Privacy, terms & security

Privacy Policy

1. Who we are

SportsMatrix ("we", "us", "our") is a software development company that designs, builds and operates custom software for clients. This policy explains what personal data we collect through this website and our business dealings, why we collect it, and what rights you have over it.

For any privacy question, or to exercise any right described below, contact us at support@sportsmatrix.tech.

2. What we collect

We only collect what we need to respond to you and to run the business:

• Information you give us. When you submit the contact form we collect your name, email address, and optionally your company, industry, project type, budget range and the details you write in the message field.
• Correspondence. If you email us, we keep that exchange, including any attachments.
• Technical data. Our web server records standard access logs - IP address, request time, page requested, browser user agent and referring page. These logs are used for security and troubleshooting.
• Session data. The contact form sets a temporary session cookie so we can apply basic spam and rate-limiting protection, and so validation errors survive a page reload. It contains no personal data and expires with your browser session.

We do not use advertising cookies, tracking pixels, social media embeds, or third-party analytics on this site.

3. Why we use it

• To reply to your enquiry and, if it leads to work, to provide our services.
• To keep records of contracts and invoices where we are legally required to do so.
• To protect the site against spam, abuse and unauthorised access.
• To fix faults and understand which pages are used.

4. Our legal bases

Where the GDPR or UK GDPR applies, we rely on: legitimate interests to respond to a business enquiry you initiated and to secure our site; performance of a contract where you are a client; legal obligation for tax and accounting records; and consent where we have specifically asked for it. You may withdraw consent at any time.

5. Who we share it with

We do not sell, rent or trade your personal data. We share it only with service providers who help us operate, and only as far as necessary:

• Email and hosting providers who transmit and store our mail and serve this website.
• Professional advisers such as accountants, where required.
• Authorities, where we are legally compelled to disclose.

Where a provider processes data outside the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

6. How long we keep it

• Enquiries that do not lead to work: up to 24 months, then deleted.
• Client and contract records: for the duration of the relationship plus the period required by tax and company law.
• Server logs: typically 30 to 90 days.
• Contact form session data: discarded when your browser session ends.

7. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to processing, to receive it in a portable format, and to withdraw consent. Email us and we will respond within one month. If you are in the EEA or UK you also have the right to complain to your national data protection authority.

8. Security

This site is served over HTTPS. Access credentials are stored outside the public web directory and blocked from direct access, and only staff who need access to the enquiry inbox have it. Section 3 below sets out our broader engineering security practices.

9. Children

Our services are aimed at businesses. This website is not directed at children, and we do not knowingly collect personal data from anyone under 16.

10. Changes

We may update this policy. The "last updated" date above always reflects the current version, and material changes will be made clear on this page.

Terms of Service

1. Scope

These terms govern your use of this website. Work we carry out for a client is governed by a separate signed agreement or statement of work. Where those documents conflict with this page, the signed agreement takes precedence for that engagement.

2. Using this website

You may browse this site and contact us freely. You must not attempt to gain unauthorised access to any part of it, interfere with its normal operation, submit malicious code, or use the contact form to send spam or unlawful content.

3. Enquiries and quotations

Information on this site is for general guidance and does not constitute an offer. Any pricing, timeline or fixed-fee figure we provide is valid for 30 days from the date of the proposal unless it states otherwise, and becomes binding only once both parties sign.

4. Intellectual property

The design, text, code and graphics of this website belong to SportsMatrix unless stated otherwise. You may not reproduce them commercially without written permission.

For client projects, ownership of the deliverables - including source code and documentation - transfers to the client on final payment, except for our pre-existing tools, libraries and know-how, which remain ours and are licensed to you for use within the delivered system.

5. Fees and payment

Unless a proposal says otherwise, invoices are payable within 30 days. We may suspend work on overdue accounts. Fees are exclusive of VAT and any other applicable taxes, which are added where required by law.

6. Client responsibilities

We depend on you to provide timely access to systems, data, environments and decision-makers, and to ensure you have the right to share anything you give us. Delays in these areas may affect agreed timelines.

7. Warranty and support

We warrant that delivered work will materially conform to the agreed specification and will fix qualifying defects reported within 30 days of delivery at no charge. Ongoing support, monitoring and enhancements are provided under a separate support agreement.

8. Limitation of liability

To the fullest extent permitted by law, and except for death or personal injury caused by negligence, fraud, or anything else that cannot lawfully be limited, our total liability arising from an engagement is limited to the fees paid for the affected work. We are not liable for indirect or consequential loss, including lost profits, revenue, data or business opportunity.

9. Confidentiality

Each party will keep the other's confidential information secure and use it only for the purposes of the engagement. This obligation survives the end of the relationship.

10. Termination

Either party may terminate an engagement for material breach that remains unremedied 14 days after written notice. On termination you pay for work completed and costs committed up to that date, and we hand over completed deliverables.

11. Governing law

These terms are governed by the laws of the jurisdiction stated in your signed agreement. Where no agreement exists, the courts of our principal place of business have exclusive jurisdiction.

12. Changes

We may revise these terms. The version published on this page at the time you use the site is the version that applies.

Security

1. How this website is secured

• Traffic is served over HTTPS with modern TLS.
• Application code, credentials and logs are stored outside the web root, and direct HTTP access to those directories is refused at the server level.
• Credentials are kept in configuration files that are excluded from version control and carry an additional access guard.
• The contact form validates and sanitises all input, limits submission rates, and strips characters that could be used for header injection.
• Email is sent over authenticated, encrypted SMTP from our own domain, with SPF-aligned sender addresses so messages are not spoofed in transit.
• Security headers including X-Content-Type-Options, Referrer-Policy and X-Frame-Options are applied to every response.

2. How we build software

• Least privilege. Systems and people get the minimum access needed, reviewed periodically.
• Secrets management. Credentials are held in a secret store or encrypted environment configuration - never in source code.
• Dependency scanning. Third-party packages are checked for known vulnerabilities, and we patch on a defined schedule.
• Automated testing. Changes pass automated tests and code review before they can reach production.
• Audit logging. Authentication events and privileged actions are logged and retained, so activity can be traced.
• Encryption. Data is encrypted in transit, and at rest where the platform supports it.
• Backups. Regular backups with tested restore procedures, held separately from production.

3. Access to client data

Only engineers who need access to deliver or support your system have it, and access is removed when it is no longer required. We do not use client data for any purpose other than providing the agreed services, and we do not sell it or share it for marketing.

4. Incident response

If we become aware of a security incident affecting your data, we will investigate promptly, take steps to contain it, and notify you without undue delay along with what we know, what we have done, and what you should do. Where a legal notification obligation applies, we will meet it.

5. Reporting a vulnerability

If you believe you have found a security issue in this website or in software we maintain, please tell us at support@sportsmatrix.tech. Include enough detail to reproduce the issue, and please give us a reasonable opportunity to fix it before disclosing it publicly. We will acknowledge your report and keep you updated. We do not pursue legal action against researchers who act in good faith, avoid privacy violations and do not disrupt our services or those of our clients.