Privacy Notice &
Data Protection Policy

CLUB-APPROVED POLICY · JULY 2026

For members, visitors, prospective members, website users, app users and marketing contacts.

Bonnyton Golf Club, Kirkton Moor Road, Eaglesham, Glasgow G76 0QA.
Telephone: 01355 303030 · Email: secretary@bonnytongolfclub.com

At a glance

Bonnyton Golf Club (the “Club”, “we”, “us” or “our”) is responsible for deciding how and why personal data is used for the activities described in this notice. This notice explains what information we collect, how we use it, who we share it with, how long we keep it and the rights available to individuals.

• We collect only the information reasonably needed to operate the Club, provide golfing and hospitality services, manage membership, communicate with people and promote the Club.

• We distinguish routine service communications from direct marketing. Members cannot opt out of essential membership or booking messages, but anyone can object to direct marketing at any time.

• Non-essential website and app tracking, including advertising pixels, will only be used where the applicable consent requirements have been met.

• We do not sell personal data. We share it only with service providers and other organisations where there is a lawful and necessary reason.

• Questions, rights requests and data protection complaints should be sent to the Club Secretary using the contact details in section 18.

1. Scope and status of this document

This document acts as the Club’s external privacy notice and also records the main data protection commitments followed by the Club. It applies to personal data relating to:

• current, former and prospective members, including junior members and parents or guardians;

• visitors, guests, societies, competition entrants, event attendees and clubhouse customers;

• people who contact the Club, request information, submit a form, apply for an offer or respond to an advertisement;

• users of the Club’s website, member app, online booking systems and social media channels;

• suppliers, sponsors, volunteers, officials and business contacts; and

• any person appearing in Club photographs, videos, CCTV or communications. Separate employee and recruitment privacy information should be used for staff, contractors and job applicants. This notice should be read with any specific notices displayed on forms, in the app, on the website, at events or beside CCTV signage.

2. Who we are and how to contact us

Data controller

Bonnyton Golf Club

Postal address

Kirkton Moor Road, Eaglesham, Glasgow G76 0QA

Telephone

01355 303030 (option 1 for the Club office)

Email

secretary@bonnytongolfclub.com

Data protection contact

The Club Secretary / Managing Secretary

The Club is the controller for most processing described in this notice. Some external platforms may act as processors on our instructions, while others may act as separate or joint controllers for parts of their services. Their own privacy information may therefore also apply.

3. Our data protection principles

The Club will process personal data lawfully, fairly and transparently. We will:

• collect data for clear and legitimate purposes and not use it incompatibly with those purposes;

• collect only what is adequate, relevant and necessary;

• take reasonable steps to keep information accurate and up to date;

• retain data only for as long as it is needed;

• use appropriate technical and organisational security measures;

• respect individual rights and marketing preferences;

• assess privacy risks before introducing material new systems, tracking or uses of data;

• have written arrangements with processors where required; and

• keep appropriate records to demonstrate compliance.

4. Personal data we collect

Identity and contact data

Name, title, date of birth or age category, postal address, email address, telephone/mobile number, emergency contact and membership or customer reference.

Membership and golf data

Membership category and history, application information, interview and eligibility information, handicap, scores, competition entries and results, bookings, tee times, attendance, locker details, reciprocal requests, disciplinary and conduct records.

Visitor, event and hospitality data

Visitor bookings, society or event details, guest names, food or accessibility requests, correspondence, attendance and transaction details.

Payment and transaction data

Subscription, joining fee, booking, competition, catering and retail payment records, invoices, refunds and payment status. Full card details are normally handled directly by the payment provider rather than stored by the Club.

Enquiry and marketing data

Information submitted through website forms, the Club app, Meta lead forms, telephone calls, emails, social media messages, offer or VIP-pass applications, newsletter sign-ups, preferences, consent records, source or campaign information and engagement with communications.

Website, app and device data

IP address, device and browser information, app account identifiers, log-in method, security logs, page or screen activity, cookie identifiers, advertising identifiers, referral source, approximate location derived from IP, and consent choices.

