1. Introduction
ClubPlaces ("we", "us", "our") operates the ClubPlaces platform (clubplaces.co.uk). This Privacy Policy explains how we collect, use, disclose and protect your personal information when you use our service. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Information we collect
We collect:
- Account information: name, email address, password (hashed), phone number (optional).
- Club information: club name, description, address, contact details.
- Membership data: member names, email addresses, membership categories, family relationships, dates of joining and renewal.
- Payment information: transaction records and invoicing details. Card details are processed by Stripe and never stored on our servers.
- Communication data: emails sent through the platform, announcements and notification preferences.
- Event data: event registrations, attendance records and custom form responses.
- Usage data: log files, IP addresses, browser type, pages visited and feature usage analytics.
- Device data: device type, operating system and screen resolution.
3. How we use your information
We use your information to:
- Provide and maintain the ClubPlaces platform
- Process membership management and communications for your clubs
- Process payments via Stripe Connect on behalf of clubs
- Send transactional emails (receipts, confirmations, renewal reminders)
- Send service-related notifications about updates or changes
- Improve and develop new features based on usage patterns
- Ensure the security and integrity of our platform
- Comply with legal obligations
4. Legal basis for processing
Under UK GDPR, we process personal data on the following legal bases:
- Contract: processing necessary to provide the service you have signed up for.
- Legitimate interest: analytics, security monitoring and service improvement.
- Consent: marketing communications (you may opt out at any time).
- Legal obligation: financial record keeping and responding to legal requests.
5. Data sharing
We share your data with:
- Stripe: for payment processing (as a data processor under their own privacy policy).
- Amazon Web Services (AWS): for email delivery via SES (as a data processor).
- Club administrators: club admins can see member data for their own club only.
We do not sell your personal data to third parties. We do not share data between clubs without explicit consent. We may disclose data if required by law or to protect our legal rights.
6. Data storage and security
- Data is stored on servers located in the United Kingdom
- We use TLS/SSL encryption for data in transit
- Passwords are hashed using industry-standard algorithms
- Database backups are encrypted
- Access to production systems is restricted and logged
- We conduct regular security reviews
7. Data retention
- Active accounts: data is retained for the duration of your account.
- Cancelled accounts: data is retained for 30 days after cancellation, then permanently deleted.
- Financial records: retained for 7 years as required by UK law.
- You may request data export or deletion at any time.
8. Your rights
Under UK GDPR, you have the right to:
- Access your personal data (Subject Access Request).
- Rectify inaccurate personal data.
- Erase your personal data ("right to be forgotten").
- Restrict processing of your personal data.
- Data portability — receive your data in a structured, machine-readable format.
- Object to processing based on legitimate interests.
- Withdraw consent at any time where processing is based on consent.
To exercise these rights, contact us at privacy@clubplaces.co.uk.
9. Cookies
We use essential cookies for authentication and session management. We use analytics cookies to understand how the platform is used. You can manage cookie preferences through your browser settings.
10. Children's privacy
ClubPlaces may store data about children as part of club membership records. This data is provided and managed by parents, guardians or club administrators. We do not knowingly collect data directly from children under 13. Parental consent is required for children's membership data.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the platform. Your continued use of ClubPlaces after changes constitutes acceptance of the updated policy.