Privacy Policy

Last updated: 12 September 2026

Didcot Community Badminton ("we", "us", "our") operates the Didcot Community Badminton app and website (together, the "Service"). We are a Community Amateur Sports Club (CASC) registered with HMRC, based in Didcot, Oxfordshire, United Kingdom.

For questions about this privacy policy or your personal data, please contact us at info@didcotbadminton.co.uk.

What information we collect

When you register for an account or update your profile, we collect: full name, email address, phone number, postal address, profile photo, gender, date of birth, disability information, emergency contact details, and Badminton England number. Disability and emergency contact details are optional and are used solely for your safety at sessions; providing them is your choice. Date of birth is also optional, and is used solely to register you with Badminton England if you ask us to.

As you use the Service, we also collect booking records, guest details (a guest's name, gender, and whether they are under 18, plus any email or phone you add, saved to your account so you can rebook the same guest), transaction records, waitlist entries, notification preferences, messages you send to club volunteers through in-app support, and your session participation data: games played, scores, and a skill rating used to arrange balanced games. Some participation data (such as leaderboards and night summaries) is visible to other members; you can hide your name from leaderboards in Account Settings.

We automatically collect device tokens (for push notifications), app usage analytics, and crash reports. Our website records anonymous, aggregated visit statistics; no cookies are set and no individual visitor is identified.

Payment information

We use Square as our payment processor. Your card details are entered directly into Square's secure payment interface and are never transmitted to or stored on our servers. We store only: transaction reference ID, amount, date, the item purchased, and, when you pay by card for a session place, whether the place was for you and the names of any guests it was for, so we can finish the booking if the payment does not complete. That last detail is deleted after a year, and straight away if you ask us to delete your account.

How we use your information

We use your personal data to provide the Service, communicate with you (session reminders, waitlist updates, booking confirmations), ensure safety, improve the Service, and comply with legal obligations.

Third-party services

We share data with: Supabase (database hosting), Firebase/Google (analytics, crash reporting, push notifications), Square (payment processing), Brevo (transactional email), Google Gemini (the chat assistant, match highlight commentary, and reading a photographed league score sheet so a volunteer does not have to type it out; nothing sent to it is used to train Google's models), and Cloudflare (privacy-preserving, cookie-free visitor statistics for our website, and Turnstile sign-up spam protection). During our transition from the club's previous booking system, booking and credit records are kept in step with Wix (our legacy provider). If you ask us to register or verify a Badminton England membership, we share the details needed for that registration (name, contact details, date of birth, and membership number) with Badminton England. If you play in a league the club has entered, the players named on each result (both clubs) and the scores are entered into Badminton England's results system through its JustGo portal. We do not sell, rent, or trade your personal information.

Push notifications

We use Firebase Cloud Messaging for session reminders, waitlist updates, booking confirmations, session cancellations, and admin alerts. You can control preferences in Account Settings.

Location

With your permission, the app uses your device's location solely to check you in automatically when you arrive at the session venue. Location is requested only around your booked sessions, is never used for advertising, and is never shared with third parties. You can decline location access. A volunteer can always check you in manually.

Data retention

Account data is retained whilst active, deleted within 30 days of a deletion request. Booking history: 2 years. Attendance records (check-ins and check-outs): 2 years. Saved guest details: deleted after 13 months without a booking for that guest. Payment records: 6 years (HMRC). Session feedback: the star rating and score you give are kept, and any comment you write is removed after 12 months. Incident records (injury, behaviour or other reports a volunteer logs): kept for as long as they may still be needed, for safeguarding and duty of care, and reviewed each year. Analytics: 14 months. Push notification logs and crash reports: 90 days.

Account deletion

You can request deletion of your account and personal data at any time from Account Settings > Help > Delete My Account in the app, or by emailing info@didcotbadminton.co.uk. See account deletion for details.

Children

App accounts are for people aged 16 and over, and we do not knowingly let a child under 16 create their own account. Separately, a member may record limited details about a guest they bring, including a guest who is under 18. Those details are their name, gender, and whether they are under 18. We hold this to organise sessions safely and fairly and to meet our safeguarding responsibilities, never for marketing. A member who records these details confirms they have the guest's parent or guardian's permission to share them. A parent or guardian may contact us at any time to see, correct, or remove the details we hold about their child.

Your rights (UK GDPR)

You have the right to access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Contact info@didcotbadminton.co.uk to exercise these rights.

Data security

All data in transit is encrypted via TLS/HTTPS. Database access is restricted via Row Level Security policies. Payment card data is handled entirely by Square's PCI DSS-compliant infrastructure. Push tokens are cleared when you sign out.

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.