Privacy Policy

This Privacy Policy explains how Bednal Limited (company number 12582198, registered in England and Wales) ("we", "us", "our") collects, uses, and protects your personal data when you use tee-time.uk, the tee-time iPhone app and related services (the "Service"). It also explains how we use the work contact details of journalists and news desks we send press releases to (see "Press contacts" in clause 3). We are committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Policy should be read alongside our Terms & Conditions, our Cookies Policy and our Acceptable Use Policy.

1. Who we are and the data controller

Bednal Limited (company number 12582198), registered in England and Wales at Unit 4 Clifford Court, Cooper Way, Carlisle, England, CA3 0JG, is the data controller for personal data processed in connection with the Service. Bednal Limited is registered with the UK Information Commissioner's Office (ICO) as a data controller, registration number ZC286502. Our data protection contact is: support@tee-time.uk.

2. What data we collect

We collect and process the following categories of personal data:

1. Data you provide directly
   1. Identity data: your name, email address, and UK mobile phone number;
   2. Optional profile data: home club, profile photo, and any handicap you entered before we started calculating one (kept read-only and used only until you have a tee-time handicap);
   3. Authentication data: WebAuthn public-key credentials (passkeys) bound to your device; we never see or store the underlying private key or any password;
   4. User Content: reviews, social posts (including "looking for a game" posts), comments, reports you make about other users, and any messages you submit through the Service.
   5. Feedback: when you use Send feedback or report a problem, we keep your message, the category you chose, any screenshot you attach, an email address if you give one while signed out, and basic technical details (the page you were on, your browser, operating-system and device type, whether tee-time is installed as an app, whether you were online, the app version and recent error messages from that browser tab). We do not keep your IP address or location with it.
   6. Payment data: if you save a card or buy booking credits, Stripe collects your card details directly, including for green-fee payments made in the app or in a club's booking widget. Where your device offers them, you can also pay with Apple Pay or Google Pay, which pass the card held in your wallet to Stripe in the same way. We receive and keep the card brand, last four digits and expiry date, whether the card is held in Apple Pay or Google Pay (the wallet type, which Stripe tells us), a Stripe customer reference, and the history of booking fees, credits, promotion redemptions and receipts on your Account. To apply "one per person" to promotions, we keep a one-way keyed fingerprint of your email address and phone number with each promotion you redeem; it cannot be turned back into your details and is deleted when your Account is deleted. We never see or store your full card number or security code. If you subscribe to tee-time Plus, we also keep your plan, its status and renewal dates, your Plus payments and refunds, any request you make to cancel and get a refund, the version of our Terms and the key information you accepted when you subscribed, and a record of the Plus emails we have sent you. For the subscription, Stripe collects your card details, the name on the card and, where your card needs them, its country and postcode.
   7. Club agreements: if you sign tee-time's Club Services Agreement for a golf club in the club portal, we keep the name and job title you type, the time you signed, the version and exact text you signed, your confirmation that you are authorised to sign for the club, and, as evidence of the signature, the IP address and browser details (user-agent) you signed from. If you accept a club's data processing agreement with us, we keep your name as it was on your Account, the club's name and the version and text you accepted.
   8. Messages you send us: when you email one of our addresses (for example support@, hello@, clubs@, admin@ or press@tee-time.uk), we keep your message, any attachments, your email address and name as your email app sends them, so we can read and answer it.
   9. Deal alerts: if you sign up for our weekly tee time deals email, your email address, the first part of your postcode (for example WR1) or your approximate location (rounded to about 1 km), how far you'll travel, and when and where you agreed to receive it. You don't need an Account for this.
2. Data we collect automatically
   1. Booking activity: the courses, dates, and times you select; the outcome of each booking attempt (success, ambiguous, or one of several failure modes);
   2. Booking diagnostics: a BookingAttemptLog row per booking attempt that records the platform response shape (status code, latency, parsed confirmation reference where present) — this is our debugging lifeline when a third-party site changes shape;
   3. Technical data: IP address, user-agent string, device type, browser, and approximate region inferred from IP;
   4. Session data: a Better Auth session cookie tying your browser to your Account, plus small functional cookies and on-device storage (for example your theme preference). The full list is in our Cookies Policy;
   5. Location data: your device location, only when you use a location feature and your browser allows it, or a postcode you type instead. See clause 6 for exactly what is used, what is sent to us (rounded to about 1 km, and not stored unless you post that you're looking for a game) and how to turn it off.
   6. Analytics and advertising data. If you opt in through the cookie banner: Google Analytics and Google Ads cookie identifiers, the pages you view (without query strings, except campaign tags such as utm_source that say which newsletter, post or advert a link came from), the features you use (for example a search, a course viewed, a booking confirmed and its value), your device and browser type, and whether a Google ad led to your sign-up or booking. Before you make a choice, Google receives cookieless signals about page views, feature use and whether an ad led to a sign-up, your browser and device type and your IP address, with no cookie identifiers (see our Cookies Policy, clause 7); once you say no to a category, it receives nothing more for it. We never send Google your name, email address, phone number, precise location or booking references;
