PRIVACY POLICY

1. Who are we?

This Privacy Policy sets out how Caddi Group Limited will use your personal data. Caddi Group Limited is a company registered in England and Wales under registration number 13142645 ('Caddi Club', 'we', 'us' and/or 'our'). Caddi Group Limited includes Caddi Club Limited, Caddi Club Chelsea Limited, Caddi Club Alpha Limited, and Caddi Club Waterloo Limited.

We act as a data controller for the processing of your personal data, including when you sign up to a membership, contact us, or otherwise engage in our services. If you have any concerns or would like to contact us about any aspect of this policy, please get in touch through the contact details at the bottom of this statement.

2. What is this privacy policy for?

This privacy policy ('Privacy Policy') applies to personal data that we collect from you as a user of this Site or as a membership applicant, member, or customer ('you' or 'your' being interpreted accordingly). It provides information on what personal data we collect, why we collect the personal data, how it is used and the lawful basis on which your personal data is processed, and what your rights are under the applicable data protection and privacy laws, including the UK General Data Protection Regulation ('GDPR') and the Data Protection Act 2018.

'Personal data' as used in this Privacy Policy means any information that relates to you from which you can be identified.

3. The personal data we collect:

We may collect and process the following personal data about you:

Contact Details: Name, address, email address, phone number;
Identity Data: Gender, data of birth, information about your work such as company name and job tittle;
Membership Information: type of membership, profile details including profile photo, any information provided on your profile, membership start date;
Attendance Data: information regarding your bookings made, event attendance, how often you visit the facility, location, preferred venue;
Financial information: payment details, invoices, transaction history, debit or credit card and bank account information (which are processed by our payment provider Glofox);
Communication Data: any information you provide to us during your correspondence to us, this includes information provided via email, phone call, through the contact us page on our website, social media platforms, any feedback received such as through surveys, any enquiries;
Social Media Data: Your public profile information, any messages you send to our social media accounts, any images shared with us (including where we are tagged in posts) and any other information you may share with us via our social media platforms;
Marketing Preferences: your preferences to receiving marketing, including any records of opt-in and opt-out;
Website Data: IP address, browser type, device identifiers, location, website activity, how you accessed the website, cookie preferences;
Images and Recordings: photography and videography taken during club events, social gatherings, and video recordings from cameras installed across our premises for security, safety and crime prevention.

4. Our purposes for processing your information:

Purpose for processing	How we get your information	Types of data collected (as categories above)	Lawful Basis	Use
Membership Application: To create your membership account. To administer any purchases of products/ services. To maintain your membership account.	Directly from you when you submit a membership application either online or in person through our hosting partner Glofox, and when you register through the Site.	• Contact Details • Identity Data • Membership Information • Financial information • Communication Data • Website Data	Legitimate interests	We require this information to acknowledge, confirm and deal with your membership application (and where necessary put you on our waiting list). Such use of your data is necessary in order to implement your request to become a member.
To record reservations and bookings made and any other information relation to the reservation or booking.	Directly from you as you complete the reservation booking through out Site.	• Contact Details • Membership Information • Financial Information	Necessary for the performance of the contract between you and us.	To complete and fulfil your booking, to process your payment, and provide you with related customer service, including sending confirmations or pre-arrival messages, assist you with meetings, events or celebrations.
To provide access to our services, including access to Site and Caddi Club Third-Party Digital Channels.	When you access our Site and other Digital Channels.	• Membership Information • Website Data	Legitimate Interests	To administer our Site, to better understand how visitors interact with our websites and ensure that our Site is presented in the most effective manner for you and for your computer/device. For internal business/technical operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes and as part of our efforts to keep our Site, network and information systems secure.
To provide you with membership services, administer your membership account and contact you regarding your use of the services.	Directly from you when you submit a membership application either online or in person, and when you register through the Site.	• Contact Details • Identity Data • Membership Information • Financial information • Communication Data • Website Data	Performance of a contract:	Such use is necessary to respond to, or implement, your request, and for the performance of the contract between you and us.
To respond to any communication sent to us, such as enquires and interests in bookings.	Individuals may contact us via the website, call us, or email us with their enquiries.	• Contact Details • Membership Information • Communication Data • Social Media Data	Legitimate interests	We process this data in order to respond to and deal with any enquiries or complaints made.
To contact you in connection with user/customer/member surveys and use any information you choose to submit in response.	Directly from you when you complete one of our feedback surveys.	• Contact Details • Membership Information • Communication Data	Consent	Where an individual consents to providing their feedback, we will use their survey responses to improve our services.
To communicate with you and promote our services via any of our Digital Channels. To manage our social media account.	Directly from the individual when they communicate with us on all Caddi Club Digital channels.	• Contact Details • Membership Information • Communication Data • Social Media Data • Marketing Preferences • Website Data • Images and Recordings	Legitimate interests	To communicate you via our channels and to provide updates on our services and offerings. To notify you about changes to our service, provide you with user support and enforce our terms, conditions and policies.
To personalise content and provide updates on existing services and opportunities. To re-engage with you regarding our services.	Directly from you when you opt in to communication, subscribe to our newsletter, attend an event, or purchase any of our products/ services.	• Contact Details • Membership Information • Attendance Data • Communication Data • Social Media Data • Marketing Preferences • Website Data	Consent (where you have provided your consent to receive such communications). Legitimate interests (where you have bought a service from us, and have not opted out of marketing)	To personalise the content you receive and provide you with tailored content that will be of interest to you. To conduct analytics to inform our marketing strategy and that of our Caddi Club group and enable us to enhance and personalise the experience we offer to our members, customers and our communications. This includes creating customer or member profiles to enable personalised direct marketing communications.
Administering and promoting events.	Directly from you when you interact with us, register to an event or show an interest in our events.	• Contact Details • Membership Information • Attendance Data • Communication Data • Social Media Data • Marketing Preferences • Website Data • Images and Recordings	Consent Legitimate Interests	To register and maintain event bookings where individuals have signed up, registered their interests, or opted in to receiving communication about events.
To provide you with location-based services.	Directly from you where you have provided your location in order to receive location based services.	• Contact Details • Membership • Attendance Data	Consent	To provide our members with information regarding the location of our services, and to provide the closest service to them.
For the purposes of capacity planning and to comply with government guidelines, regulations and mandates.	Directly from you when you book with us.	• Contact Details • Membership Information • Attendance Data • Communication Data	Legitimate interests	illegal activity on the Site.
Keeping our business secure.	When you enter onto our premises in which CCTV is in operation.	Images and Recordings	Legitimate interests	In order to comply with our legal obligations, we use your data to help us detect abuse, fraud and
To keep our website secure.	Directly from you when you interact and use our website and other Digital Channels.	• Website Data	Legitimate Interests Legal Obligation	To protect our website from malicious activity, cyber attacks and other crime.

