Privacy notice

1. Who we are

Pay Green Fees is operated by BB AI Limited (company number 17441545), registered at Astute House, Wilmslow Road, Wilmslow, SK9 3HP. We are the data controller for the personal information described in this notice.

We are registered with the Information Commissioner’s Office under registration number ZC239971.

To contact us about anything in this notice, email privacy@paygreenfees.co.uk.

2. What this notice covers

We hold information about three groups of people, and what we do differs for each:

• Golfers — people who pay a green fee through our payment page, and the other players named on that payment.
• Club users — people at a golf club who hold an account on our dashboard.
• Website visitors — anyone who visits paygreenfees.co.uk.

Sections 3 to 5 deal with each in turn. Sections 6 onwards apply to everyone.

3. Golfers

3.1 What we collect

When someone pays a green fee through our page:

We never see or store your card number. Card details go directly to Stripe.

If you are named on a payment made by someone else, we received your name from them. We hold nothing else about you beyond that name, the rate you were charged and the club and date.

3.2 Why we use it, and our lawful basis

Where we rely on legitimate interests, we have considered the effect on you. The information involved is limited, you would reasonably expect a green fee payment to be shared with the club you are playing at, and we do not use it for marketing.

3.3 We do not market to golfers

We do not send golfers marketing email, and we do not sell or rent golfer information to anyone.

The golf club receives your details and has its own privacy notice governing what it does with them afterwards, including any marketing it may send. That is the club’s responsibility, not ours. If you want the club to stop contacting you, ask the club directly.

4. Club users

4.1 What we collect

Name, job title or role at the club, work email address, work phone number, a password (stored only as a secure hash), and a record of your sign-ins and the actions you take in the dashboard.

Where you complete a signup on the club’s behalf, we also record which version of our terms you accepted, when, and the IP address and browser you used. We need this to show that the agreement was validly entered into.

Bank account details supplied for payouts belong to the club rather than to you personally, but we treat them with the same care: they are encrypted and only the last four digits are ever displayed.

4.2 Why we use it, and our lawful basis

Service messages such as receipts, payout notices and refund confirmations are part of the service and cannot be switched off while the account is active.

5. Website visitors

We use Google Analytics on our marketing site to understand how people find and use it. This sets cookies and collects information about your device, your approximate location derived from your IP address, the pages you view and how you arrived.

Analytics only runs if you consent to it. Nothing is collected for analytics purposes until you accept it in our cookie banner, and you can change your mind at any time.

Our lawful basis is your consent, given through the cookie banner.

We do not run analytics on the green fee payment page. See our Cookies Notice for the full detail of what is set and when.

6. Who we share information with

We use a small number of service providers. They process information on our instructions and cannot use it for their own purposes, except where noted.

Stripe is a payment services provider and is a controller in its own right for some of what it does, including fraud prevention and meeting its own regulatory obligations. Its privacy policy is at stripe.com/gb/privacy.

We also share:

• Green fee transactions with the relevant golf club, which is an independent controller of that information for its own purposes.
• Information with our accountant and professional advisers, where needed.
• Information with law enforcement, regulators or a court, where we are legally required to.
• Information with a buyer, if the business is ever sold, subject to the same protections.

We do not sell personal information.

7. Sending information outside the UK

Some of the providers above are based in the United States. Where information leaves the UK, we rely on one of:

• the UK Extension to the EU–US Data Privacy Framework, where the provider is certified under it; or
• the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

You can ask us for details of the safeguard used for any particular provider.

8. How long we keep things

We do not keep information longer than these periods unless we are required to, or unless it relates to an ongoing dispute or investigation.

9. How we protect it

Card details never reach our servers. Bank details are encrypted using AES-256-GCM and only the last four digits are ever shown. Passwords are hashed and cannot be read by us. Access to production data is restricted and logged. Data is transmitted over encrypted connections.

No system is perfectly secure, but if a breach occurs that is likely to affect your rights, we will report it to the ICO within 72 hours and tell you where we are required to.

10. Your rights

You have the right to:

• be told what we hold about you and why — that is what this notice does;
• get a copy of your information;
• have it corrected if it is wrong;
• have it deleted, where we no longer need it and no legal obligation requires us to keep it;
• restrict how we use it while a concern is being resolved;
• object to processing based on legitimate interests, including direct marketing;
• receive it in a portable format, where processing is based on consent or a contract;
• withdraw consent at any time, where we rely on it — this does not affect anything done beforehand.

We do not make any decision about you by automated means that produces a legal or similarly significant effect.

To exercise any of these, email privacy@paygreenfees.co.uk. We will respond within one month. We may ask you to confirm your identity first — usually the reference code from your receipt is enough.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first, so we have a chance to put it right.

11. Children

The service is not intended for children. Payments must be made by someone aged 18 or over. We do not knowingly collect information from children beyond the name of a junior player entered by an accompanying adult.

12. Changes to this notice

We may update this notice. The current version and its date are shown at the top. Where a change materially affects how we use your information, we will tell affected club users by email and post a notice on the website.