Privacy policy

1. Who we are

Tekkers & Tactics, at tekkersandtactics.com, is run by FALLINGHIPPO LIMITED, which trades as FallingHippo. In this policy “we”, “us” and “our” mean that company. We decide why and how the personal data described here is used, which makes us its “controller” under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Company	FALLINGHIPPO LIMITED
Company number	17415391, registered in England and Wales
Registered office	71-75 Shelton Street, London, England, WC2H 9JQ
Privacy contact	privacy@fallinghippo.com
General contact	hello@fallinghippo.com
Data protection fee	Paid. Registration reference ZC264249 on the Information Commission’s register of fee payers

We haven’t appointed a data protection officer. The law only requires one for public bodies and for organisations whose core work involves large-scale monitoring of people or large-scale use of sensitive data, and we do neither. Privacy questions sent to the address above are read and answered by a person.

2. What this policy covers

This policy covers personal data we handle when you visit tekkersandtactics.com or any page on it, and when you email or write to us. It doesn’t cover other websites we link to, such as IFAB, England Football or the NSPCC, which have their own policies. Our other websites and apps have their own privacy policies too.

3. What we collect and where it comes from

When you visit the site

You don’t have to sign up or give us anything to use the site. When your browser asks for a page or a file, our web host, Cloudflare, automatically receives and logs some technical information, as any web server does. This usually includes:

• your IP address, which can show your approximate location (country or town, never your street);
• the date and time of the request and the page or file requested;
• your browser type and version, operating system and device type, as your browser reports them;
• the address of the page that linked you here, if your browser shares it;
• security information, such as whether a request looks like it comes from an automated attack.

We don’t combine this with anything else to work out who you are. We don’t download, copy or keep these logs ourselves, and we don’t use them to follow what individual visitors do. Some browsers also send Cloudflare a short report if a page fails to load because of a network fault. These reports go to Cloudflare, not to us, and we don’t use them.

The session planner and the weekly practice plan

When you choose an age group, a number of players, a length of session or a theme in the planner, or an age, days and kit in the weekly plan, the page builds the plan inside your browser. Your choices are written into the page address (for example ?age=9&n=12) so that you can bookmark, print or share the plan. They are not sent to us as data and nothing about them is stored on our side. As with any web address, if you load or share that address, the address itself reaches Cloudflare as part of the request described above. The choices are general settings, not information about any person. Please don’t type names into the page address.

The skill check

If you record your scores on the skill check, they are saved in your browser’s local storage on that device, so that you can see your progress next time. They are never sent to us and we can’t see them. You can delete them at any time with the “Delete all my scores” button, or by clearing this site’s data in your browser.

The motion setting

If you use the Motion button at the top of the page, your choice is remembered in your browser’s local storage so that the next page you open respects it. It is a single word, “on” or “off”, and it never leaves your device.

When you email or write to us

We receive your email address, your name if your email shows it, what you write, any attachments, and the technical details that come with any email. If you write by post, we receive your name and address and what you write. We only get what you choose to send. Please don’t send us details about a child, or sensitive information such as health details. If you have a safeguarding concern about a child, contact your Club Welfare Officer, the NSPCC or, in an emergency, 999, not us.

What we don’t collect

There are no accounts, comments, forms that send data to us, newsletters, uploads, leaderboards or ways to message other visitors. We don’t use analytics, advertising, social media buttons, embedded videos or fingerprinting. We don’t collect sensitive (“special category”) data or information about criminal convictions, and we don’t buy personal data from anyone. Our fonts, images and scripts are all served from tekkersandtactics.com, so loading a page doesn’t send your details to Google or any other company.

4. How we use it and our lawful basis

What we do	Data used	Lawful basis	How long
Deliver pages and files to your browser	Server log data	Legitimate interests: running a website that works	Handled by Cloudflare for as long as it needs, then deleted (see section 9). We keep none.
Protect the site from attacks, and investigate faults	Server log data, network error reports	Legitimate interests: keeping the site and its visitors safe	As above
Read and reply to your emails and letters	Contact details, message content, attachments	Legitimate interests: answering people who contact us	Up to 24 months after our last exchange
Look into corrections and feedback	Contact details, what you tell us	Legitimate interests: keeping the site accurate	Up to 24 months after our last exchange
Handle privacy requests and complaints	Your contact details, the request and our reply	Legal obligation	2 years after we close the request, or longer if a related claim is open
Establish, bring or defend legal claims	Any of the above that is relevant	Legitimate interests: protecting our legal rights	Until the claim, and any appeal, is finished
Comply with a court order or a lawful request from a regulator or the police	Only what is required	Legal obligation	As long as the law requires

You don’t have to give us any personal data to use this site. We don’t use your data for any purpose that isn’t in this table. If we ever want to, we’ll update this policy first and ask for your consent where the law requires it.

Where we rely on legitimate interests, we have checked that the use is necessary and isn’t outweighed by your interests and rights. The data is limited and short-lived, and isn’t used to identify or profile anyone. Protecting the security of networks and systems is one of the “recognised legitimate interests” in the Data (Use and Access) Act 2025. You can object to any of these uses (see section 10).

What the site keeps on your own device is covered by the Privacy and Electronic Communications Regulations 2003 rather than by a lawful basis under the UK GDPR. The cookies and storage page explains it.

