Privacy Policy

Didcot Community Badminton ("we", "us", "our") operates the Didcot Community Badminton app and website (together, the "Service"). We are a Community Amateur Sports Club (CASC) registered with HMRC, based in Didcot, Oxfordshire, United Kingdom.

For questions about this privacy policy or your personal data, please contact us at info@didcotbadminton.co.uk.

What information we collect

When you register for an account or update your profile, we collect: full name, email address, phone number, postal address, profile photo, gender, disability information, emergency contact details, and Badminton England number. Disability and emergency contact details are optional and are used solely for your safety at sessions.

As you use the Service, we also collect booking records, guest names, transaction records, waitlist entries, notification preferences, messages you send to club volunteers through in-app support, and your session participation data: games played, scores, and a skill rating used to arrange balanced games. Some participation data (such as leaderboards and night summaries) is visible to other members; you can hide your name from leaderboards in Account Settings.

We automatically collect device tokens (for push notifications), app usage analytics, and crash reports.

Payment information

We use Square as our payment processor. Your card details are entered directly into Square's secure payment interface and are never transmitted to or stored on our servers. We store only: transaction reference ID, amount, date, and the credit package purchased.

How we use your information

We use your personal data to provide the Service, communicate with you (session reminders, waitlist updates, booking confirmations), ensure safety, improve the Service, and comply with legal obligations.

Third-party services

We share data with: Supabase (database hosting), Firebase/Google (analytics, crash reporting, push notifications), Square (payment processing), Brevo (transactional email), and hCaptcha (sign-up spam protection). During our transition from the club's previous booking system, booking and credit records are kept in step with Wix (our legacy provider). If you ask us to register or verify a Badminton England membership, we share the details needed for that registration (name, contact details, and membership number) with Badminton England. We do not sell, rent, or trade your personal information.

Push notifications

We use Firebase Cloud Messaging for session reminders, waitlist updates, booking confirmations, session cancellations, and admin alerts. You can control preferences in Account Settings.

Location

With your permission, the app uses your device's location solely to check you in automatically when you arrive at the session venue. Location is requested only around your booked sessions, is never used for advertising, and is never shared with third parties. You can decline location access — a volunteer can always check you in manually.

Data retention

Account data is retained whilst active, deleted within 30 days of a deletion request. Booking history: 2 years. Payment records: 6 years (HMRC). Analytics: 14 months. Push notification logs and crash reports: 90 days.

Account deletion

You can request deletion of your account and personal data at any time from Account Settings > Help > Delete My Account in the app, or by emailing info@didcotbadminton.co.uk. See account deletion for details.

Children

The Service is not directed at children. Accounts may only be held by people aged 16 or over; younger players attend under a parent or guardian's account, and we hold only the information the parent or guardian provides (such as a name for the register).

Your rights (UK GDPR)

You have the right to access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Contact info@didcotbadminton.co.uk to exercise these rights.

Data security

All data in transit is encrypted via TLS/HTTPS. Database access is restricted via Row Level Security policies. Payment card data is handled entirely by Square's PCI DSS-compliant infrastructure. Push tokens are cleared when you sign out.

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.