In some cases we may process the above categories of data to (a) comply with legal obligations, (b) respond to requests from competent authorities; (c) enforce Caddi Club rules; (d) protect our operations or those of any of the Caddi Club group; (e) protect our rights, safety or property, and/or that of the Caddi Club Group, you or others; and (f) enforcing or defending legal rights or preventing damage.

We may anonymise, aggregate and de-identify the data that we collect and use such anonymised, aggregated and de-identified data for our own internal business purposes, conducting feedback reviews.

5. Cookies:

Our Site uses cookies (small text files placed on your device) and similar technologies to distinguish you from other users. This is to provide you with a good user experience when you browse our Site, and allows us to improve its features.

6. Disclosure of your information:

Sometimes we may share your information with other organisations or individuals, who may use your information only for the purposes we allow them to and under written agreements as required by legislation.

Where appropriate, we may disclose your personal data to:

Members of the Caddi Club Group and our subsidiaries for administrative purposes; for providing membership services; and in relation to our sales and marketing activities.
Service providers: Caddi Club, like many businesses, sometimes hires selected third parties who act on its behalf to support its operations, such as (i) card processing or payment services (see the section below headed 'Payment Information'); (ii) credit reference agencies to protect against possible fraud; (iii) IT suppliers and contractors (e.g. data hosting providers or delivery partners) as necessary to provide IT support and enable us to provide membership services and other goods/services available on this Site or to members; (iv) web analytics providers; (v) providers of digital advertising services; and (vi) providers of CRM, marketing and sales software solutions. Pursuant to our instructions, these parties may access, process or store your personal data in the course of performing their duties to us and solely in order to perform the services we have hired them to provide.
Business transfers: if we sell our business or our company assets are acquired by a third party, personal data held by us about our members, membership applicants or customers may be one of the transferred assets.
Administrative and legal reasons: if we need to disclose your personal data (i) to comply with a legal obligation and/or judicial or regulatory proceedings, a court order or other legal process requirements from public health organisations, local councils and governmental, federal and state authorities. (ii) to enforce our Terms & Conditions, Caddi Club rules or other applicable contract terms that you are subject to or (iii) to protect us, our members, membership applicants, or contractors against loss or damage. This may include (without limit) exchanging information with the police, courts or law enforcement organisations.

7.Payment information:

Any credit/debit card payments and other payments you make through Caddi Club or whilst on Site will be processed by our third-party payment providers. The payment data you submit will be securely stored and encrypted by our payment service providers using up-to-date industry standards.

We may arrange that card or payment data you submit in support of a membership application or subscription fee is stored for the purpose of processing your application, initiating your membership and collecting your subscription fees if your initial application is successful. If you are put on to a membership waiting list, please note that this data may be stored for later use to initiate your membership and subscription. We may also process your payment details where you purchase a gift card from us.