   7. Scorecards and your tee-time handicap: the rounds you record (course, date, tees, scores and any optional statistics such as putts) and the tee-time handicap we calculate from them with World Handicap System maths. It is our own estimate, not an official WHS Handicap Index. We recalculate it when your recorded rounds change, when a course rating or slope for a round you have played is added or corrected, or when we improve the calculation; it is shown to you, to other users only if you turn on social features, and to Clubs as described in clause 7.9.
   8. Marketing email activity: whether each marketing email we send you is opened and which of its links you click, with the time (see "Marketing emails" in clause 3). This covers welcome emails, tips, nudges, seasonal and offers emails, and individually written emails from our founder sent through our email tool. Service emails are never tracked this way.
   9. Your marketing choice: whether you have said yes to news and offers, where and when you said it (for example the sign-up form, Account, Preferences, a booking or an unsubscribe link), and the date of each marketing email we send you, so we can keep to the limit on how often we email you (clause 3).
   10. Visit counts: when you open a page on tee-time.uk (for example the home page, search results, a club, course or Scout page, or the sign-up page) or a page of a club website we host, when you search, or when you press Book, your browser tells us which page it was in a general form (for example "a club page", never which club, and never the full address, a code in it or anything you searched for), the kind of site that sent you there (for example a search engine or social media; we keep the kind only, never the address), and whether tee-time is installed as an app. When you use one of its features (for example a Scout fly-over, the tee view or logging a round), your browser tells us which feature it was in the same general form, never the course or anything else about you. If a sign-in or sign-up doesn't go through (for example a wrong or expired email code, a passkey that wasn't found or was cancelled, or a Google or Apple sign-in you cancelled), we count it in the same way, with the step it stopped at and the general reason, so we can see where people get stuck; we never keep the email address you typed or anything else you entered. We work out your device type (phone, tablet or computer) from your browser and then discard it. We add one to a daily total and keep nothing else: no cookie, identifier, IP address or browser details, so a count can't be traced back to you or linked to your other visits. We don't count pages in our admin area, the club portal or the booking widget, or unsubscribe and confirmation links, and we don't count our own team while they are signed in. You can turn this off (clause 5).
   11. Usage of the Service while you are signed in: the main steps you take in tee-time while signed in to your Account (signing up and in, searching, opening a course or club page or Course Scout, starting a booking and whether it went through, viewing or starting tee-time Plus, saving a card, buying booking credits, and using features such as Course Scout's tools (for example the fly-over, tee view or tee choice), the map view, logging or sharing a round, social play, reviews, feedback, deal alerts, invites, lessons and the app's install and notification prompts), with the time, the kind of page, whether you use a phone, tablet or computer (where we can tell), and a few details of the step (for example the search filters you chose, the course, the number of players, the booking's status, the Plus plan or which feature). We do not record your name, email, phone, IP address, location, what you type, booking references or amounts paid with it. It is stored under a code made from your Account instead of your Account itself, and no cookie or other storage on your device is used for it. Unlike visit counts (item 9), it is linked to your Account by that code. See "Usage data" in clause 3.
   12. Your cookie choice: if you make or change your cookie choice while signed in, we keep on your Account whether you agreed to analytics and to advertising cookies, the version of our Cookies Policy you answered, when and where you answered (the cookie banner, Cookie settings or the question after sign-up, or that it was copied from one of your devices), and the random identifier of that choice.
   13. The iPhone app: if you use the tee-time iPhone app, it sends our servers the app's version and build number with each request, and keeps your sign-in on your iPhone in Apple's Keychain. If you allow notifications, the app gives us a push notification token from Apple, which we keep linked to your Account with whether notifications are allowed, whether it is a test or live token, the sign-in it was registered from, and when it was registered and last used, so we can send you the notifications you choose (for example booking updates, round-day reminders and, if you turn them on, review requests). The app also keeps on your iPhone how you last signed in and the notification token it last gave us. If you choose to scan a card when paying, the app uses your iPhone's camera through Stripe's card scanner only to read the card into the payment form; nothing from the camera is recorded or kept, and the card details then go to Stripe as described in clause 2.1.6.
3. Data from third parties
   1. If you sign in with Google, Google provides us with your email address and basic profile (name, profile picture URL) per your consent given at Google.
   2. If you sign in with Apple, Apple provides us with your email address and, where you choose to share it, your name. If you choose Apple's "Hide My Email" option, the address we receive is a private relay address ending @privaterelay.appleid.com. Apple forwards email sent to that address on to your real inbox; we never see your underlying email. Apple also gives us a token that lets us end tee-time's access to your Apple ID. On the website Apple sends it with your sign-in. In the iPhone app, the app passes us a one-time code from Apple and we exchange it with Apple for the token, which we keep encrypted. We use the token only to end that access when you delete your Account.
   3. If another golfer reports you, we hold their report: the reason, their description and a copy of the reported text.
   4. Press contacts: if you are a journalist or work on a news desk, the work contact details your publication lists publicly for the press, for example on its contact or newsroom page: the publication and desk, the email address and, where the publication lists them, your name and role, with the address of the page we found them on and the date we checked it. If you are a freelance journalist, we hold only the details you gave us when you asked to receive our press releases. We also keep a record of the releases we send you and whether you have asked us to stop.