App profile and content

Account name, email or Apple/Google sign-in identifier, profile details, group membership, game preferences, posts, replies, messages, reports, moderation records, notification settings and app usage information.

Advertising and campaign data

Campaign source, ad clicks, landing-page activity, form submissions, conversions, audience segment, matched or hashed identifiers used for audience services where enabled, and aggregated campaign performance.

Images, audio and video

Photographs and video from competitions, prize-givings, team events, social occasions, junior activities and promotional activity; CCTV footage in areas covered by signage; and call recordings only if the Club introduces and clearly notifies such recording.

Junior and safeguarding data

Parent or guardian details, age/date of birth, consent and permissions, emergency information, relevant health or allergy information, coaching or attendance records, safeguarding concerns and incident records where necessary.

Special category and sensitive data

Limited health, disability, allergy, religious or other sensitive information only where genuinely needed, such as to protect health and safety, make reasonable adjustments, manage catering or safeguarding, and only with an appropriate legal condition.

Correspondence, rights and complaint data

Emails, letters, call notes, evidence, identity checks, requests, complaints, investigation records and outcomes.

We do not intentionally collect more information than is required. Please do not provide sensitive personal data through public website forms, advertising lead forms or member-app group chats unless the Club has specifically requested it through an appropriate secure route.

5. How we obtain personal data

We may obtain personal data:

• directly from the individual, including through membership and competition forms, bookings, purchases, telephone calls, emails, website forms, the app, surveys and face-to-face contact;

• from a parent, guardian, host member, team captain, society organiser or other authorised person;

• through Club systems and service providers, including BRS, HowDidIDo/Club Systems, handicap or governing-body systems, payment providers and the member-app provider;

• through advertising platforms, including Meta lead forms and Google or Meta campaign measurement, where the individual has interacted with a Club advertisement or consented to relevant tracking;

• from social media platforms when a person messages, comments, follows or otherwise interacts with a Club account;

• from cookies, pixels, software development kits and similar technologies used on the website or app, subject to the consent rules described below;

• from publicly available sources or business directories where this is fair, expected and lawful; and

• from insurers, professional advisers, police, governing bodies, other clubs or regulators where needed to manage an incident, claim, complaint or legal obligation. Privacy information will be made available at the point of collection or, where information is obtained from another source, within the period required by law.

6. Why we use personal data and our lawful bases

The lawful basis depends on the specific activity. More than one basis may apply. Consent is not used where another basis is more appropriate, and withdrawing marketing consent will not prevent the Club from sending necessary service messages.

Membership administration

Purpose: Process applications; manage subscriptions, benefits, records, renewals, resignations and member services.

Lawful basis: Contract; steps before a contract; legitimate interests; legal obligation where applicable.

Bookings, competitions and golf administration

Purpose: Manage tee times, visitor bookings, competition entry/results, handicaps, teams, reciprocals, course operations and emergency contact.

Lawful basis: Contract; legitimate interests in operating the Club and the sport; legal obligation where applicable.

Payments, accounts and tax

Purpose: Collect payments, issue invoices, reconcile accounts, prevent fraud and maintain statutory financial records.

Lawful basis: Contract; legal obligation; legitimate interests.

Clubhouse, catering and events

Purpose: Manage reservations, dietary or accessibility needs, event attendance and customer service.

Lawful basis: Contract; legitimate interests; consent or substantial public interest/vital interests where sensitive information is necessary.

Member app

Purpose: Create and secure accounts, authenticate users, enable group communication, coordinate games, send requested notifications, moderate content and investigate misuse.

Lawful basis: Contract; legitimate interests in providing a safe member service; consent for optional device access or notifications where required.

Enquiries and prospective members

Purpose: Respond to questions, provide information, arrange visits or interviews, follow up applications and assess interest in membership, events or services.

Lawful basis: Steps before a contract; legitimate interests; consent where required for the chosen marketing channel.

Routine communications

Purpose: Send membership, booking, competition, payment, course-status, safety, governance and service notices.

Lawful basis: Contract; legitimate interests; legal obligation. These are not direct marketing merely because they are sent by email or text.

