Privacy Policy

Version 2.0. Published 12 August 2026; takes effect 26 August 2026. The previous version (8 May 2026) is available on request.

Badminton Clubhouse is a multi-tenant platform that helps badminton clubs run their day-to-day operations and helps players find games, track their stats, and manage their relationship with the clubs they belong to. This page explains what personal data we hold, why, who we share it with, and what control you have.

This policy is written for UK users under the UK GDPR and the Data Protection Act 2018. If you're based in the EU your equivalent rights under the EU GDPR apply.

1. Who is the data controller?

For data you give us directly (your account, your profile, your public-facing handle), the controller is Badminton Clubhouse Ltd, a company registered in England and Wales (company number 17391781), registered office Vicarage Court, 160 Ermin Street, Swindon, England, SN3 4NE. Our data protection contact is the director: privacy@badmintonclubhouse.com. We have assessed that we are not currently required to appoint a statutory Data Protection Officer and keep that assessment under review.

For data your club records about you as a member of that club (membership status, attendance, fees, club-specific notes), the club committee is the controller and Badminton Clubhouse acts as their processor. Each club is responsible for its own privacy notice covering that membership data; this policy covers the platform layer. The written terms governing that processor relationship are our Data Processing Agreement, which each subscribing organisation enters into.

2. What personal data we collect

We collect only what we need to run the platform and the features you use. Data is grouped by where it lives:

Account & identity

• Email address, password (hashed, never stored in plaintext)
• Display name, handle, pronouns, date of birth, profile photo if you upload one
• Postcode (for finding nearby games and clubs)

Profile (optional, you control these)

• Bio, skill level, preferred format, dominant hand, goals
• Phone number, address, gender
• Emergency contact name, phone and relationship (used for safeguarding only)
• Medical notes (used by your club committee for in-session safety only, held with your explicit consent, which you can withdraw at any time)
• Optional: your Badminton England membership number and tier (Play, Compete, Club, Coach or Fan). Lets your club confirm eligibility for BE-sanctioned competitions. We do not exchange this with Badminton England, there is no API.

Club membership

• Which clubs you belong to, your membership status, your membership level, custom club fields (e.g. shirt size if your club asks)

Activity & matchmaking

• Friendly games you host or RSVP to via Find a Friendly Game, attendance at club sessions, play sessions you log
• Events you're invited to or attend
• Career stats derived from the above

Consent records

• Every consent you give (GDPR processing at a club, photo consent at a club, medical notes, public profile visibility, public profile photo) is logged with timestamp and the policy version you agreed to. Withdrawals are kept for two years for audit.

Communication & audit

• Notifications we send you (email log, in-app feed, push if you opt in)
• Audit trail of safeguarding-relevant actions (e.g. a guardian acting on a junior's behalf), retained for two years

Safeguarding and criminal records checks (officers, coaches and volunteers)

• If you hold a role that requires a criminal records check (DBS in England and Wales, Disclosure Scotland PVG, or AccessNI), your club records the check's level, outcome, issue date, Update Service flag, and the date your club's own re-check falls due. Certificates have no expiry date; the re-check date is your club's own policy. We never hold the content of a certificate or the detail of any disclosure, we do not carry out checks, and clubs must not upload certificates.
• Safeguarding case records (for example a welfare hold and its audit trail) may include information about alleged conduct.
• This is criminal-offence data under Article 10 UK GDPR, processed under the safeguarding condition in Schedule 1 of the Data Protection Act 2018. We maintain the Appropriate Policy Document that condition requires. This data is never used for statistics, marketing or any commercial purpose.

Junior profiles (under 18)

If you're a parent or guardian managing a junior's profile, we hold the same categories of data as for adults but attached to a separate junior profile with no login of its own. See section 7 for our junior posture in full.

If you register a child after a school taster session, you can optionally tell us which school the session was at. This is stored with the registration (with your consent, and you can remove it before submitting), is only ever visible to the club's committee, and is used in aggregate, never per child, to show which school programmes bring new players into clubs.

3. Why we process it (lawful bases)

4. Who we share data with

We do not sell your data, run ad networks, or share it with marketers. We do use the following sub-processors to run the platform:

Payments. When you pay your club through the platform, the payment is processed by your club's own payment provider (Stripe or GoCardless) under that provider's terms; they are your club's providers, not our sub-processors, and are independent controllers for their own obligations such as fraud prevention. We process payment metadata (amount, status, who paid) so your club's records reconcile. Card details are entered only on the provider's hosted payment surfaces; we do not store, process or transmit cardholder data, and funds never pass through Badminton Clubhouse.

