Information Security Statement

Commitment to information security

FASE Global Ltd is a technology-led organisational management business for professional football and sport, bringing together Technology + Framework + Expertise. Responsible handling of information supports our work and the trust placed in us.

Our approach is to protect confidentiality, integrity and availability: limiting inappropriate disclosure, protecting information from unauthorised alteration, and considering access and recovery needs. Security measures should be proportionate to the nature of the information, how it is used and the risks to people and organisations.

This statement describes the current website’s implemented safeguards and the approach that needs to inform our wider operations. It is not an independent security assessment, certification or declaration of legal compliance. No system can guarantee absolute protection against unauthorised access, loss, misuse, disclosure or interruption.

Scope and responsible information handling

This statement concerns the FASE public website, its administrator publishing functions and related business enquiries. Relevant information includes business and club contact details, correspondence, and organisational, governance or environmental-management documents shared in connection with an enquiry or separately agreed work.

The website’s Contact form stores contact details and messages in a private administrator inbox. It does not accept file uploads. Do not place confidential club evidence or unnecessary personal information in public comments. Before sharing sensitive documents, contact us to agree an appropriate method and scope of handling.

The website processes administrator account information, Insights publications and uploaded publication images or reports, moderated visitor comments and browser-based article likes. It does not currently provide a checkout or process payment-card details through a website payment feature. Please do not email payment-card details.

The future FASE Clarity and client technology platform is not automatically covered by this website statement. Client evidence processing, access arrangements, security requirements and contractual terms must be separately assessed and agreed before those services are deployed.

Our Privacy Policy explains personal-information handling and your rights. Our Cookies notice describes browser storage.

Current website safeguards

Access and publishing

Administrator sign-in uses the website’s authentication service. A registered account does not itself grant publishing or moderation permission: a separately assigned administrator role is required. Application and data-access rules restrict publication management and moderation to authorised administrators.

Public article pages retrieve published publications only. Draft previews require administrator access. Publication files are held in restricted cloud storage and delivered through signed links under the applicable access rules. A signed link can be used by someone who has it while it remains valid; it is not a guarantee against copying or onward sharing of published material.

Business enquiries

Enquiries are validated on the server before storage. Data-access rules restrict inbox reading to authorised administrators; visitors cannot read stored enquiries. A hidden anti-spam field and submission limits using hashed network-address information help reduce misuse. Please do not submit confidential club evidence, financial records or payment details through the form.

Reader interactions

Comments are stored for moderation and are displayed publicly only after approval. Submission checks and limits help reduce automated or excessive requests. The form does not request an email address, but your chosen display name and approved comment become public. Moderation cannot guarantee that every harmful or inappropriate submission will be identified.

Article likes use a random browser identifier rather than a visitor account. The server stores a hash of that identifier and uses hashed network-address information for abuse-prevention limits. These measures reduce direct exposure of identifiers; hashing does not necessarily make information anonymous or remove data-protection obligations.

Operational boundaries

The website uses cloud services for authentication, publication records and files. Access management, retention, recovery arrangements and diagnostic handling need to be considered alongside these application safeguards. This statement does not assert a verified backup or restoration programme, mandatory multi-factor authentication, encryption-at-rest configuration or a completed programme of security testing.

Third-party services and responsibilities

Lovable Cloud supplies the website’s authentication, database and storage services. Other services are involved in website hosting, asset delivery, email and fonts; business collaboration arrangements may also involve external providers. Their precise contractual roles, processing locations and operational responsibilities need to be confirmed before launch.

Providers are responsible for the services and controls they operate under their applicable terms. FASE remains responsible for its own information handling, access decisions, configuration choices and assessment of whether provider arrangements are appropriate for the intended use. Using a cloud provider does not, by itself, establish that FASE is certified or compliant.

External sharing links take you to services operated by others. Their own privacy and security arrangements apply to information you choose to share there. We do not control those services.

Security concerns and incident handling

If you suspect unauthorised access, accidental disclosure or another security concern involving FASE information, contact info@faseglobal.org. Provide a concise description and affected page or service where relevant. Do not send passwords, access tokens, sensitive evidence or other people’s personal information in an initial report, and do not attempt to access information without permission.

Our intended incident-handling approach is to assess the concern, seek to contain any ongoing exposure, involve the relevant service providers or advisers, and identify appropriate recovery and follow-up action. The operational process, responsibilities and reporting arrangements require confirmation before launch; this statement does not promise a response time or service-level commitment.

Where an incident involves personal information, FASE must assess the risks to affected people and any applicable duties to notify the ICO, affected individuals or others. Not every incident requires external notification. Where notification is required, the applicable legal requirements and timescales apply; this statement does not replace that assessment.

Review and governance

Security should be reviewed proportionately as the business, information handled, website features and provider arrangements change. Relevant considerations include who needs access, permission changes when responsibilities change, the sensitivity of documents, retention and deletion, and the ability to recover information following disruption.

This tailored version was prepared and last reviewed on 2 November 2026, following the original statement dated 1 February 2026. It remains a draft for owner and appropriate professional review before public launch. The date is a document-review date, not evidence of a security audit or a completed operational review.

Our risk-based approach is informed by the ICO’s security outcomes guidance and the NCSC’s small organisations guidance. Referencing guidance does not mean that all recommended measures have been implemented or independently verified.

Contact

For information-security questions, contact FASE Global Ltd, UK company number 16734894, at info@faseglobal.org. Our Contact page provides the website’s general enquiry details.

For related information, see the Privacy Policy and Legal Notice. This statement does not vary separately agreed client terms or limit any obligation that applies by law.