Email, text and social- message marketing

Purpose: Promote membership, visitor golf, competitions, functions, offers, sponsorship, Club news and similar Club products or services.

Lawful basis: Consent, or the products-and-services soft opt-in where all PECR conditions are met; legitimate interests for the associated personal-data processing where appropriate.

Live telephone marketing

Purpose: Follow up enquiries and promote relevant Club services by live call.

Lawful basis: Legitimate interests where appropriate, subject to PECR, the TPS/CTPS and prior objections; consent where required.

PPC, Meta ads and online advertising

Purpose: Display advertisements, understand campaign performance, measure conversions, limit repetition, create or exclude audiences and improve marketing.

Lawful basis: Consent for non-essential storage/access technologies where required; legitimate interests or consent for related personal- data processing depending on the method and privacy impact.

Customer-list audience matching

Purpose: Where enabled, use appropriately protected identifiers to create, exclude or measure advertising audiences on platforms such as Meta and Google.

Lawful basis: A documented lawful basis following a legitimate-interests assessment or valid consent, as appropriate; a clear right to object; platform terms and safeguards.

Website and app analytics

Purpose: Maintain security, understand use, diagnose faults and improve services.

Lawful basis: Legitimate interests for strictly necessary security and limited operational data; consent for non-essential analytics and tracking where required.

Photographs, video and publicity

Purpose: Report Club activity, celebrate achievements, promote membership and maintain a historical record.

Lawful basis: Legitimate interests where use is reasonable and expected; consent for uses that are more intrusive, individually focused, sensitive or involve juniors where appropriate.

CCTV and security

Purpose: Protect people and property, deter and investigate incidents and support insurance or legal claims.

Lawful basis: Legitimate interests; legal obligation where applicable.

Complaints, discipline and legal matters

Purpose: Handle complaints, conduct investigations, enforce rules, protect legal rights and cooperate with regulators or law enforcement.

Lawful basis: Legal obligation; legitimate interests; contract; establishment, exercise or defence of legal claims.

Health, safety and safeguarding

Purpose: Respond to emergencies, protect children and vulnerable people, make reasonable adjustments and manage incidents.

Lawful basis: Vital interests; legal obligation; legitimate interests; appropriate special-category conditions.

7. Marketing, advertising and customer data

7.1 Service messages and direct marketing

The Club may use email addresses and telephone numbers to provide information requested by an individual and to administer memberships, bookings, payments, competitions, events and safety. These operational messages are different from direct marketing. We may also send promotional communications, but only where the relevant UK GDPR and PECR requirements are met.

7.2 Email, text and direct messages

• For individuals, we will use consent unless the limited products-and-services soft opt-in applies. The soft opt-in requires the Club to have collected the details directly during a sale or genuine negotiation for a sale, to market only its own similar products or services, and to offer an opt-out when collecting the details and in every later message.

• Email and text preferences will be collected separately where appropriate. Boxes will not be pre-ticked and marketing consent will not be made a condition of membership or purchase unless the marketing is genuinely necessary to the service.

• Every marketing email or text will identify the Club and include a simple way to opt out. Social-media direct marketing messages are treated as electronic mail for these purposes.

• We will retain a limited suppression record after an opt-out so that we do not accidentally contact the person again.

7.3 Telephone marketing

• We may telephone a person to respond to an enquiry, discuss an application or booking, or provide an expected service update.

• Before making unsolicited live marketing calls, the Club or its authorised agency will screen numbers against the Telephone Preference Service and Corporate Telephone Preference Service as applicable and against the Club’s own do-not-call list.

• We will identify the Club, display a contact number and stop marketing calls when asked. Automated marketing calls will not be used without specific consent.

7.4 Website forms, offers and Meta lead forms

The Club collects names, email addresses and telephone numbers through website enquiry forms, membership and event forms, promotional landing pages and, where used, Meta lead advertisements. Each form should contain a short privacy statement and a link to this notice. Details submitted for an enquiry will be used to respond and follow up the request. They will not automatically be added to unrelated marketing lists unless consent has been obtained or another lawful PECR route applies.

