MATCHSPACE LTD
Company-wide policy including LTA API and World Tennis Number (WTN) integration
Version 1.0 | 21 October 2026 | Policy owner: Matchspace Ltd directors
The directors, Charles Morris and Ian Edwards, retain overall responsibility for this policy, including decisions on safeguarding escalation, access to personal information, and appropriate organisational and technical protection. Clubs retain responsibility for safeguarding their own tennis activities, coaches, events and physical venues. Matchspace is responsible for the safeguards within its digital service and for referring concerns that come to its attention. Reports can be made to hello@matchspace.co, marked “Safeguarding – confidential”, and will be directed to a director. Matchspace will restrict circulation of such reports to persons who need to act on them.
Matchspace processes account and contact details, usernames, club affiliation, competition entries, fixtures, availability, match scores, rankings and tennis identifiers. Its existing privacy notice also describes payment administration through Stripe, application and device information, usage and security logs, and optional notifications. Matchspace may process LTA player identifiers and World Tennis Number information in connection with its authorised LTA integration. Matchspace does not treat a player's competition history as a basis to publish private contact information. Payment information is subject to the payment provider's controls and applicable terms.
Matchspace processes personal information to create and maintain accounts, deliver club competitions, record results, support relevant player rankings, provide customer support, protect service security and meet legal obligations. Depending on the activity, the applicable lawful basis is performance of a contract, legitimate interests, legal obligation or consent. Matchspace gives additional weight to children's rights when assessing legitimate interests. It does not rely on blanket parental consent as the basis for all processing of junior information. Individuals are informed of relevant processing through Matchspace's privacy information and service communications.
Matchspace shares personal information only where needed for the service, including with the relevant club, authorised service providers, payment processors and the LTA for approved integration purposes. Match results for junior and adult players may appear on publicly accessible pages, showing player names and results only. Contact details, account information and other private personal details are not displayed as part of public match results. Matchspace does not sell personal player information. Service providers and developers are granted access only as necessary for authorised work.
Matchspace uses Microsoft Azure cloud hosting, a .NET backend and a React Native mobile application. Matchspace's security policy is to protect data in transit, restrict access to systems and personal information according to role, protect administrator and developer credentials, safeguard API secrets, apply security updates, maintain suitable backup and recovery arrangements, and respond to suspected misuse. Application permissions must enforce the club-level restrictions on junior results. Production access is limited to authorised persons carrying out company work. Security measures are reviewed as the service develops; no representation is made that every optional Azure security product is deployed.
Matchspace retains information for as long as required for account administration, competitions, lawful historical results, dispute resolution, security and legal obligations. Account closure does not necessarily remove a result from a legitimate competition record. Personal data that is no longer needed is deleted or anonymised, subject to lawful retention requirements and backup cycles. Individuals may request access, correction, erasure, restriction or objection where the law provides those rights, by emailing hello@matchspace.co. Matchspace will respond within applicable legal time limits. A safeguarding record is held with more restricted access than ordinary competition data.
Suspected unauthorised access, loss of data, inappropriate publication of junior information or other security incidents must be escalated promptly to the directors. Matchspace will contain the incident, establish the facts, record its decisions and notify affected parties and authorities when required. Reportable personal data breaches will be notified to the ICO without undue delay and, where feasible, within 72 hours of awareness. Individuals will be notified where required by the level of risk. Contractual notification obligations to the LTA also apply to incidents affecting LTA data.
This policy applies specifically to the connection between Matchspace Ltd and the Lawn Tennis Association (LTA) for the submission of tennis match results and retrieval of World Tennis Number (WTN) and related authorised player information. It supplements the Matchspace-wide Safeguarding, Privacy and Data Protection Policy and governs Matchspace's use of the integration.
Information submitted or retrieved may include an LTA or other authorised player identifier, player name or matching attributes required to identify the correct record, match date, match format, match score, opponent information, and WTN or other information made available for the authorised purpose. Matchspace limits exchanges to fields necessary for the requested function and does not seek unrelated personal information through the API.
A player or authorised competition administrator records or confirms a match within Matchspace. The Matchspace backend prepares the relevant submission, communicates with the LTA's approved interface and processes the resulting acknowledgement or data response. Retrieved WTN information is associated with the appropriate player record for authorised display and use. Matchspace is responsible for its application, its handling of information within Matchspace and the accuracy of data submitted from its service. The LTA remains responsible for its own systems and processing. The allocation of controller and processor obligations follows applicable law and the parties' agreement.
Submission of a match result is a competition function, not an unrestricted right of every account holder. Matchspace applies its competition administration permissions to result entry and submission. Matchspace seeks to associate each submission with the correct player and competition, avoid unintended duplicate submissions, and support correction of mistakes through the facilities made available by the LTA. Matchspace does not knowingly submit fabricated results or use the integration to impersonate players.
Matchspace is hosted on Microsoft Azure, with .NET backend services and a React Native application. The integration is operated as an application service, with protection of connection credentials, encrypted communications, controlled backend access and restricted disclosure of retrieved data. LTA credentials are confidential and are not intended for disclosure to end users. Matchspace limits access to integration administration to authorised personnel and takes reasonable steps to prevent unauthorised requests, bulk extraction and inappropriate exposure of junior records.
Matchspace may retain its own competition records and player history for legitimate service purposes, subject to data protection law. Information retrieved from the LTA is used and retained only as authorised by the LTA agreement and applicable law. Matchspace will not treat an API response as permission for unrestricted onward sharing. If access to the integration ends, Matchspace will stop accessing the LTA interface and deal with LTA-derived information according to the applicable agreement, while distinguishing it from independently collected competition records.
An incident involving LTA credentials, player identifiers, match records, WTN information or junior player privacy will be investigated promptly by Matchspace. Matchspace will preserve relevant evidence, restrict compromised access and notify the LTA where required under the agreement. Personal data breaches will be assessed under UK GDPR, including ICO and individual notification where legally required. Safeguarding concerns are referred through the process in the Matchspace-wide policy, including to the LTA Safeguarding Team or statutory agencies where appropriate.
The directors, Charles Morris and Ian Edwards, oversee Matchspace's use of the LTA integration and its compliance with this policy. The integration is subject to Matchspace's general privacy, safeguarding and security obligations, the LTA API agreement and applicable UK data protection law. This policy is reviewed annually and when the integration or its permitted purposes change.
Contact: hello@matchspace.co | www.matchspace.co
