Privacy Notice how we look after your details
The short version
- We only collect what we need to run your booking, membership or society day.
- We never see your card details: payments are handled by Stripe.
- We don’t sell your details, and we don’t use advertising or tracking cookies.
- We only email you news and offers if you didn’t opt out when booking, and you can unsubscribe at any time.
- Personal details are removed from old bookings after 24 months.
- You can ask to see, correct or delete your details, or complain, at any time.
1. Who we are
Cranham Golf Course is run by [CLUB LEGAL NAME], St Mary’s Lane, Cranham, Upminster, Essex RM14 3NU. We are the “controller” of the personal information described here, which means we decide how and why it’s used. [Company number: [NUMBER], registered office: [ADDRESS].] Our registration number with the Information Commissioner’s Office is [ICO REGISTRATION NUMBER].
For anything about your personal information, email [DATA CONTACT EMAIL], call 01708 221177, or write to us at the address above, marked “Data protection”.
2. What we collect and why
Data protection law says we must have a lawful reason (“lawful basis”) for each use of your information. Here’s what we collect, why, and our reason.
{{u.title}}
We don’t make decisions about you by automated means that have legal or similarly significant effects. Prices are worked out by fixed rules (day, time, holes, membership), the same for everyone.
3. People in your group
When you book, you can choose to give the names of the people playing with you, so the pro shop can check everyone in. This is optional. If you don’t, we use placeholders such as “Guest 2”, and staff may write in a name when the group arrives.
If you give us someone else’s name or member card number, please make sure they’re happy for you to do so and point them to this notice. We use their name only to check them in and keep the day’s records, and it’s removed on the same timetable as your booking.
4. Juniors
Juniors (16 and under) play with an adult, and bookings are made by the adult. For a junior we record only that they are a junior (for their discount) and, if the adult gives it, their name. We don’t ask juniors for contact details, and our sign-up forms are intended for adults.
6. Where it’s stored
Our website and booking system are hosted by Render in its Frankfurt, Germany data centre. UK law treats the European Economic Area as giving adequate protection. Some of our suppliers (Render and Stripe) are American companies or have staff outside the UK and EEA; where your information may be accessed from outside the UK, it is protected by the standard contractual safeguards approved under UK law, such as the International Data Transfer Addendum, which are part of our contracts with them.
7. How long we keep it
After personal details are removed from a booking, we keep its date, time and amount (with no names or contact details) for our accounts and to understand how the course is used.
9. Keeping it safe
Everything is sent over encrypted connections (HTTPS). Card details go straight to Stripe and never reach our systems. The staff area is password protected, member sign-in uses one-time links rather than passwords, and the system is built to recognised security standards (the OWASP Top 10). Daily backups are kept for 14 days on our host’s secure storage. If something ever goes wrong with your information that could put you at risk, we’ll tell you and, where required, the Information Commissioner’s Office.
10. Your rights
You have the right to:
- See the information we hold about you and get a copy.
- Correct anything that’s wrong or incomplete.
- Have it deleted where we no longer need it.
- Restrict how we use it, or object to uses based on our legitimate interests.
- Take it with you in a common electronic format (“data portability”).
- Withdraw your consent at any time where we rely on it, for example by asking to come off the padel list. This doesn’t affect anything we did before.
To use any of these rights, contact us using the details in section 1. We may need to check who you are. We’ll respond within one month (or tell you within that month if we need longer for a complex request). There’s normally no charge.
11. Complaints
If you’re unhappy with how we’ve handled your information, please tell us first so we can put it right. Email [DATA CONTACT EMAIL] with “Data protection complaint” in the subject, call us, or write to us. We’ll acknowledge your complaint within 30 days, look into it properly, keep you updated and tell you the outcome.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator, at any time: ico.org.uk/make-a-complaint or 0303 123 1113.
12. Changes to this notice
We’ll update this notice when we change how we use personal information, and show the date at the top. If a change affects you significantly, we’ll let you know.