Golf 360 — Privacy Policy
Version 1 — Last updated: 30 September 2026
This Privacy Policy explains how Golf 360 Ltd collects, uses, and protects personal data when you use the website at golf-360.co.uk and the application at app.golf-360.co.uk (together, the "Service").
Golf 360 Ltd is the data controller for the personal data described in this Policy.
Golf 360 Ltd Company number: 13264363 Registered office: Unit 27 Caxton House Northampton Science Park, Kings Park Road, Northampton, Northamptonshire, England, NN3 6LG ICO registration number: ZB983989
If you have a question about this Policy or how we handle your personal data, contact us at [email protected].
1. What personal data we collect
| Data | Where it comes from | Why we collect it |
|---|---|---|
| Email address | Account sign-up | To send your one-time passcode and authenticate you |
| Name | Guest play, contact form, and (optionally) your account | To identify you on a scored leaderboard, or to respond to your enquiry |
| Round and scoring data | Your use of live scoring | To provide leaderboards, stats, and round history |
| Enquiry details (name, email, category selected, message) | The contact form on the Website | To respond to your enquiry |
| Technical data (IP address, browser/device information, request logs) | Automatically, from your use of the Website and App, and via our security provider (Cloudflare) | To operate, secure, and troubleshoot the Service, and to protect the contact form from spam/bot submissions |
We do not knowingly collect special category data (such as health data) through the Service, and we ask that you do not include such information in free-text fields (for example, the contact form message field) unless necessary and relevant to your enquiry.
2. Our legal basis for processing
Under UK GDPR, we rely on the following legal bases:
- Performance of a contract (Article 6(1)(b)) — to create and manage your account, send authentication codes, and provide live scoring, leaderboards, and related features you have signed up to use.
- Legitimate interests (Article 6(1)(f)) — to respond to enquiries submitted before any contract exists, to secure the Service (including bot/spam protection via Cloudflare Turnstile on the contact form), and to maintain logs necessary for troubleshooting and security. Where we rely on legitimate interests, we have considered that this processing is proportionate and does not override your rights and freedoms.
- Consent (Article 6(1)(a)) — where applicable, for example if we ever ask for your consent to send marketing communications. We do not currently send marketing emails; any enquiry response or account-related email (such as a one-time passcode) is sent to fulfil your request or our contract with you, not as marketing.
3. Guest play
If you join a round as a guest (without an account), we process the name you provide and the scores recorded for that round for the duration needed to display the leaderboard and any round history associated with that session. Because no account is created, we may be limited in our ability to verify or link this data back to you if you later want to exercise a data-subject right over it (see Section 8) — please provide as much context as you can (for example, the club, date, and event) if you contact us about guest-play data.
4. Who we share your data with
We share personal data with the following categories of recipient, only as necessary to provide the Service:
- Email delivery — we use Brevo to send authentication (one-time passcode) emails and to send/receive contact-form related emails.
- Hosting and infrastructure — the Service is hosted on Amazon Web Services (AWS) infrastructure, in AWS's eu-west-2 (London) region.
- Security and content delivery — we use Cloudflare for DNS, content delivery, and bot/spam protection (Cloudflare Turnstile) on our contact form. Cloudflare may process technical data (such as your IP address) as part of providing that protection, in data centres located in the EU and the United States.
We do not sell personal data, and we do not share personal data with third parties for their own marketing purposes.
5. International data transfers
Brevo processes and stores data entirely within the EU (primarily France and Germany, with backup infrastructure in Belgium). Transfers of personal data from the UK to the EU are covered by the UK government's ongoing adequacy decision for the EEA, so no additional safeguard is required for this transfer.
Cloudflare processes some technical/metadata (including IP addresses, as part of bot protection) in data centres in both the EU and the United States. For the transfer to the US, Cloudflare relies on the EU Standard Contractual Clauses together with the UK's International Data Transfer Addendum (IDTA) as its safeguard mechanism.
6. How long we keep your data
- Account data: for as long as your account is active. If you close your account, we delete or anonymise it within 30 days, unless we need to keep it longer for a specific legal, accounting, or dispute reason.
- Guest play data: for as long as needed to display that round's leaderboard and any related history, then deleted or anonymised after 12 months of inactivity — because guest play creates no account, there is nothing to tie the data to beyond that point.
- Enquiry data (contact form submissions): for 24 months from your last contact with us, covering a reasonable follow-up window.
- Technical/security logs: for 90 days, the standard period for operational troubleshooting and security investigation.
7. Children's data
The Service may be used by junior golfers, in particular through guest play arranged by a club or event organiser, or through club-level distribution of the App. We do not knowingly collect account-level personal data directly from a child under 13 without appropriate parental/guardian involvement, consistent with the age threshold for consent to information society services under UK data protection law. Clubs and event organisers distributing the Service to junior members are responsible for ensuring appropriate parental/guardian awareness where required by their own safeguarding policies.
8. Your rights
Under UK GDPR, you have the right to:
- access the personal data we hold about you;
- rectify inaccurate or incomplete personal data;
- request erasure of your personal data, in certain circumstances;
- request restriction of processing, in certain circumstances;
- object to processing based on legitimate interests;
- request portability of data you have provided to us, in certain circumstances;
- withdraw consent at any time, where processing is based on consent (this will not affect processing carried out before withdrawal).
To exercise any of these rights, contact us at the email address at the top of this Policy. We will respond within the timeframes required by UK GDPR (generally one month).
You also have the right to lodge a complaint with the UK's data protection regulator:
Information Commissioner's Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF ico.org.uk | 0303 123 1113
9. Security
We use appropriate technical and organisational measures to protect your personal data, including encrypted transmission (HTTPS/TLS) between your device and our servers, and access controls restricting who within Golf 360 can access personal data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
10. Cookies
Our use of cookies and similar technologies is described separately in our Cookie Policy.
11. Changes to this Policy
We may update this Privacy Policy from time to time. We will post the updated Policy on this page with a new "Last updated" date.
12. Contact us
Golf 360 Ltd Unit 27 Caxton House Northampton Science Park Kings Park Road, Northampton Northamptonshire, England, NN3 6LG
Email: [email protected] ICO registration: ZB983989