7.5 Google Ads, Meta Ads, retargeting and conversion measurement

The Club runs pay-per-click and social-media advertising, including Google and Meta campaigns. Depending on the campaign and the user’s consent choices, the website or app may use cookies, pixels, tags, software development kits or server-side conversion tools to:

• record that an advertisement was viewed or clicked;

• measure whether an enquiry, booking or membership application followed;

• create audiences of people who visited particular pages or interacted with Club content;

• exclude existing members, customers or people who have opted out from selected campaigns;

• show more relevant advertisements and reduce repeated advertising; and

• produce aggregated campaign reports. Non-essential advertising and analytics technologies will not be activated before valid consent where consent is required. Refusing or withdrawing consent must be as easy as accepting, and will not affect access to essential website or app functions.

7.6 Customer Match, Custom Audiences and hashed identifiers

Where the Club has approved this use, contact data such as an email address or telephone number may be transformed into a protected “hashed” value and uploaded to an advertising platform, such as Meta Custom Audiences or Google Customer Match, to find an existing platform account, create or exclude an audience, or measure advertising. Hashing reduces direct readability but the data remains personal data during this process. The Club will only use this feature where it has:

• clearly told the person about the use;

• identified and documented an appropriate lawful basis;

• completed any necessary legitimate-interests or privacy impact assessment;

• provided a clear way to object or opt out;

• used only appropriate first-party data and complied with platform terms; and

• ensured that people who object to direct marketing are excluded from future uploads. The Club does not make decisions producing legal or similarly significant effects solely through advertising profiling. Advertising platforms may independently profile users under their own privacy notices.

8. Website, cookies and similar technologies

The Club’s website and app may use storage and access technologies, including cookies, pixels, tags, local storage and app software development kits. The Club will maintain a separate cookie notice or consent- management panel that lists the technologies currently in use, their providers, purposes and duration.

Strictly necessary

Purpose: Security, log-in, load balancing, fraud prevention, booking functions and recording consent choices.

Control: Used without consent only where the legal exception applies; still explained to users.

Preference or functional

Purpose: Remember choices and provide optional functionality.

Control: Consent where required.

Analytics

Purpose: Understand site/app use, performance and faults.

Control: Consent unless a specific legal exception applies and all conditions are met.

Advertising

Purpose: Meta Pixel, Google advertising tags, retargeting, audience measurement and conversion reporting where enabled.

Control: Valid consent before activation where required; related UK GDPR lawful basis also documented.

• Non-essential technologies will not be set or accessed before the user’s valid choice where consent is required.

• The banner will offer a genuine reject option and allow preferences to be changed later.

• Consent records will be kept for an appropriate period, and fresh consent will be sought when material uses change.

• The Club will audit the website and app periodically to identify all technologies actually in operation.

9. Member app privacy

The Club offers a messenger app designed to help members coordinate games and communicate in Club groups. Users may register using an email address, Apple ID or Google account. The following additional terms apply:

• The app may receive a unique account identifier and limited profile information from Apple or Google. The Club does not receive the user’s Apple or Google password.

• Posts, replies, game preferences, profile names and other content submitted to a group may be visible to other authorised members of that group. Users should not post another person’s contact details, health information or other sensitive information without permission.

• The Club and app provider may process device information, IP address, security logs, crash information and notification tokens to operate, secure and improve the app.

• Optional push notifications or access to device features will be controlled through app and device settings and will not be enabled contrary to applicable consent requirements.

• The Club may moderate, remove or retain content where reasonably necessary to enforce rules, protect members, investigate complaints or meet legal obligations.

• Access is intended for authorised Club members. Junior access and group design must be reviewed against safeguarding requirements and age-appropriate privacy standards.

10. Photographs, video, website and social media

The Club may take or receive photographs and videos at competitions, prize-givings, team matches, open days, coaching sessions, social events and other Club activities. These may be used on the Club website, app, social- media channels, newsletters, press releases, printed materials and historical archives.

