3. The personal data we collect
We may collect and process the following personal data about you.
- Contact details
- Name, address, email address, phone number.
- Identity data
- Gender, date of birth, information about your work such as company name and job title.
- Membership information
- Type of membership, profile details including profile photo, any information provided on your profile, membership start date.
- Attendance data
- Information regarding bookings made, event attendance, how often you visit the facility, location, preferred venue.
- Financial information
- Payment details, invoices, transaction history, debit or credit card and bank account information (which are processed by our payment providers: Stripe for online bay bookings and gift cards, Glofox for memberships, and Square for payments in our venues).
- Communication data
- Any information you provide during your correspondence with us, including by email, phone call, through the contact page on our website and on social media platforms, along with any feedback received such as through surveys, and any enquiries.
- Social media data
- Your public profile information, any messages you send to our social media accounts, any images shared with us (including where we are tagged in posts) and any other information you share with us via our social media platforms.
- Marketing preferences
- Your preferences for receiving marketing, including any records of opt-in and opt-out.
- Website data
- IP address, browser type, device identifiers, location, website activity, how you accessed the website, cookie preferences.
- Images and recordings
- Photography and videography taken during club events and social gatherings, and video recordings from cameras installed across our premises for security, safety and crime prevention.
4. Our purposes for processing your information
For each purpose below: where the information comes from, which categories of data from section 3 are involved, the lawful basis we rely on, and what we do with it.
Membership application: to create your membership account, to administer any purchases of products or services, and to maintain your membership account.
How we get itDirectly from you when you submit a membership application either online or in person through our hosting partner Glofox, and when you register through the Site.
Data usedContact details · Identity data · Membership information · Financial information · Communication data · Website data
Lawful basisLegitimate interests
What we do with itWe require this information to acknowledge, confirm and deal with your membership application (and where necessary put you on our waiting list). Such use of your data is necessary in order to implement your request to become a member.
To record reservations and bookings made, and any other information relating to the reservation or booking.
How we get itDirectly from you as you complete the booking through our Site.
Data usedContact details · Membership information · Financial information
Lawful basisNecessary for the performance of the contract between you and us
What we do with itTo complete and fulfil your booking, to process your payment, and to provide you with related customer service, including sending confirmations or pre-arrival messages, and assisting you with meetings, events or celebrations.
To provide access to our services, including access to the Site and Caddi Club third-party digital channels.
How we get itWhen you access our Site and other digital channels.
Data usedMembership information · Website data
Lawful basisLegitimate interests
What we do with itTo administer our Site, to better understand how visitors interact with our websites, and to ensure that our Site is presented in the most effective manner for you and for your device. For internal business and technical operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes, and as part of our efforts to keep our Site, network and information systems secure.
To provide you with membership services, administer your membership account, and contact you regarding your use of the services.
How we get itDirectly from you when you submit a membership application either online or in person, and when you register through the Site.
Data usedContact details · Identity data · Membership information · Financial information · Communication data · Website data
Lawful basisPerformance of a contract: such use is necessary to respond to, or implement, your request, and for the performance of the contract between you and us
To respond to any communication sent to us, such as enquiries and interest in bookings.
How we get itYou may contact us via the website, call us, or email us with your enquiries.
Data usedContact details · Membership information · Communication data · Social media data
Lawful basisLegitimate interests
What we do with itWe process this data in order to respond to and deal with any enquiries or complaints made.
To contact you in connection with user, customer and member surveys, and to use any information you choose to submit in response.
How we get itDirectly from you when you complete one of our feedback surveys.
Data usedContact details · Membership information · Communication data
Lawful basisConsent
What we do with itWhere an individual consents to providing their feedback, we will use their survey responses to improve our services.
To communicate with you and promote our services via any of our digital channels, and to manage our social media accounts.
How we get itDirectly from you when you communicate with us on any Caddi Club digital channel.
Data usedContact details · Membership information · Communication data · Social media data · Marketing preferences · Website data · Images and recordings
Lawful basisLegitimate interests
What we do with itTo communicate with you via our channels and to provide updates on our services and offerings. To notify you about changes to our service, provide you with user support, and enforce our terms, conditions and policies.
To personalise content and provide updates on existing services and opportunities, and to re-engage with you regarding our services.
How we get itDirectly from you when you opt in to communication, subscribe to our newsletter, attend an event, or purchase any of our products or services.
Data usedContact details · Membership information · Attendance data · Communication data · Social media data · Marketing preferences · Website data
Lawful basisConsent (where you have provided your consent to receive such communications); legitimate interests (where you have bought a service from us and have not opted out of marketing)
To personalise the content you receive and provide you with tailored content that will be of interest to you. To conduct analytics to inform our marketing strategy and that of the Caddi Club group, and to enable us to enhance and personalise the experience we offer to our members and customers, and our communications. This includes creating customer or member profiles to enable personalised direct marketing communications.
How we get itAdministering and promoting events, and directly from you when you interact with us, register for an event, or show an interest in our events.
Data usedContact details · Membership information · Attendance data · Communication data · Social media data · Marketing preferences · Website data · Images and recordings
Lawful basisConsent; legitimate interests
What we do with itTo register and maintain event bookings where individuals have signed up, registered their interest, or opted in to receiving communication about events.