We do not intentionally collect special-category data (race, health, religion, political opinions, biometric data, etc.). If you choose to disclose such data in a review or social post, please be aware it becomes part of your User Content.

3. How we use your data

We process your personal data for the following purposes:

Marketing emails. We send news and offers by email only if you create an Account on our sign-up form without ticking the box described in "Marketing when you sign up" below, or you say yes under Account, Preferences, or after you book a tee time in the tee-time app without ticking the box described in "Marketing after a booking" below, or if your Account was created before 14 November 2026 (see "Accounts created before 14 November 2026" below); otherwise it is off unless you turn it on. Our marketing emails (welcome, tips, nudges, seasonal and offers emails, and individually written emails from our founder sent through our email tool) show us whether each marketing email is opened (from a small image in the email) and which of its links you click, and when, whichever way you came to receive them. Each of these emails says so in its footer. We use this only to learn what golfers find useful, and it is approximate: some email apps, such as Apple Mail and Gmail, load images on your behalf, so we count those loads separately and don't treat them as an open. Every marketing email has an unsubscribe link, which stops all of them, and your email app's own unsubscribe button stops them in one click; you can also turn marketing emails off under Account, Preferences, or reply and ask us. Saying no, or changing your mind later, stops both the emails and the tracking straight away and doesn't affect anything else in your Account. Service emails (about your Account, your bookings, our policies or security) are sent whether or not you say yes and are never tracked this way. If an email we send you bounces or is reported as spam, our team's email tool stops emailing that address.

Review requests. After a round you book in the Tee Time app or on our website, we may ask you how the course was, with a link to write a review: in Tee Time when you next open it, by email about a day after your tee time and, if you allow notifications from Tee Time and turn on review requests, by a notification. We ask at most twice about a round, never more than once a day, and never after you've reviewed it, reviewed that course in the last 30 days, or told us not to ask. We never ask about bookings made through a club's own website or booking widget. These requests contain no offers and we don't track whether review emails are opened. To stop review emails, use the "Stop review emails" link in any of them, your email app's unsubscribe button, or turn off Review requests by email under Account, Preferences; to stop notifications, turn off Review requests under Account, Notifications. This doesn't affect your booking emails or reminders.

Marketing when you sign up. The sign-up form shows an unticked box saying "Don't send me news and offers from Tee Time". If you leave it unticked and create your Account, we may email you news and offers about our own similar services: booking tee times with tee-time, tee-time Plus and deals on tee times, and the emails described in "Occasional emails about Tee Time" below. We do this under PECR reg. 22(3) (sometimes called the "soft opt-in"), not your consent, and we record that it came from the sign-up form and when. If you tick the box, we send you no marketing emails because of signing up. This applies only when you create your Account on the sign-up form, where the box is shown; an Account created another way (for example in the iPhone app) is not sent marketing emails because of signing up. Like our other marketing emails, these show us whether they are opened and which of their links you click (see "Marketing emails"). You can stop them at any time under Account, Preferences, with the unsubscribe link in any of these emails, or by replying to us. Before 14 November 2026 the box was an unticked "Send me news and offers" box, and we emailed you only if you ticked it; a yes given that way still stands.

Occasional emails about Tee Time. If you receive marketing emails from us, we may send you occasional emails about tee-time itself: a welcome or a short note from the person who runs it, tips on getting started and on getting the most from a round you've booked (for example a course preview and the forecast a few days before, or a reminder to add your score afterwards), a nudge if you haven't been back for a while, and seasonal golf campaigns. We send at most one marketing email in any 48 hours, counting everything: news and offers, the emails in this paragraph and, if you have signed up for them, weekly deal alerts. One unsubscribe link, in any marketing email, stops all of them (it doesn't stop service emails, which are about your Account, your bookings, our policies or security).

