Last updated: 19 May 2026. Version 2.4.
1. Who we are
Dragon Team is the contributor hub for Dragon Sports Media Limited. We commission freelance sports journalists, photographers, videographers, podcasters and data analysts across our network of editorial sites. This Privacy Policy explains how we collect, use and protect your personal data when you apply, are approved as a contributor, or visit dragonfc.co.uk.
Data controller
The data controller responsible for personal data collected via dragonfc.co.uk is:
- Dragon Sports Media Limited
- Company number: 15866644
- Registered office: 2 Alexandra Gate, Fford Pengam, Cardiff, United Kingdom, CF24 2SA
- ICO registration: ZA367891
- Contact: privacy@dragonfc.co.uk
Dragon Sports Media Limited is part of the wider Lovells Group. DragonBet is a separate Lovells Group business, licensed by the UK Gambling Commission (licence 64908). Dragon Sports Media Limited and DragonBet do not share contributor personal data.
2. What personal data we collect
2.1 When you apply through the site
- Name, email address, phone number, country
- A password you set yourself (stored as a salted hash, never in plain text)
- Short bio and optional headshot
- Sectors you cover, formats you produce, sites you’d like to write for
- Links to publications you’ve written for and portfolio examples
- Rate per article, rate per shoot or video, monthly capacity
- Notice or availability information, blocked-out dates
- Social media URLs (LinkedIn, X, Instagram, TikTok, YouTube) if you choose to share them
- VAT registration status, VAT number and IR35 / trading status for UK contributors
2.2 After you’re approved
- Which network sites and sectors you’re assigned to
- Editorial team notes about your work
- Records of articles you’ve promoted via our short-link system, including aggregated click counts
- Invoices you upload, with the period and amount
- Feedback you submit on briefs (rating + text)
2.3 Visitor analytics
- IP address (truncated / pseudonymised)
- Browser and device information
- Pages viewed, time on site, referrer
Collected via Google Analytics 4, only when consent is granted via our cookie banner.
2.4 What we do NOT collect
- Bank account details. Bank details are held in our finance team’s accounting software (Xero), not on this site.
- Identifying click data. We hash IP addresses with a daily-rotating salt for 24-hour deduplication. The hashes become meaningless after that.
- Identity-graph tracking (no LiveRamp, Zeotap or similar).
- Payment or banking data processed through our site.
- Data from users under 18. The contributor programme is open to adults only.
3. Why we process your data (lawful bases)
Under UK GDPR Article 6, every processing activity needs a lawful basis. Ours are:
| Purpose | Data used | Lawful basis |
|---|---|---|
| Process your contributor application | All application fields | Contract / pre-contract (Art 6(1)(b)) |
| Commission you work + pay invoices | Profile, rates, IR35, invoices | Contract (Art 6(1)(b)) |
| Send transactional emails (verification, approval, brief notifications) | Email, name | Contract (Art 6(1)(b)) |
| Match briefs to contributors | Sectors, format, tier, capacity | Legitimate interests (Art 6(1)(f)) |
| Website analytics (GA4) | IP, device, page views | Consent (Art 6(1)(a)) |
| Security, fraud prevention | Access logs, IP | Legitimate interests (Art 6(1)(f)) |
| Comply with HMRC accounting record retention | Contributor + invoice data | Legal obligation (Art 6(1)(c)) |
4. Who we share your data with
4.1 Within the group
Editorial leads for our network sites see your profile to review applications and commission briefs. Finance staff see your name, email, VAT and IR35 details to process invoices.
We do not share contributor data with DragonBet (the gambling brand within the group). DragonBet is a separate legal entity with its own systems.
4.2 Third-party processors
We use the following processors. Each has a Data Processing Agreement with us. See our Data Processing Agreement page for full sub-processor detail.
| Processor | Purpose | Transfer mechanism |
|---|---|---|
| 20i / StackCP (UK) | Website hosting | UK-adequate |
| StackMail (UK) | Transactional email delivery | UK-adequate |
| Cloudflare (USA) | DNS and edge security | UK-US Data Bridge / SCCs |
| Google (GA4, USA) | Website analytics (consent-gated) | UK-US Data Bridge / SCCs |
| Xero (UK / NZ) | Finance and invoice processing | SCCs |
| Automattic (WordPress, USA) | WordPress core services | UK-US Data Bridge / SCCs |
4.3 Legal disclosure
We may disclose personal data if required by law, court order, or where necessary to establish, exercise or defend legal claims.
5. How long we keep your data
| Data | Retention |
|---|---|
| Approved contributor profiles | While active, then 7 years after the last invoice paid (HMRC accounting retention) |
| Rejected applications | 12 months, then deleted |
| Click tracking hashes | Pruned after 24 hours of deduplication usefulness; aggregate counts kept indefinitely without personal identifiers |
| Activity log entries | Last 20 events per user |
| Uploaded invoices | 7 years after the financial year they relate to |
| Analytics data | 14 months in GA4 (default retention) |
6. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you (Art 15)
- Correct anything wrong, or correct it yourself via your account page (Art 16)
- Delete your data, subject to legal retention obligations (Art 17)
- Restrict processing while you challenge it (Art 18)
- Object to processing on legitimate-interest grounds (Art 21)
- Receive your data in a portable format (Art 20)
- Withdraw consent at any time where we rely on consent as the lawful basis (Art 7(3)). Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. For analytics cookies specifically, use the Cookie Settings link in our footer.
- Not be subject to automated decision-making that produces legal or similarly significant effects (Art 22). See Section 7.
- Lodge a complaint with the Information Commissioner’s Office (ICO)
To exercise any of these rights, email privacy@dragonfc.co.uk. We’ll respond within 30 days as required by UK GDPR.
7. Automated decision-making and profiling
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.
Contributor application reviews and tier placement are made by human editors. The brief-matching system filters which open briefs are visible to which contributors based on the sectors, formats, tiers, availability and rates you’ve declared, but it does not make commissioning decisions. Editors review and decide.
You have the right under Article 22 UK GDPR not to be subject to a decision based solely on automated processing where it has legal or similarly significant effects. We confirm no such decisions are made on this site.
8. Security
- The site runs over HTTPS with TLS 1.2 or higher
- Passwords are hashed using WordPress’s salted hashing
- Two-factor authentication is enforced on administrator accounts
- SPF, DKIM and DMARC are configured on our sending domain to reduce email spoofing
- IP addresses for click tracking are immediately hashed with a daily-rotating salt
9. Cookies
See our Cookie Policy for full detail on the cookies we set and how to manage them.
10. International transfers
Where personal data is transferred outside the UK / EEA, we rely on UK-approved transfer mechanisms: UK adequacy regulations, the UK-US Data Bridge, or Standard Contractual Clauses. See Section 4.2 for processor locations.
11. Under-18s
The contributor programme is open to adults aged 18 or over. We do not knowingly collect data from people under 18. If you believe a minor has registered, email privacy@dragonfc.co.uk and we’ll delete the account.
12. Changes to this policy
We update this page when our practices change. The version number and date at the top reflect the most recent revision. Material changes that affect how we handle your data are notified by email to current contributors before they take effect.
13. Contact
For any data protection matter, including access requests, corrections, deletion, or complaints, email privacy@dragonfc.co.uk.
Our supervisory authority is the UK Information Commissioner’s Office. You have the right to complain to the ICO at any time: ico.org.uk.