processing activities or legal obligations change.

Where a change materially affects how we use personal data or the rights of users, we will take reasonable steps to bring the change to the attention of affected users before the new use begins where required by law.

The latest version will be published on Kickwise with an updated version number and “Last Updated” date.

For privacy questions, rights requests, consent withdrawal, objections, or data-protection complaints, contact:

KICKWISE LTD
71-75 Shelton Street
Covent Garden
London
WC2H 9JQ
United Kingdom

• Email: privacy@kickwise.co.uk

• Website: https://kickwise.net