Personal emails from our founder. Now and then the person who runs tee-time writes to people who use the app, one at a time and in their own words, to ask for feedback on how it is working. These are individually written emails, not a mailing, and they come from a tee-time.uk address. When we send one through our email tool as a marketing email, it shows us whether it is opened and which of its links you click, as described in "Marketing emails"; a service email never does. You can reply to them, or tell us you would rather not hear from us, and we stop. We keep a record of these emails as we do of other emails from our team (clause 9.14).

Marketing after a booking. When you book a tee time in the tee-time app, we show an unticked box saying "Don't send me news and offers from Tee Time" with the Book button, if you haven't already made a choice about marketing emails. If you leave it unticked and the booking goes through, we may email you news and offers about our own similar services: booking tee times with tee-time, tee-time Plus and deals on tee times. We do this under PECR reg. 22(3) (sometimes called the "soft opt-in"), not your consent. Like our other marketing emails, they show us whether they are opened and which of their links you click (see "Marketing emails"). If you tick the box, we record that and send you no marketing emails. A booking never changes a choice you have already made, and bookings made through a golf club's booking widget or website don't count. Every one of these emails has an unsubscribe link, and you can stop them at any time under Account, Preferences or by replying to us.

Accounts created before 14 November 2026. On 17 October 2026 we switched news and offers emails on for the Accounts that existed at that time, and on 14 November 2026 we did the same for Accounts created since then that had not made a choice about marketing emails. If your Account was created before 14 November 2026, you may receive these emails although you didn't say yes to them under Account, Preferences. Like our other marketing emails, they show us whether they are opened and which of their links you click (see "Marketing emails"). You can turn them off at any time under Account, Preferences, or with the unsubscribe link in every one of these emails, and we stop straight away. If we show you the box described in "Marketing after a booking" when you next book a tee time in the tee-time app, the choice you make there replaces this setting. The emails described in "Occasional emails about Tee Time" and the limit of one marketing email in any 48 hours apply to these Accounts too, and the sign-up box described in "Marketing when you sign up" does not affect an Account that already exists.

Deal alerts. If you sign up for deal alerts, we email you once a week, on Wednesday evenings, with up to six courses within the distance you chose that have a special price or a tee time well under their usual price in the week ahead. If there aren't any, we don't email you. We only start once you've confirmed your email address from the message we send you. To work out which courses are near you we look up your postcode with postcodes.io, an open postcode service; if you use your location, we round it to about 1 km on your device before it reaches us. We keep only the first part of your postcode and that rounded point, never your full postcode or exact location. We don't track whether you open these emails. Use the unsubscribe link in any of them, or your email app's unsubscribe button, and we stop straight away. Signing up for deal alerts doesn't change your other email choices.

Usage data. While you are signed in, our servers note the main steps you take in tee-time, as listed in clause 2.2, so we can see where tee-time works well and where golfers get stuck, for example how many searches lead to a booking. If you have also said yes to news and offers, we may use the course pages you opened in the last three days to send you one email about tee times at a course you looked at but didn't book. We send at most one of these in any 30 days and never more than one about the same course. This is worked out automatically; our team still doesn't look at one person's steps. Turning off usage data, or unsubscribing from marketing, stops these emails. This is our own record, kept in our own systems; we don't share it with Google or anyone else, and it is separate from Google Analytics, which only runs if you accept analytics cookies. Each step is stored under a code made from your Account using a secret key, not under your name or Account, and our team only ever looks at totals across all golfers, never at one person's steps. Nothing is recorded when you are signed out. You can turn it off under Account, Preferences ("Help improve tee-time with usage data"): we stop straight away and delete what we have already noted. Turning it off doesn't affect anything else, and it is separate from the Club statistics switch in clause 5, which covers the visit counts we keep for golf clubs.

Press contacts. Now and then we send press releases, such as our monthly UK Green Fee Index, to journalists and news desks. We use only the work contact details a publication lists publicly for the press, for example on its contact or newsroom page, and we prefer a desk address to a named person's. We email a freelance journalist only if they have asked to receive our releases. Each release comes from press@tee-time.uk, says it is from Bednal Limited, links to this Policy and tells you how to stop. We don't track whether press releases are opened or which of their links are clicked. If you tell us you'd rather not receive them, by replying to a release or by emailing support@tee-time.uk, we stop straight away, whatever the reason.

Where we rely on legitimate interest, we have weighed those interests against your rights and freedoms and we believe our processing is proportionate. You can object at any time — see clause 10.