We share data inside the platform only on a need-to-know basis:

• Your club committee sees the full member record for your club (the membership data they're the controller of), plus contact data you've made visible via the "show email" / "show phone" toggles in your profile.
• Other members of your clubs see what your committee has chosen to display in the club directory and what your visibility setting allows. You can set visibility to private, clubs only (default), or public.
• Anyone (including search engines) sees only what you've made public via your /players/[handle] profile, and only after you've given the explicit consent described in section 8.

4A. Club and organisation contact information

We maintain a directory of UK badminton clubs, associations and venues compiled from publicly available sources, including governing-body and local-authority listings. Where a listing includes a named contact, we hold their name, role and contact details so we can tell organisations about the platform. Our lawful basis is our legitimate interest in reaching organisations that may benefit from it; a legitimate interests assessment is available on request. You can object at any time and we will stop contacting you: email privacy@badmintonclubhouse.com or use the unsubscribe link in any message. We provide this privacy information in or linked from our first message to you, we do not use the information for any other purpose, and we honour objections permanently.

5. Your public profile

By default your profile visibility is "clubs only". Search engines cannot index it. You can opt in to a public profile by going to /me/profile and switching visibility to "public". When you do:

• Your display name, handle, skill tier, headline stats (games played, format split, recent form), bio, and the discoverable clubs you belong to become visible at /players/your-handle.
• Your photo appears only if you separately grant "public profile photo" consent.
• Search engines may index the page.
• Opponent and partner names on your recent-games list always appear as initials with skill tier, never as full names.
• You can switch back to private or clubs-only at any time. Your URL returns 404 within sixty seconds; search engines drop the page from their index over the following weeks.

6. Cookies and tracking

We use only essential cookies, the ones our authentication needs to keep you signed in. We do not use advertising cookies, social-media trackers, or third-party analytics that profile you.

Vercel Web Analytics, which we use for aggregate page-view counts, is cookieless and does not track individuals across sites.

6A. Aggregated and anonymised statistics

Platform activity produces statistics about the sport that no individual record could: how many people play, where, how often, and how participation changes. We produce these as aggregated, anonymised statistics and may use them commercially, for example in participation reports for county associations, governing bodies and public-sector partners. The promises that govern this:

• Anonymisation is a process we test, not a label. Outputs are anonymised in line with ICO guidance, including the motivated intruder test, under our Statistical Disclosure Control Policy (available on request): minimum cell sizes, protection against combining releases, and higher thresholds for statistics about children or attributed to a named club. We re-assess outputs over time; if one stops being anonymous we withdraw or further protect it.
• Children's records never contribute to statistics we are paid for. Under-18 records can contribute only to participation reporting we publish free of charge in the public interest, under the same controls with higher thresholds.
• We never disclose personal data to a purchaser or recipient of statistics. Anonymisation happens first, under our Data Processing Agreement with your club. What we supply is counts, not records about you.
• Your club is not named in any statistic without its consent.
• Safeguarding, criminal-records and medical data are excluded from every aggregate.
• You can opt out. If you would rather your activity did not contribute, email privacy@badmintonclubhouse.com and we will exclude your records from future statistics (an in-product setting is on its way). Statistics already produced contain no personal data and are unaffected.

Because anonymised statistics contain no personal data, they are retained even if you delete your account or your club leaves the platform.

7. Children and under-18s

The platform supports junior players via guardian-managed profiles. We comply with the UK ICO Age-Appropriate Design Code (the "Children's Code") standards applicable to that model and Article 8 of the UK GDPR.

• Juniors do not have public profiles. Under-18 visibility is locked to clubs-only by default, and the public /players/[handle] route does not resolve for junior profiles.
• Under-18s do not hold accounts. A parent or guardian creates and manages the junior profile and gives all consents relating to it. As a junior matures, clubs and guardians can involve them in decisions, but the account, sign-in and consents remain the guardian's until the young person turns 18 and takes ownership through the handover process below.
• Promotion at 18. When a junior turns 18 we email them with a magic link to take ownership of their own account; they have between 30 and 90 days to do so. If they don't, we lock their record. Guardians lose access at 18 (with a short read-only grace window) regardless.
• Welfare holds. If we detect a safeguarding concern (for example, a child being added to a club without an active guardian), we apply a welfare hold and route the case to a club's welfare officer or a platform admin. The audit trail is shared with all of the child's active guardians.

