This notice is a first draft for review. It is not formal legal advice.

Privacy notice

Last updated 7th November 2026 (Europe/London).

Who this notice is for

This notice explains how personal data is used on Golf Day Caddy, a UK service for running golf days (charity, fundraising, corporate and society). It is being built by a commercial airline pilot.

The organiser of a golf day is typically the controller of the personal data collected for that event. Golf Day Caddy processes that data to provide the service the organiser has asked for.

Golf Day Caddy is the controller of the platform owner account and of this marketing and coming-soon website.

We have not appointed a data protection officer.

What data we use

We only describe uses that the service actually makes. Depending on how an event is run, that can include:

• Club-team logins: name, email address, a hashed password, and, if switched on, an encrypted authenticator secret and hashed recovery codes. The platform owner can also register a hardware security key. We store the public credential needed to check that key, not a copy of the key itself.
• Booking requests and tee times: team name, booker name, email, phone number, notes, chosen package, player names and handicaps.
• If the organiser turns on public player names, the club may publish golfer names on open or listed tee times so others can see who is in each group. Email addresses and phone numbers are not shown on that list.
• Sponsor records: company name, contact name and email, sign wording, tee-sign logos (stored privately and shared with the sign writer), and any notes the organiser adds.
• Shop orders: buyer name, item and amount.
• Food-cart orders: buyer name, location on the course, item, any donation, and whether an age confirmation was given.
• Scorecards: player names, handicaps and scores, including live hole-by-hole cards and paper-card entries.
• Scorecard photos: a picture of a paper card, stored privately with extra photo metadata removed, and shown only to that group (with their scoring code) and to organisers.
• Club logos and other images the organiser uploads.
• The volunteer rota: name, role, shift and notes entered by the organiser. Volunteers do not log in.
• Pace of play: times inferred from on-course use of the food cart, side competitions, the scorecard and (when someone has a scorecard session) the leaderboard.
• Platform audit records for owner sign-in and admin actions: the action, an IP address and a browser user agent. These records do not include passwords, codes or other secrets.

Golfers, sponsors and volunteers do not need an account.

Payments

If the club has connected Stripe, card payments are taken as direct charges on the club’s own Stripe account. Golf Day Caddy never takes an application fee and never holds the money. We do not store card numbers. Stripe handles the card details. If Stripe is not connected, the service asks people to pay the treasurer instead.

Emails

When email sending is set up and the organiser has it switched on, booking emails are sent from a no-reply address (by default noreply@golfdaycaddy.co.uk) with Reply-To set to the organiser.

Where it is stored

The service is hosted on Golf Day Caddy’s existing UK-facing website. Data is stored in a SQLite control database and one SQLite database file for each event.

Cookies

We use cookies that are needed to run the service. We do not use analytics or advertising cookies.

• gdc_session — keeps an organiser or club-team member signed in (up to 14 days).
• gdc_owner_session or __Host-gdc_owner_session — keeps the platform owner signed in on the admin host (up to 14 days).
• gdc_2fa — a short-lived cookie (10 minutes) while someone finishes signing in with an authenticator app or security key.
• gdc_sc_ followed by the event number — an on-the-day scorecard session, valid for that UK date (up to 18 hours).
• gdc_shop_ followed by the event number — remembers a public shop basket (up to 14 days).

These cookies are set as HttpOnly and SameSite=Lax. They are marked Secure when the site is served over HTTPS.

Children and young people

We do not verify anyone’s age. A golf day may include juniors. Organisers are responsible for what they collect about children and young people.

Alcohol items on the food cart can ask the person ordering to confirm they meet the age requirement. That confirmation is not an identity check. The venue’s licence still applies.

How long we keep data

We keep account and event data while the club and event remain on the service, and for as long as it is needed to run that golf day. We have not set a separate automatic deletion timetable. Organisers can change or remove much of what they have entered. You can ask for data to be corrected or deleted.

Your rights

UK data protection law gives you rights in your personal data, including to ask for a copy, a correction or deletion. For data collected for a golf day, start with the organiser of that event. For the platform owner account or this website, use the contact details below.

We do not sell personal data. We share what is needed with Stripe when a card payment is taken, and with the email provider if booking emails are sent. Sponsor names, sign wording and tee-sign logos may be shared with the sign writer who prints the tee-box signs.

How to contact us

Contact details will be added when the owner email is set up.