4. intelligentgolf guest accounts

To book at clubs that run on the intelligentgolf platform, the Service automatically creates a per-club guest account on your behalf the first time you book there. We generate a unique email address (of the form <your-user-id>+<course-slug>@<guest-domain>) and a random password. The password is encrypted at rest using AES-256-GCM with a key we control, and is only ever decrypted in memory during a booking attempt. The Club's intelligentgolf system stores the guest account on its own infrastructure; you can request deletion from the relevant Club separately.

5. Cookies and similar technologies

We use strictly necessary cookies and on-device storage to sign you in, take bookings and payments, and remember your settings. With your consent only, we also use Google Analytics (analytics) and Google Ads (advertising) cookies. Nothing in those two categories is set until you opt in, and you can withdraw at any time through the Cookie settings link at the bottom of every page. Before you choose, the Google tag sends Google cookieless signals, as our Cookies Policy explains; once you say no to a category, it sends nothing more for it. If you are signed in when you choose, your choice is saved to your Account and applied when you sign in on your other devices for six months; signing up is never taken as agreeing.

We also count visits to every page of tee-time.uk, and to golf clubs' pages and the club websites we host, without cookies, so we can see which pages are used and where people stop on the way to a booking, and so clubs can see how many people find and book them. This uses a small script that sends one request to our own servers per page view, and one when you use a feature; it stores nothing on your device and sets no identifier, and we keep only daily totals. You can switch it off at any time under Club statistics on this page (we then keep a small cookie, tt_insights_off, so we remember your choice, on tee-time.uk and on club websites we host at tee-time.uk addresses), and we never count you while your browser sends a Global Privacy Control signal.

While you are signed in, our servers also note the main steps you take in tee-time (see "Usage data" in clause 3). That uses only the sign-in cookie you already have and sets nothing new on your device.

Our Cookies Policy lists every cookie and storage item, what it is for, who sets it and how long it lasts.

6. Your location

1. What we use. Your device's location, only when you use a feature that needs it and your browser or phone has given permission. Alternatively, a UK postcode you type in Set location, which we use instead of your device location. We never track your location in the background.
2. What it is for. Showing courses near you, the distance to each course and tee time, sorting and filtering search results by distance ("near me"), your position on the map, open games near you, and matching your "looking for a game" posts with games nearby. Driving directions open in your own maps app, which uses its own location services under its own privacy policy; we do not send your location to it.
3. What stays on your device. Distances are worked out on your device. Your last location (or the postcode you chose) is saved in your browser's local storage (userLocation) so we don't have to ask every visit. A device location older than one hour is not relied on: we refresh it when you next use a location feature (without asking again if you have already allowed it), or ask you first, or show its age. It stays on your device until you press Clear in the location settings, clear your browser's site data, or withdraw location permission, at which point the saved device location is deleted.
4. What is sent to us. Some features ask our servers for results near you: popular courses near you, open games near you and search results within the distance you choose (or sorted by distance), unless you turn off Use my approximate location for search in your Account. For these, your device first rounds your location to a grid of about 1 km, so we never receive your precise position. We use the rounded location only to answer that request and do not store it in our database, except with a "looking for a game" post (item 7). Like every web request, it can appear in our hosting provider's (Vercel's) request logs, which are kept for a short period under Vercel's standard log retention and used only for security and fixing faults.
5. postcodes.io. To show the name of your nearest town, your browser sends your exact device coordinates directly to postcodes.io, a free UK postcode lookup run by IDDQD Limited (Ideal Postcodes), London. When you type a postcode, that postcode is sent to them to look up its location. Rounding is not applied here because it can change which town is shown. They receive the coordinates or postcode and your IP address, but nothing that identifies your Account. Their handling is described in the Ideal Postcodes privacy policy.
6. How to turn it off. Deny or withdraw location permission for tee-time.uk in your browser or phone settings (on iPhone: Settings → Privacy & Security → Location Services; for the tee-time iPhone app: Settings → Tee Time → Location); turn off Use my approximate location for search in your Account (search then sends no location and the distance filter is unavailable); or type a postcode instead of using your device location. Everything except the location features keeps working.
7. "Looking for a game" posts. When you post that you're looking for a game, you choose the dates, the time of day, how far you'll travel and, if you like, a handicap range and a short note. We store your location with the post, rounded to about 1 km, so we can match it with games nearby. A golfer hosting a game that matches your post sees your name, profile photo, home club and handicap, with the post's dates, time of day, travel distance, handicap range and note, and can invite you to play. Hosts never see your location or how far you are from the course. We delete the post, including its location, 30 days after it ends (when its last date passes or you close it). Turning off social features or deleting your Account closes your posts straight away.
8. In the iPhone app. The app asks your iPhone only for your approximate location, never your precise location, and only when you choose Near me in search. It rounds it to about 1 km on your iPhone before sending it to us (as in item 4), and keeps it only while you're using it: it is never saved on your iPhone. Use my approximate location for search applies in the app too. The app doesn't use postcodes.io.