To provide you with location-based services.
How we get itDirectly from you where you have provided your location in order to receive location-based services.
Data usedContact details · Membership information · Attendance data
Lawful basisConsent
What we do with itTo provide our members with information regarding the location of our services, and to provide the closest service to them.
For the purposes of capacity planning, and to comply with government guidelines, regulations and mandates.
How we get itDirectly from you when you book with us.
Data usedContact details · Membership information · Attendance data · Communication data
Lawful basisLegitimate interests
Detecting abuse, fraud and illegal activity on the Site, and keeping our business secure.
How we get itWhen you enter our premises, on which CCTV is in operation.
Data usedImages and recordings
Lawful basisLegitimate interests
What we do with itIn order to comply with our legal obligations, and to help us detect abuse, fraud and illegal activity.
To keep our website secure.
How we get itDirectly from you when you interact with and use our website and other digital channels.
Data usedWebsite data
Lawful basisLegitimate interests; legal obligation
What we do with itTo protect our website from malicious activity, cyber attacks and other crime.
In some cases we may process the above categories of data to (a) comply with legal obligations; (b) respond to requests from competent authorities; (c) enforce Caddi Club rules; (d) protect our operations or those of the Caddi Club group; (e) protect our rights, safety or property, and those of the Caddi Club group, you or others; and (f) enforce or defend legal rights, or prevent damage.
We may anonymise, aggregate and de-identify the data that we collect, and use it for our own internal business purposes, including conducting feedback reviews.
7. Payment information
Any credit or debit card payments and other payments you make through Caddi Club, or whilst on Site, will be processed by our third-party payment providers: Stripe (for online bay bookings and gift cards), Glofox (for memberships) and Square (for payments made in our venues). We do not store your full card details ourselves. The payment data you submit will be securely stored and encrypted by our payment service providers using up-to-date industry standards.
We may arrange that card or payment data you submit in support of a membership application or subscription fee is stored for the purpose of processing your application, initiating your membership and collecting your subscription fees if your initial application is successful. If you are put on to a membership waiting list, please note that this data may be stored for later use to initiate your membership and subscription. We may also process your payment details where you purchase a gift card from us.
We store and use this card or payment information for the purpose of processing any future payments that you make as a member for additional goods and services. We will store this data in accordance with our legal obligations under applicable law, and only for so long as legally permitted.
You may choose to opt out of us holding your card or payment data, although this means that you will need to re-supply us with card or payment details to initiate your membership subscription fee, or to make any future purchases.
10. Personal data retention
We will keep your personal data only for as long as is reasonably necessary for the purposes outlined in this policy, or for the duration required by any legal, regulatory, accounting or reporting requirements, whichever is longer. When you consent to receive marketing communications, we will keep your data until you unsubscribe, after which records of those who have unsubscribed are kept in suppression lists in order to comply with the law.
To determine the appropriate retention period, we consider the amount, nature and sensitivity of the personal data, the purposes for which we process it, applicable legal requirements or operational retention needs, and whether we can achieve those purposes through other means.
Upon expiry of the applicable retention period, we will securely destroy your personal data in accordance with applicable laws and regulations. In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case it is no longer personal data.
11. Your personal data protection rights
Certain applicable data protection laws give you specific rights in relation to your personal data. In particular, if the processing of your personal data is subject to the UK GDPR, you have the following rights.
- Right of access
- If you ask us, we will confirm whether we are processing your personal data and, if so, provide you with a copy of that personal data along with certain other details, such as the purpose of the processing. If you require additional copies, we may need to charge a reasonable fee.
- Right to rectification
- If your personal data is inaccurate or incomplete, you are entitled to ask that we correct or complete it. If we shared your personal data with others, we will tell them about the correction where possible. If you ask us, and where possible and lawful to do so, we will also tell you with whom we shared your personal data so you can contact them directly.
- Right to erasure
- You may ask us to delete or remove your personal data, such as where our legal basis for the processing is your consent and you withdraw consent. If we shared your data with others, we will tell them about the erasure where possible. We may continue processing personal data where this is necessary for a legitimate interest in doing so, as described in this policy.
- Right to restrict processing
- You may ask us to restrict or block the processing of your personal data in certain circumstances, such as where you contest its accuracy or object to us processing it. We will tell you before we lift any restriction on processing, and if we shared your personal data with others we will tell them about the restriction where possible.
- Right to data portability
- You have the right to obtain the personal data you consented to give us, or that was provided to us as necessary in connection with our contract with you. We will provide it in a structured, commonly used and machine-readable format, and you may reuse it elsewhere.
- Right to object
- You may ask us at any time to stop processing your personal data, and we will do so if we are relying on a legitimate interest to process it (unless we demonstrate compelling legitimate grounds for the processing) or if we are processing it for direct marketing.
- Right to withdraw consent
- If we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing carried out before we received notice that you wished to withdraw it.
Right to lodge a complaint with the data protection authority.If you have a concern about our privacy practices, including the way we handled your personal data, you can report it to the UK data protection authority, the Information Commissioner’s Office (ICO), or, as the case may be, any other competent data protection authority of an EU member state that is authorised to hear those concerns. You can find EU data protection authorities’ contact information at edpb.europa.eu.