Privacy Policy

1. Who we are (the controller)

The data controller is ELITE LEGACY GROUP LTD, trading as Recruited.agency — a company registered in England and Wales, company number 16234309, registered office 128 City Road, London, EC1V 2NX, United Kingdom. For any privacy question or to exercise your rights, contact us at support@recruited.agency.

We are a UK company that serves families primarily in the United States. Your personal data is processed in the context of our UK establishment and is protected under UK data-protection law (UK GDPR and the Data Protection Act 2018).

2. Whose data we handle

• The parent or guardian (our client): the person who engages us and consents on the athlete's behalf.
• The athlete (the beneficiary): typically a minor, generally aged 14–18.
• People our athletes contact: college coaches receive outreach sent from the athlete's own accounts; we process the information needed to support that outreach.

3. What we collect

• Contact and account details — parent and athlete names, email addresses, phone/WhatsApp numbers, and mailing/billing details.
• Athlete profile — athletic information (sport, position, stats, video/highlights, achievements) and academic information (school, year, grades/test scores where relevant to targeting).
• Communications — messages between you and us, and outreach sent from and replies received in your athlete's own email and social accounts, which we access and process to run and coach the outreach.
• Target and outreach data — the college programs and coaches we research and contact on your athlete's behalf, and the status of those conversations.
• Payment information — handled by our payment processor; we do not store full card numbers.
• Website and technical data — basic server log data (such as IP address, browser type, and pages visited) generated when you visit our site.

4. Why we use it and our lawful bases

We use personal data to: deliver the service (intake, research, outreach, mentoring); communicate with you; issue invoices and take payment; keep records and meet legal obligations; and, only with a separate signed release, feature success stories in our marketing.

Our lawful bases under UK GDPR are principally: performance of a contract with the parent/guardian; consent (which the parent gives on the athlete's behalf, including for using the athlete's own accounts for outreach and for any marketing use of the athlete's name/image/likeness); legitimate interests in operating and improving the service; and legal obligation for records and compliance.

5. Minors' data and parental consent

Athletes are typically minors. The parent or legal guardian is our client and is the person who consents to our collection and use of the athlete's personal data, including the use of the athlete's own email and social accounts for coach outreach. We collect and process an athlete's data on the basis of that parental consent and our contract with the parent.

• We ask families to confirm the athlete's age at intake, and we treat the parent/guardian as the account holder and consent-giver.
• Our service and marketing are directed to parents and to athletes aged 14 and over; they are not directed to children under 13. We do not knowingly onboard an athlete under 13. If we learn we have collected data from a child under 13 without the parental consent that US COPPA requires, we will delete it or obtain the required verifiable parental consent.
• We will only use an athlete's name, image, likeness, or footage in our marketing under a separate written release signed by the parent/guardian, and a parent may withdraw that consent for future use.

6. Who we share it with (processors)

We share personal data with service providers who process it on our behalf, under contract and only as needed to run the service:

• Email and social outreach / messaging — providers that help us send and manage outreach from your athlete's own email and social accounts, and the underlying email and social platforms.
• Payment processing — our payment processor.
• Hosting, storage, and analytics — our website hosting, cloud-storage, and analytics providers.
• Professional advisers — accountants and lawyers, where necessary.

We do not sell personal data. We do not share athletes' data with third parties for their own marketing.

7. International transfers

We are a UK controller and some of our processors are based in the United States (for example, payment and communications providers). Where we send personal data from the UK to a country without UK "adequacy," we rely on an approved transfer mechanism (such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK–US data bridge where applicable).

8. How long we keep it

We keep personal data for as long as needed to provide the service and for a reasonable period afterward to meet legal, accounting, and dispute-handling needs, then delete or anonymize it.

9. Your rights

Subject to applicable law, you (and, through you, your athlete) may request access to, correction of, deletion of, or a copy of personal data; object to or restrict certain processing; and withdraw consent for processing that relies on consent (including a marketing release), without affecting processing already carried out. To exercise any right, contact support@recruited.agency. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk. Depending on where you live, you may have additional rights under your local law.

10. Security

We use reasonable technical and organizational measures to protect personal data. No system is perfectly secure, but we work to protect the information families entrust to us and limit access to those who need it to deliver the service.

11. Changes

We may update this policy; the current version is always the one posted here, with the effective date shown above.

← Back to home