5. Cookies

Tekkers & Tactics sets no cookies. It keeps at most two small things in your browser, both described on the cookies and storage page: your motion setting, and your skill check scores if you choose to record them. Neither is used for advertising or tracking, and neither is sent to us. That is why there is no cookie banner.

6. Marketing

We don’t have a mailing list for this site and we don’t send marketing emails. If you email us, we won’t add you to a list.

7. Who we share it with

We don’t sell personal data, rent it or share it with advertisers. We share it only in these situations.

Company	What they do for us	Contract and safeguards
Cloudflare, Inc. (United States)	Hosts and delivers the website, protects it from attacks and keeps the server logs	Cloudflare customer data processing agreement
Google (Google Workspace)	Runs our email	Google Cloud data processing addendum

These companies act as our processors. They may only use personal data on our instructions, under written terms that meet Article 28 of the UK GDPR.

We may also share relevant information with our accountants, lawyers and insurers where they need it to advise us. We’ll disclose personal data to the police, a court or a regulator if the law requires it, or where it is necessary to protect someone’s safety, and we check that each request is lawful. If we sell or transfer the business, personal data may pass to the new owner, who would have to use it in line with this policy.

8. Data sent outside the UK

Cloudflare and Google are based in the United States and can process data there and in other countries. For the United States, both take part in the UK Extension to the EU-US Data Privacy Framework, which the UK recognises as giving adequate protection to data sent to certified companies. Both companies’ data processing terms also include standard contractual clauses with the UK’s International Data Transfer Addendum, which apply where the Data Privacy Framework doesn’t. Email us if you’d like more detail.

9. How long we keep it

We keep personal data only for as long as we need it. The table in section 4 gives the period for each use. When it ends, we delete the data or anonymise it. Cloudflare doesn’t publish a fixed retention period for the logs it keeps when serving a customer’s site. Its privacy policy says it keeps personal information for a period consistent with its business purposes and then deletes it.

10. Your rights

The UK GDPR gives you these rights over your personal data. Some only apply in certain situations, and we’ll explain if one doesn’t apply to your request.

Your right	What it means
To be informed	To be told clearly how your data is used. This policy is how we do that.
Of access	To get a copy of your data and the other information in this policy.
To rectification	To have inaccurate data corrected.
To erasure	To have your data deleted, unless we must keep it by law or for a legal claim.
To restrict processing	To have us store your data but not otherwise use it, for example while we check it.
To data portability	To receive data you gave us in a machine-readable format, where the law gives this right.
To object	To object to processing based on legitimate interests. We must stop unless we have compelling grounds or need it for a legal claim.
About automated decisions	Not to be subject to significant decisions made by computer alone. We don’t make any.
To complain	To complain to us, and to the Information Commission (see section 13).

For what is kept on your device, you don’t need to ask us: the “Delete all my scores” button, or your browser’s own controls, remove it immediately.

To use a right, email privacy@fallinghippo.com with “Privacy request” in the subject, or write to our registered office. You don’t need a form or particular words. We may ask for what we need to confirm it’s you. We’ll reply without undue delay and within one month, which we can extend by up to two months for complex requests if we tell you why within the first month. It is free, unless a request is clearly unfounded or excessive.

11. How we keep it safe

The site is served only over HTTPS. It has no third-party scripts and a strict content security policy, so no other company’s code runs on its pages. Access to our mailboxes and accounts is limited to the people who need it, and passwords are kept in a password manager. The surest protection is that we collect almost nothing.

If a security breach led to personal data being lost or disclosed, we would assess it straight away, report it to the Information Commission within 72 hours where the law requires, and tell you directly if you were at high risk. If you think you’ve found a security problem with the site, please tell us at hello@fallinghippo.com.

12. Children

Many of the people who use the Play pages will be children, and many coaches using the Coach pages work with children. The site is built to need nothing from either. There are no accounts, no adverts, no tracking and no way to talk to other visitors, and nothing a child records in the skill check leaves their device. We have followed the ICO’s Age-Appropriate Design Code (the “Children’s code”) in building it: we collect as little as we can, we don’t profile anyone, we don’t show leaderboards or streaks, and we don’t use nudges to keep people on the site.

If you are under 13, please ask a parent or carer before you email us. If you’re a parent or carer and believe a child has sent us personal data, email us and we’ll delete it.

13. Complaints

If you’re unhappy with how we’ve handled your personal data, please tell us first so we can try to put it right: email privacy@fallinghippo.com with “Complaint” in the subject. We’ll acknowledge it within 30 days, look into it without undue delay and tell you the outcome.

You also have the right to complain to the Information Commission, which regulates data protection in the UK. It took over from the Information Commissioner’s Office (ICO) on 30 September 2026 and still uses the ICO website. Complain at ico.org.uk/make-a-complaint, or call its helpline on 0303 123 1113. It will usually expect you to have raised the matter with us first. You can also go to court if you believe your rights have been breached.

14. Changes to this policy

We review this policy at least once a year and whenever we change how the site handles personal data. If we make a change, we’ll update this page before it takes effect and change the date at the top.

• 11 November 2026. First version.

15. Contact us

For anything about this policy or your personal data, email privacy@fallinghippo.com. For anything else, email hello@fallinghippo.com. You can also write to FALLINGHIPPO LIMITED, 71-75 Shelton Street, London, England, WC2H 9JQ. That is our registered office address, so email is quicker.