7. Who we share your data with

We only share your personal data where it is necessary and lawful to do so. Our sub-processors include:

1. Vercel Inc. — application hosting (functions, edge cache, blob storage). Data location: primarily UK / EU (lhr1).
2. Neon Inc. — managed PostgreSQL database. Data location: eu-west-2 (London).
3. Resend — email delivery: transactional and service emails, tee-time Plus receipts, reminders and payment emails, emails our team sends you and, if you opt in, marketing emails. Resend tells us whether each email was delivered, bounced or reported as spam.
4. Vercel Blob — storage of user-uploaded avatars and feedback screenshots.
5. Cloudflare, Inc. — receives email sent to our tee-time.uk addresses and passes it to our team's mailbox, which is hosted by Google (Gmail), and to our own systems (Vercel and Neon, above) so we can read and answer it there.
6. Push services (Apple Push Notification service, Firebase Cloud Messaging): delivery of the push notifications you allow, in your browser or in the tee-time iPhone app.
7. Better Auth (open-source library) — runs in our infrastructure; not a separate processor.
8. Stripe Payments Europe, Ltd. — payment processing for booking fees, credit bundles, tee-time Plus subscriptions (Stripe Billing) and green-fee payments made in the app or in a club's booking widget. In the tee-time iPhone app, Stripe's own software collects your card or Apple Pay details directly; we never receive your full card number. Stripe also acts as an independent controller for some data it needs for fraud prevention and to meet its own legal obligations; see Stripe's privacy policy.
9. Google Ireland Limited / Google LLC — Google Analytics and Google Ads measurement: cookie-based measurement only if you opt in to analytics or advertising cookies, and cookieless signals before you make a choice (see our Cookies Policy). Google acts as our processor for Analytics and as an independent controller for some advertising purposes.
10. The booking platforms — at the moment you make a Booking, the Service submits the data the platform requires to complete a visitor booking on your behalf. Platforms currently in use: ClubV1, BRS Golf, intelligentgolf, Sahara, ESP/EliteLive, and Chronogolf. We share only what each platform requires (typically: name, email, phone and, where the platform asks for one, optionally your tee-time handicap or the handicap you entered before we calculated one). Each platform applies its own privacy policy to that data.
11. postcodes.io (IDDQD Limited, UK): town and postcode lookups made by your browser when you use location features. It receives exact coordinates or a typed postcode, never your Account details. See clause 6. When you sign up for deal alerts, the postcode you enter (or your location, already rounded to about 1 km) is sent to postcodes.io to find the area it's in. Nothing else about you is sent.
12. Apple (Sign in with Apple): to sign you in with Apple, and to end tee-time's access to your Apple ID when you delete your Account.

Coaches and clubs, for lessons. When you book a lesson we share your name, email address and phone number, the first names and ages of the students you enter, and anything you write about what you'd like to work on, with the coach and the club, so they can deliver the lesson. The club keeps its own record of you as its customer and is the controller of that record. The coach or the club is the seller of the lesson; we take the payment as their agent.

Linking a club membership. If you're a member of a club that runs its tee sheet on tee-time, the club can invite you to link your Account to its member record, or give you a link at the desk. Nothing is linked until you open that link and confirm. If the link was emailed to you and your Account's email address isn't verified or doesn't match the club's record, the club confirms the link first. Once linked, the club sees your display name, your email address with most of it hidden, and the bookings you make at that club; it does not see your bookings anywhere else, your payment details or anything else in your Account. The club is the controller of its own member record (your name, contact details, membership number and category) and keeps it under its own policies; linking doesn't copy your Account details into it. You can unlink at any time under Account, Club memberships: the club keeps its member record and your past bookings there, but no longer sees your Account. When we delete or anonymise your Account data (clause 9.1), the link is removed in the same way.

Reciprocal rights at other clubs. If your club has a reciprocal agreement with another club, or with a group of clubs, you can choose to use your membership there. When you choose to, we tell that club your name, that you are a member of your club, your membership category and the date your membership is due for renewal, and we keep telling it while your membership is current, so it can apply the agreement. We count the reciprocal rounds and guests you book to apply the agreement's limits. Your own club sees only how many reciprocal rounds its members play at each partner club, not who. You can stop sharing at any time under Account, Reciprocal rights; bookings you have already made stay with the club you booked. If your membership ends or you unlink it, we stop sharing it.

If you joined through a friend's invite link, we tell that friend your first name when your first payment earns them referral credits (Terms clause 5.8.12). We share nothing else about you with them.