A separate junior public surface (e.g. county pathway visibility) is not part of the current product and would only ship after consultation with Badminton England, the relevant county associations, and an updated Children's Code DPIA.

8. Consent, and how to withdraw it

Where we rely on consent (public profile visibility, public profile photo, photo on a club roster, medical notes, GDPR processing on a specific club, optional marketing email if you opt in) you can withdraw at any time:

• Public profile visibility / photo: at /me/profile in the "Public profile" section.
• Per-club photo consent: at /me/profile in the "Photo consent" section, per club.
• Notification subscriptions: at /me/notifications preferences tab.

Withdrawing a consent does not affect anything we did under that consent before you withdrew. We keep the consent and withdrawal records for two years so we can show what you agreed to and when.

9. How long we keep things

• Account data: while your account is active. When you delete it (via /me/profile → "Delete my account"), we cascade-delete profile rows, member rows, and the auth user. Your handle is held in reservation for 90 days to prevent impersonation, then released.
• Consent and safeguarding audit logs: two years.
• Email log (records of emails we've sent you): 12 months, reviewed annually.
• Game and event records remain attached to their club while the club uses the platform. If the club leaves, its data is exported or returned at the club's choice and the personal data is removed from our systems within 30 days (encrypted backups clear within 90 days). Anonymised statistics produced before departure are retained; they contain no personal data (section 6A).
• Junior records follow the rules in section 7; they're either locked at 18 + 90 days or carried forward into the player's new adult account.
• Full periods for every category are in our published Retention Schedule.

10. Your rights under UK GDPR

You have the right to:

• Access the data we hold about you (a copy).
• Rectification of anything that's wrong; most fields are editable directly via /me/profile.
• Erasure, sometimes called "the right to be forgotten". Self-service via /me/profile → Delete my account, or by emailing us. Note: we cannot erase records that are subject to a legal obligation (e.g. an active safeguarding investigation) until that obligation lifts.
• Restriction of processing while a dispute is being resolved.
• Portability, a machine-readable copy of the data you gave us.
• Object to processing based on legitimate interest, including the statistics in section 6A. We'll stop unless we have an overriding lawful ground (in practice: safeguarding-related processing for under-18s).
• Not be subject to solely automated decisions that produce a legal or similarly significant effect. The only automated intervention we operate is the safeguarding welfare hold, which can be triggered automatically (for example when a junior profile has no active guardian) but is always reviewed by a person with authority to change the outcome (a club welfare officer or a platform administrator) before it has lasting effect.

To exercise any of these, email privacy@badmintonclubhouse.com. We'll respond within one calendar month. Providing profile data is voluntary; the data your club needs to run your membership (name, contact details) is required by your club's membership agreement, and without it your club cannot administer your membership. Where we receive your data from your club rather than from you, the source is your club's committee.

11. How we protect your data

• All traffic is encrypted in transit (HTTPS/TLS 1.2+).
• Data at rest is encrypted by Supabase using industry-standard mechanisms.
• Passwords are stored only as bcrypt hashes, we never see them in plaintext.
• Row-level security (RLS) on the database enforces who can read and write what; club admin actions and any acting-as-junior actions are logged in an append-only audit trail.
• Sensitive uploads (e.g. safeguarding evidence) live in a private storage bucket and are accessible only via short-lived signed URLs to platform admins.

12. Changes to this policy

When we make material changes (anything that affects what we process, why, or who we share with) we'll email registered users at least 14 days before the change takes effect. Minor edits, fixing a typo, updating a sub-processor's region are made silently and dated below.

13. Complaints and ICO escalation

If you're unhappy with how we've handled your data, please email privacy@badmintonclubhouse.com first, we want the chance to fix it.

You also have the right to complain to the UK Information Commissioner's Office:

• Web: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

14. Contact us

Questions about this policy, requests for your data, or anything privacy-related: email privacy@badmintonclubhouse.com.

For general support that doesn't involve personal data, our help centre is at /help or you can reach the team at hello@badmintonclubhouse.com.