We store and use this card or payment information for the purpose of processing any future

payments that you make as a member for additional goods and services. We will store this data in accordance with our legal obligations under applicable law, and only for so long as legally permitted.

You may choose to opt-out of us holding your card or payment data, although this means that you will need to re-supply us with card/payment details to initiate your membership subscription fee, or for the purpose of making any future purchases.

8. Personal data transfers:

Your personal data may be transferred to, and stored in, countries other than the country in which the information was originally collected, including the United States and other destinations outside the European Economic Area ('EEA'), to our service providers.

Where we transfer your personal data to countries outside of the EEA, we will take all steps to ensure that your personal data will continue to be protected. We will implement appropriate safeguards for the transfer of personal data to our service providers in accordance with the applicable law, such as relying on our service or implementing standard contractual clauses for data transfers. If you would like to receive more information on the safeguards that we implement, including copies of relevant data transfer contracts, please contact us as indicated below.

9. Security:

We will take appropriate technical and organisational security measures to protect the personal data that you submit to us against unauthorised/unlawful access or loss, destruction or damage, although we cannot 100 percent guarantee the security of personal data that you provide to us online. Unfortunately, the transmission of information over the internet or public communications networks can never be completely secure.

Where we have given you (or where you have chosen) a password or login that enables you to access certain restricted parts of our Site, you are responsible for doing everything you reasonably can to keep these details secret. You must not share your password or login details with anyone else.

10. Personal data retention:

We will keep your personal data only for as long as is reasonably necessary for the purposes outlined in this Privacy Policy, or for the duration required by any legal, regulatory, accounting or reporting requirements, whichever is longer. When you consent to receive marketing communications, we will keep your data until you unsubscribe, in which records of those who have unsubscribed will be kept in suppressions lists in order to comply with the law.

To determine the appropriate retention period for your personal data, we consider the amount, nature, and sensitivity of the personal data, the purposes for which we process your personal data, applicable legal requirements or operational retention needs, and whether we can achieve those purposes through other means.

Upon expiry of the applicable retention period, we will securely destroy your personal data in accordance with applicable laws and regulations. In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case it is no longer personal data.

11. Your personal data protection rights:

Certain applicable data protection laws give you specific rights in relation to your personal data. In particular, if the processing of your personal data is subject to the GDPR, you have the following rights in relation to your personal data:

Right of access: If you ask us, we will confirm whether we are processing your personal data and, if so, provide you with a copy of that personal data along with certain other details such as the purpose of the data processing. If you require additional copies, we may need to charge a reasonable fee.
Right to rectification: If your personal data is inaccurate or incomplete, you are entitled to ask that we correct or complete it. If we shared your personal data with others, we will tell them about the correction where possible. If you ask us, and where possible and lawful to do so, we will also tell you with whom we shared your personal data so you can contact them directly.
Right to erasure: You may ask us to delete or remove your personal data, such as where our legal basis for the processing is your consent and you withdraw consent. If we shared your data with others, we will tell them about the erasure where possible. If you ask us, and where possible and lawful to do so, we will also tell you with whom we shared your personal data with so you can contact them directly. We may continue processing personal data where this is necessary for a legitimate interest in doing so, as described in this Privacy Policy.
Right to restrict processing: You may ask us to restrict or 'block' the processing of your personal data in certain circumstances, such as where you contest the accuracy of the personal data or object to us processing it. We will tell you before we lift any restriction on processing. If we shared your personal data with others, we will tell them about the restriction where possible. If you ask us, and where possible and lawful to do so, we will also tell you with whom we shared your personal data so you can contact them directly.
Right to data portability: You have the right to obtain your personal data from us that you consented to give us or that was provided to us as necessary in connection with our contract with you. We will provide you with your personal data in a structured, commonly used and machine-readable format. You may reuse it elsewhere.
Right to object: You may ask us at any time to stop processing your personal data, and we will do so if:
- We are relying on a legitimate interest to process your personal data — unless we demonstrate compelling legitimate grounds for the processing.
- We are processing your personal data for direct marketing.
Right to withdraw consent: If we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing of your data before we received notice that you wished to withdraw your consent.
Right to lodge a complaint with the data protection authority: If you have a concern about our privacy practices, including the way we handled your personal data, you can report it to UK data protection authority, the Information Commissioner's Office (ICO), or, as the case may be, any other competent data protection authority of an EU member state that is authorised to hear those concerns. You may find EU Data Protection Authorities' contact information at https://edpb.europa.eu/about-edpb/board/members_en.

12. Contact Us:

If you have any questions about this notice or about how we process your personal data, please contact us at fore@caddi.club