Golf clubs that use the tee-time club portal

Some clubs run their tee sheet on tee-time. When you book one of those clubs, through our app or through the club's booking widget, the club gets a customer record for you (your name, email address and phone number, and your bookings at that club) so it can run your booking. When you book in our app, that record is linked to your tee-time account, and bookings the club later makes for you also appear in your account and are emailed to you.

Club staff can also add people to their customer list themselves, for example when you book by phone or walk in. For those records, and for everything the club adds (notes about a booking, the names of the people playing with you, what you paid at the counter), the club is the controller and we process the data on the club's behalf under a data processing agreement. Ask the club if you want a copy of that data or want it erased; if you ask us, we will pass your request to the club.

Clubs see daily totals of how often their courses appear in tee-time search results and how often their pages are viewed, with the kinds of site visitors came from and their device types. These totals never identify you.

If you delete your tee-time account, we unlink the club's records from it. The club keeps its own records of the rounds you played there, as it would on any other booking system. Club records with no account and no booking for six years are anonymised automatically.

We may also disclose personal data where required by law, by a court of competent jurisdiction, or to defend our legal rights.

8. International transfers

Some of our sub-processors operate outside the UK (notably Vercel, Resend, Cloudflare, Google for our team's mailbox and Google (for analytics and advertising measurement), which are US-headquartered). Where personal data is transferred outside the UK, we rely on one or more of the following safeguards:

1. UK adequacy decisions where they exist;
2. Standard Contractual Clauses approved by the UK Information Commissioner ("ICO");
3. The UK Addendum to EU Standard Contractual Clauses.

9. Data retention

1. Account data is retained for as long as your Account is open. If you delete your Account, we delete or anonymise it within 90 days, except where law requires longer retention.
2. Booking confirmations are retained for as long as your Account is open, then anonymised on deletion. Our record that we asked you for a review of a booking, and whether you said not to ask again, is kept with that booking. It holds nothing about you beyond the booking it belongs to.
3. BookingAttemptLog rows (debug data) are retained for 12 months and then deleted on a rolling basis.
4. Cached availability data is ephemeral — it is overwritten on each refresh and contains no personal data.
5. Encrypted intelligentgolf guest-account credentials (IGGuestAccount.passwordEnc) are retained for as long as your Account is open. On deletion they are removed; the corresponding guest account at the Club is not automatically deleted (you may need to request that from the Club).
6. Feedback (messages, screenshots and their technical details) is deleted 12 months after we close it, or 24 months after you sent it if it is never closed. If you delete your Account, your feedback is deleted with the rest of your Account data.
7. Location sent to us (rounded to about 1 km) is not stored in our database, except with a "looking for a game" post (item 11); it may remain in our hosting provider's request logs for their short standard retention period. Your last location saved on your device stays there until you clear it (clause 6).
8. Payment records (booking fees, credits, promotional credits, credit purchases and their VAT receipts) are kept for six years after the end of the financial year they relate to, to meet our tax and accounting obligations, even if you close your Account. Saved-card display details (brand, last four digits, expiry and whether the card is held in Apple Pay or Google Pay) are deleted when you remove the card or your Account is deleted.
9. tee-time Plus records (your subscription history, payments, refunds, and the terms and key information you accepted) are kept for six years after the end of the financial year they relate to, even if you close your Account. If you delete your Account we cancel Plus straight away. When we then delete or anonymise your Account data (clause 9.1), we also delete the record of the Plus emails we sent you and, for any Account with a customer record at Stripe (Plus or booking fees), remove your name, email address, phone number and address from that record and detach your saved cards. We do not delete the Stripe customer record itself, and Stripe keeps the invoices and payment records it holds, as its own legal obligations require.
10. Social reports and moderation records. A report (who reported whom, the reason, any details given, a copy of the reported text and what we decided) is kept for 12 months after we close it. A record of the action we took (for example hiding content or pausing someone's social access) is kept for 12 months, except that the record of a pause still in force is kept for as long as the pause lasts. When we delete or anonymise your Account data (clause 9.1), we remove the details and reported text in reports made by or about you, our notes on reports about you, and our notes on any action taken against you, but keep the record that a report was made and handled. We never tell the person you report who reported them.
11. "Looking for a game" posts, including their location, are deleted 30 days after they end. Invites to a game are deleted 30 days after they expire.
12. Club agreement records (the signer's name, job title, the time, the text signed, and the IP address and browser they signed from, and the record of who accepted a club's data processing agreement) are kept while the agreement is in force and for six years after it ends, as the record of the contract. They are kept even if you delete your Account, because they belong to the club's contract with us.
13. Lesson bookings are kept for six years after the end of the financial year they relate to, as financial records. When you delete your Account, the students' names, ages and notes on them are removed and the booking record is kept.
14. Emails from our team and messages you send us. Our record of an email our team sends you (who it went to, what it said, and whether it was delivered, opened or clicked) and messages you send to our email addresses are kept in our systems for 24 months and then deleted; copies in our team's mailbox are kept only as long as we need them to deal with what you sent. Your choice about marketing emails, and when and how you made it (including the choice you made on the sign-up form), and the date of the last marketing email we sent you, are kept for as long as your Account is open. Individually written emails from our founder and any replies are kept in the same way as other emails from our team. If an address bounces or reports our email as spam, we keep a coded form of it (a hash, not the address itself) for as long as our team's email tool is in use, so that it doesn't email that address again. When we delete or anonymise your Account data (clause 9.1), your address is removed from our records of emails our team sent you.
15. Visit counts (daily totals with no personal data) are kept for 25 months, then deleted.
16. Usage data (clause 3) is deleted 14 months after it was recorded. If you turn it off under Account, Preferences, or ask us to delete your Account, we delete yours straight away.
17. Your cookie choice on your Account is kept until you change it or ask us to delete your Account; we stop using it six months after you made it. The separate record of each choice (a random identifier, the choices, the date, the version and where you answered, with no name, email address or IP address) is deleted after two years.
18. Deal alerts: if you don't confirm your sign-up, we delete it after 30 days. When you unsubscribe we delete your email address, your area and any link to your Account straight away, and keep a scrambled (hashed) copy of the address with the dates you agreed and unsubscribed for 24 months, as a record of your consent. Our record of each weekly email we sent you is deleted after 90 days. If you delete your Account, we delete any deal alert sign-up linked to it or using its email address.
19. Press contacts are kept while the publication still lists them and they are relevant to our press releases. We check them at least once a year and delete any that the publication no longer lists, or that we haven't sent a release to for 24 months. Our record of the releases we sent and any replies is kept as described in item 14. If you ask us to stop, we delete your contact details straight away and keep only a coded form of your email address (a hash, not the address itself), so that we don't add it again.
20. iPhone app notification tokens are deleted when you sign out of the app (or, if it is offline, when it next reaches us), after that sign-in ends, when Apple tells us the token no longer works, when you have more than 20 devices (the least recently used goes first), or when you delete your Account. Turning notifications off keeps the token, marked as not allowed.
21. Sign in with Apple tokens are used to end tee-time's access to your Apple ID when you delete your Account, and deleted once Apple confirms. If that doesn't go through, we try again when your Account's data is deleted (item 1) and delete the token then either way.