• Prominent signage or event information will be used where practical to explain that photography is taking place and how to raise an objection.

• General crowd or event images may be used under legitimate interests where the use is reasonable and unlikely to cause harm or surprise.

• Specific consent will be sought where appropriate for posed promotional features, testimonials, sensitive contexts, close-up junior content or uses that an individual would not reasonably expect.

• A person may ask not to be photographed or may object to a proposed or continuing marketing use. The Club will consider and respect reasonable objections and will remove content under its control where legally required and reasonably practicable.

• Withdrawal cannot always remove material already printed, lawfully reported by the press, independently shared by others or retained for legal or historical reasons, but the Club will prevent new use where required.

11. Junior members and children

The Club recognises that children require particular protection. Information about junior members will be presented in clear, age-appropriate language and parents or guardians will be involved where appropriate. The Club will:

• collect only information needed for membership, coaching, competitions, communication, health and safety or safeguarding;

• use parent or guardian contact details for important communications where appropriate;

• avoid behavioural advertising directed at children and avoid using junior data for customer-list matching or retargeting;

• apply additional care to photographs, video, app groups, public competition information and social-media posts;

• restrict access to safeguarding and health information to people with a genuine need to know; and

• retain safeguarding or incident records for periods required by the Club’s safeguarding policy, insurers and applicable law.

12. Who we share personal data with

We may share personal data with the following recipients where necessary and lawful. The exact provider list must be maintained internally and updated when services change.

Golf and membership systems

BRS; HowDidIDo/Club Systems International; Scottish Golf and relevant golf unions or handicap bodies; competition organisers; reciprocal clubs.

App and authentication providers

The Club’s member-app developer/host; Apple and Google where a user selects their sign-in services; push-notification and security providers.

Website, CRM and communications

Website host/developer; enquiry-form, CRM, email, SMS, survey, cloud-storage, IT support and cyber-security providers.

Advertising and analytics

Google, Meta Platforms and other advertising, analytics, tag-management or consent- management providers used by the Club. Their role may vary by service.

Payments and finance

PayPal and/or other card or direct-debit processors; banks; accountants; auditors; debt collection services where necessary.

Club operations

Authorised employees, Board members, officials, captains, coaches, volunteers, professional-shop staff, catering providers and event organisers, limited to what they need for their role.

Professional and legal

Insurers, brokers, solicitors, professional advisers, investigators and claims handlers.

Public and regulatory bodies

HMRC, the ICO, police, courts, local authorities, safeguarding authorities and other regulators where required or permitted by law.

Other people

Host members, team members, competition participants, guests or the public only where the relevant information is reasonably necessary, expected and lawful. Contact details will not be published merely for convenience without an appropriate basis.

The Club does not sell or rent personal data. Suppliers must only use Club data for agreed purposes and must protect it appropriately. The Club will put written data-processing terms in place where required.

13. International transfers

Some technology, app, cloud, advertising, authentication and communications providers may store or access data outside the United Kingdom. Where UK restricted-transfer rules apply, the Club will use an approved safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with any required risk assessment. Individuals may contact the Club for information about the relevant safeguard.

14. How long we keep personal data

We keep data only for as long as needed for the purpose collected, including legal, accounting, insurance, safeguarding and complaint requirements.

Member and competition records

During membership and normally up to 6 years after it ends; selected historical competition results may be retained permanently as part of the Club’s sporting archive.

Unsuccessful enquiries and advertising leads

Normally 24 months after the last meaningful interaction, unless the individual asks us to stop sooner or a shorter campaign period is set.

Marketing contact and preference records

Until opt-out, withdrawal or inactivity review. Evidence of consent and minimal suppression information may be kept for up to 6 years after last use, or longer where necessary to respect a continuing objection.

Financial and payment records

Normally 6 years after the end of the relevant financial year or transaction relationship.

Visitor, booking and event records

Normally 3 years after the booking/event, or up to 6 years where needed for contractual, accounting or claims purposes.

App account and routine content

While the account is active and normally up to 12 months after closure; reported, disciplinary or legally relevant content may be kept longer.

