Deleting your data

Under UK GDPR Article 17, you have the right to ask us to delete the personal data we hold about you. We make this self-serve from either /me/settings (Danger Zone) or /me/data ("Delete my data"), both lead to the same cooling-off flow.

What happens when you click Delete

You confirm. You'll see a dialog explaining what gets deleted, what we have to keep by law, and how the 30-day window works. You'll be asked to type DELETE to confirm, this is a hard friction barrier so it doesn't happen by accident.
Your account is scheduled for deletion. We do not lock you out. You can keep signing in throughout the cooling-off, that's deliberate, so cancelling is always easy. A prominent amber banner appears across the app reminding you of the deletion date with a Keep my account button.
30-day cooling-off begins. No data is erased yet. We send you an email with a one-click cancel link.
You can change your mind. Click Keep my account in the banner, click the email cancel link, or open Your data (/me/data) and tap Cancel my erasure request. Your account is restored in place; no data was deleted.
On day 30 the background worker walks every category and applies our deletion / pseudonymisation / retention rules (see below).

Before you can delete, two checks

Outstanding payments. If you're the payer on any unpaid payment request, deletion is blocked until you settle or cancel it. You'll get a prompt linking to /me/payments. (Settled financial records are still retained 7 years for HMRC.)
Sole guardian of a child. If you're the only guardian of a junior, we stop and ask, either add a co-guardian / transfer guardianship on the Juniors page first (recommended), or explicitly confirm that the child's records should be deleted with yours. See Deleting your account for the full guardian walkthrough.

What gets deleted (most of it)

Category	What we do
Profile (name, email, phone, address, DOB, medical notes, emergency contacts, bio)	Scrubbed to `<erased>` / NULL; row retained as a stub for FK integrity
Membership records	Display name → "Former player"; admin notes cleared
Consent records	Hard deleted
Notifications sent to you	Recipient detached; payload walked recursively to redact your name and email from any third-party mention
Push subscriptions, partner preferences, availability, alert subscriptions	Hard deleted
Visit requests, team rosters, event attendance	Hard deleted
Coach record (if applicable)	Hard deleted
Survey responses	Anonymised (response data retained for aggregate stats; you're no longer linked to it)
API keys, system incidents authored	Detached / hard deleted

What we keep, and why (Art. 17(3) carve-outs)

UK GDPR allows controllers to retain personal data when another legal basis overrides erasure. We retain:

Category	Why	How long
Financial records (payments, invoices, refunds)	HMRC / Companies Act 2006	7 years; your name and email are scrubbed, but the financial linkage stays
Audit log (every action you took or that was taken on you)	Art. 17(3)(b), proof of lawful processing	7 years; your name → `<erased actor>` where relevant
Acting-as audit (when you acted on someone else's behalf, or vice versa)	Art. 17(3)(b), authorisation chain integrity	7 years
Safeguarding records (welfare concerns, DBS records for coaches)	Children Act 2004 / safeguarding statutory duty	Statutory retention; see the Children's Code addendum to our DPIA
Past game history	Other players have a legitimate interest in their own match record	Indefinite; your slot shows "Former player" so the row's still complete

Every kept row generates an erasure_retentions audit record naming the Art. 17(3) clause and a basis note. That's our evidence trail if the ICO asks why we didn't delete something.

Backups: a small gap to disclose

Supabase (our database host) retains a 7-day point-in-time-recovery (PITR) backup of the database. Erasing your live data does not propagate into PITR backups: they age out within 7 days. So between live erasure (day 30) and full backup expiry (day 37), an extremely small theoretical risk exists that a database-level restore could reintroduce your data. We have a runbook (docs/runbooks/post-pitr-restore.md) that automatically re-erases any subjects in that case.

By day 37 at the worst case, your data is unrecoverable from any surface.

What about other clubs, other tenants?

The default ("Delete my data" on /me/data) erases everywhere on the platform: across every club, association, county or competition you've been part of. This is the cleanest path and matches what most people mean when they say "delete my account".

If you only want to leave one club but stay active on the platform, don't request erasure: leave the club instead from My clubs (/me/clubs) or the club's membership page. Your other clubs and tenants are unaffected. If you also want that club's records about you reviewed or removed, contact the club committee or privacy@badmintonclubhouse.com.

On behalf of a junior

If you are the active guardian of a junior, open the junior's page from Juniors (/me/juniors) and use Request deletion in the Data and privacy section. The same rules apply, including the 30-day cooling-off period.

Important safeguarding block: if the junior has an active welfare hold on their account, erasure is refused at the database level. The UI will show a "contact welfare officer or dpo@badmintonclubhouse.com" message. We can't erase a record we're required by Children Act to retain.

Rate limit: once per 90 days

You can submit one erasure request per 90 days. If you cancel during cooling-off and want to re-think, you'll have a sensible gap. system_admin (the platform team) can override for ICO-ordered erasures.

How long things take

Deletion runs: within 5 minutes after day 30 (the dispatcher cron polls every 5 min).
Email delivery (cancel link, completion): within a few minutes.
Backup expiry: 7 days post-erasure.

What we email you

Erasure request received: confirmation + 30-day cancel link.
Erasure cancelled: if you click cancel or sign back in.
Erasure completed: confirmation of completion (where you still have an inbox to receive it).

If something goes wrong

Erasure failures are rare but possible (constraint violations, etc.). When they happen, the row stays failed and the DPO is notified to triage. You'll receive an email; you can also email dpo@badmintonclubhouse.com at any time.

Tenant-fulfilled erasure

If you receive an email saying "an administrator at has requested erasure of your data", that means a committee member (DPO function, with the gdpr.erasure permission) lodged a request on your behalf, usually because you asked in writing, or because the club received a paper request. The email includes the same 30-day cancel link. If you didn't ask for this, reply to the email, we treat unexpected admin requests as a potential safeguarding incident.

Deleting your data (UK GDPR Art. 17)