Privacy Notice

Smash Potatoes Badminton Club (Smash Potatoes, "we") decides how your personal information is used. In data protection law, that makes us the controller.

• Privacy contact: [Owner to confirm: privacy contact email and name or role]
• ICO registration: [Owner to confirm: ICO registration number, or remove this line]

When you book a session

• Your name, and your email address or phone number.
• Your badminton skill level, the number of players and your payment choice.
• For group bookings, each player's name and skill level. If you book for others, please let them know about this notice.

While we manage your booking

• Your booking reference, session, booking status and the history of changes, including which organiser made them.
• The version of our booking and cancellation policies you accepted.
• Waiting-list offers: when a place was offered, its private link, and whether you accepted or declined.
• Attendance: whether you arrived, were late, didn't show or let us know you'd be absent, and when this was recorded.
• Any notes organisers add to your booking, and checks for possible duplicate bookings.
• A record of each time an organiser messages you about your booking: when, how (for example WhatsApp or email), which organiser and any short note. We don't keep a copy of the message itself.

Payments and refunds

• Amounts due and received, deposits, balances, payment deadlines and payment status.
• The payment option you asked for, the terms an organiser agreed with you, and (if an arrangement couldn't be agreed) the organiser's private note on why.
• For each bank transfer: the date, amount, method and the reference shown on it, plus a history of payment changes.
• Cancellation requests and the reason you give, and refund decisions, amounts, reasons and how they were sent.

Keeping Check My Booking secure

When someone uses Check My Booking or asks to cancel, we record the booking reference entered, whether the details matched, the time, and a scrambled code made from the connection's IP address. This stops people guessing references. We don't store the IP address itself.

Other information

• Messages you send us by email or WhatsApp. These services (for example WhatsApp, or the email provider the club uses) handle those messages under their own privacy terms.
• Photos in our gallery may show players. We publish general photos of club sessions in our gallery, relying on legitimate interests in showing what the club is like. If you'd like a photo of you removed, just ask and we'll take it down.
• For organisers: name, email, role, permissions, sign-in account and a record of the actions they take in the dashboard.

Things we don't collect: you don't need an account to book. We never see your bank login or card details — you pay by bank transfer from your own bank. We don't use advertising or marketing tracking.

Please don't include health details when you give a cancellation reason. If you choose to tell us about an injury or illness, we'll only use it to consider your request. Only organisers who manage bookings can see it, and it's kept with your booking (1 year after the session).

• Taking and managing your booking: places, the waiting list, payments, cancellations, refunds and contacting you about them. Lawful basis: contract, because it's needed to provide the session you asked for.
• Group members' details: organising each player's place and checking skill levels. Lawful basis: legitimate interests in running group bookings.
• Attendance: running sessions safely and applying our no-show rules. Lawful basis: legitimate interests.
• Change and payment history, duplicate checks and Check My Booking security: keeping bookings fair, accurate and secure, and resolving disputes. Lawful basis: legitimate interests.
• Financial records: keeping payment and refund records for 6 years so the club can account for money received and refunded, and answer any questions or disputes about them. Lawful basis: legitimate interests, and legal obligation where the law requires us to keep financial records.
• Gallery photos: We publish general photos of club sessions in our gallery, relying on legitimate interests in showing what the club is like. If you'd like a photo of you removed, just ask and we'll take it down.

Where we rely on legitimate interests, you can ask us how we balanced them against your rights, and you can object (see section 7).

• Club organisers who manage sessions, bookings or payments. Each organiser only sees the parts of the dashboard their role allows.
• Lovable, which hosts our website, database and photo storage (Lovable Cloud), acting for us as a processor. Lovable uses its own sub-processors, listed at trust.lovable.dev/subprocessors. [Owner to confirm: processor agreement and transfer safeguards]
• Banks that handle your payment to us, or our refund to you.
• Email and messaging services if you contact us that way, or we message you about your booking. These services (for example WhatsApp, or the email provider the club uses) handle those messages under their own privacy terms.
• Anyone we are legally required to share it with.

We don't sell your information or use it for marketing.

• Our database and photo storage are hosted in the European Union (Ireland). UK law recognises the European Economic Area as giving adequate protection to personal information.
• The website itself is delivered from servers around the world, close to each visitor, so information you submit may pass through servers outside the UK on its way to our database.
• Safeguards for transfers outside the UK and EEA: [Owner to confirm: processor agreement and transfer safeguards]

We keep: booking, attendance, waiting-list, cancellation and messaging records — 1 year after the session; payment and refund records, including their history — 6 years; organiser accounts — while the person is an organiser; gallery photos — until someone asks us to remove them.

Change and payment histories can't be edited, and are kept for as long as the record they belong to. Once a period ends, we delete or anonymise the records by hand — the website doesn't delete them automatically. The scrambled security codes and attempts from Check My Booking are deleted automatically once they're more than 24 hours old, the next time anyone uses Check My Booking.

To ask us to delete your information early: ask us using the privacy contact above. We'll delete or anonymise your records by hand, unless we still need to keep them (for example payment records within the 6-year period), in which case we'll tell you why.

Under UK data protection law you have the right to:

• Access a copy of your personal information.
• Correct information that's wrong or incomplete.
• Delete your information in some circumstances.
• Restrict how we use it in some circumstances.
• Object to uses based on legitimate interests.
• Data portability — receive information you gave us for your booking in a commonly used format.
• Withdraw consent at any time, where we rely on consent.

To use any of these rights, contact [Owner to confirm: privacy contact email and name or role]. To protect you, we may ask for your booking reference and the email or phone number you booked with. We'll normally reply within one month.

• The website doesn't set cookies for players and doesn't use advertising or tracking cookies.
• After a website update, a small note in your browser's session storage records when the page last reloaded itself. It contains no personal information.
• Visitor statistics: switched on. Lovable's built-in statistics count visits without cookies and store nothing in your browser.
• The website's fonts are stored on our own site, so no font requests go to Google or any other font service.
• Organisers who sign in to the dashboard have a sign-in token kept in their browser so they stay signed in.

We don't make decisions about you purely by computer that have legal or similarly significant effects. The website uses session capacity to decide whether a request joins the waiting list, but an organiser approves every booking and refund.

Under-18s are welcome at our sessions, but a parent or guardian must make the booking for them, using the parent or guardian's own contact details. If you're under 18, please ask a parent or guardian to book for you.

• Only signed-in organisers with the right permissions can see bookings, attendance and payments.
• Check My Booking only shows a booking when both the reference and the email or phone number match.
• Visitors can't see other players' names, skill levels, contact details or payment records.

If you're unhappy with how we've used your information, please contact us first at [Owner to confirm: privacy contact email and name or role]. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, helpline 0303 123 1113.

We'll update this notice if the way we use your information changes. Takes effect: [Owner to confirm: date this notice takes effect]. Version draft-2026-10-27b.