10. Your rights

Under UK GDPR you have the following rights, exercisable at any time by contacting support@tee-time.uk:

1. Access — a copy of the personal data we hold about you;
2. Rectification — correction of inaccurate or incomplete data;
3. Erasure ("right to be forgotten") — deletion of your data, subject to lawful retention obligations;
4. Portability — a machine-readable export of data you have provided;
5. Restriction — restrict our processing in certain circumstances;
6. Objection — object to processing based on legitimate interest, including for profiling. For usage data you can also object yourself, at any time, by turning off "Help improve tee-time with usage data" under Account, Preferences. If you are a press contact, you can object to our press releases at any time by replying to one or emailing support@tee-time.uk, and we always stop;
7. Withdraw consent — where processing relies on consent, withdraw it at any time;
8. Complain to the ICO — you may lodge a complaint with the UK Information Commissioner's Office (https://ico.org.uk). We would, however, appreciate the chance to address your concern first.

We will respond to a rights request within one month, unless the request is complex or part of a series in which case we may extend by a further two months and tell you why.

11. Children

The Service is not intended for, and may not be used by, anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at support@tee-time.uk and we will delete it.

12. Security

1. Authentication uses passkeys (WebAuthn) bound to your device's biometric or PIN. We do not store passwords for your Account, and we cannot see the private half of your passkey.
2. Booking-hold tokens are HMAC-signed using a server-side secret so they cannot be tampered with by a client.
3. Sensitive secrets (such as intelligentgolf guest-account passwords) are encrypted at rest using AES-256-GCM.
4. All traffic to the Service is served over HTTPS.
5. We follow the principle of least privilege for production access and apply security updates on a routine basis.

No system is perfectly secure. If you believe you have found a vulnerability in the Service, please contact us at support@tee-time.uk and we will respond promptly.

13. Changes to this Policy

We may update this Policy from time to time. Material changes will be flagged on the Service before they take effect. The "Effective" date at the top of this page tells you when the current version began to apply.

14. Contact

If you have any question about this Privacy Policy or want to exercise any of your rights, please contact us at support@tee-time.uk, or write to:

Bednal Limited (company number 12582198) Unit 4 Clifford Court, Cooper Way, Carlisle, England, CA3 0JG