Website/app security logs

Normally up to 12 months, unless required longer to investigate security, fraud or legal issues.

Cookies and advertising identifiers

As specified in the live cookie/consent panel and platform settings, typically from a session to 24 months depending on purpose.

CCTV

Normally 30 days, unless footage is required for an incident, complaint, insurance matter or legal claim.

Photographs and video

For as long as relevant to current communications or the Club’s legitimate historical archive, subject to objections, consent withdrawal where applicable and periodic review.

Complaints, discipline and legal claims

Normally 6 years after closure, or longer where proceedings, insurance, safeguarding or another legal requirement applies.

Junior safeguarding and incident records

In accordance with the Club’s safeguarding retention schedule, insurer requirements and applicable law; this may extend beyond the end of junior membership.

15. Security and data breaches

The Club uses measures appropriate to the nature and risk of the information, which may include role-based access, password protection, multi-factor authentication where available, secure cloud services, encryption in transit, backups, device controls, staff and volunteer guidance, supplier checks and secure disposal.

Access is limited to people who need the information for an authorised purpose. Suspected loss, unauthorised disclosure, cyber incident or misuse must be reported immediately to the Club Secretary. The Club will investigate, contain and document incidents and will notify the ICO and affected individuals where the legal thresholds are met.

16. Individual rights

Depending on the circumstances, individuals may have the right to:

• be informed about how their data is used;

• request access to their personal data;

• have inaccurate or incomplete data corrected;

• request erasure in certain circumstances;

• request restriction of processing;

• receive certain data in a portable format;

• object to processing based on legitimate interests;

• object at any time to the use of personal data for direct marketing — this right is absolute;

• withdraw consent at any time where consent is relied upon, without affecting earlier lawful processing; and

• challenge certain solely automated decisions with legal or similarly significant effects, although the Club does not currently make such decisions. A request may be made verbally or in writing. We may ask for proportionate information to verify identity. We will normally respond within one calendar month, subject to any lawful extension. Rights are not absolute and the Club will explain any lawful refusal or limitation.

17. Data protection complaints

Anyone who believes the Club has mishandled personal data may make a data protection complaint to the Club Secretary by email, telephone or post. The Club will:

• provide a clear way to submit a complaint;

• acknowledge receipt within 30 days;

• make appropriate enquiries and keep the complainant informed without undue delay; and

• communicate the outcome without undue delay. If the complainant remains dissatisfied, they may complain to the Information Commissioner’s Office. The ICO can be contacted through its website or by telephone on 0303 123 1113. A person may also have rights through the courts and should obtain independent legal advice where appropriate.

18. Contacting us and changing preferences

Privacy questions, rights requests or complaints

Club Secretary / Managing Secretary, Bonnyton Golf Club, Kirkton Moor Road, Eaglesham, Glasgow G76 0QA; secretary@bonnytongolfclub.com; 01355 303030 (option 1).

Email marketing opt-out

Use the unsubscribe link in the email or contact the Club office.

Text marketing opt-out

Use the stated opt-out method or contact the Club office.

Telephone marketing objection

Tell the caller or contact the Club office. The number will be added to the Club’s do-not-call list.

Cookie and tracking choices

Use the cookie-settings control on the website or relevant app/device settings.

Photography objection

Tell the photographer or event organiser, or contact the Club office as soon as possible.

19. Governance, review and changes

The Board is responsible for ensuring this policy is implemented. The Club will review it at least annually and whenever there is a material change to law, systems, suppliers, app functionality, marketing technology or Club activities. Material changes will be brought to the attention of affected individuals through an appropriate channel.

The Club will maintain or implement, as appropriate:

• a data map and record of processing activities;

• supplier contracts and data-processing agreements;

• legitimate-interests assessments and data protection impact assessments where required;

• records of marketing consent, source, wording, date, channel and opt-outs;

• a current cookie and tracking inventory;

• a retention and secure-deletion schedule;

• an incident and breach response process;

• a data protection complaints process; and

• appropriate briefing or training for employees, Board members, officials and volunteers handling personal data.