Privacy Policy

Jack Longley Golf is operated by Jack Longley, a PGA Golf Professional based in the Midlands, UK. For the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018), Jack Longley is the data controller for personal information collected through this website.

Contact us about data matters: mail@jacklongleygolf.co.uk

We collect and process the following categories of personal data:

• Identity & contact information: Your full name, email address, and phone number, provided when you create an account or book a lesson.
• Booking information: Lesson type, scheduled date and time, booking status, and any notes related to your lessons.
• Payment information: When you pay for a lesson or package, your payment is processed securely by Stripe. We receive confirmation of payment (amount, reference, and last four digits of card) but do not store your full card details.
• Account credentials: Your email address and hashed password, managed securely by Supabase Auth. We never store plain-text passwords.
• Usage data: With your consent, we collect anonymised website analytics (pages visited, session duration) via Vercel Analytics to understand how the site is used and improve it.
• Communications: If you contact us via the contact form or email, we retain that correspondence.

We use your personal data for the following purposes:

• To create and manage your account on this website.
• To process and confirm your lesson bookings and payments.
• To send booking confirmation, reminder, and cancellation emails.
• To respond to enquiries submitted via the contact form.
• To improve the website and our services (with your consent, via anonymised analytics).
• To comply with legal obligations, including financial record-keeping.

Under UK GDPR, we rely on the following legal bases:

• Contract performance — to fulfil your bookings and process payments.
• Legitimate interests — to manage communications and maintain our records, where this does not override your rights.
• Legal obligation — to retain financial transaction records as required by law.
• Consent — for non-essential cookies and analytics. You may withdraw this consent at any time via the cookie settings on this site.

• Account data: Retained for as long as your account is active. You may request deletion at any time (see Section 7).
• Booking records: Retained for 7 years following the date of the lesson for tax and financial compliance purposes.
• Payment records: Retained for 7 years in line with HMRC requirements.
• Contact form messages: Retained for up to 2 years, then deleted.
• Analytics data: Anonymised aggregated data with no retention limit; individual session data is not stored.

We do not sell your personal data. We share it only with trusted third-party services necessary to operate this website:

• Supabase — our database and authentication provider. Your account data and bookings are stored securely on Supabase infrastructure (EU region). Supabase Privacy Policy.
• Stripe — our payment processor. Payment details are handled directly by Stripe and subject to their policies. Stripe Privacy Policy.
• Resend — our transactional email provider, used to send booking confirmations and notifications.
• Vercel — our website hosting and analytics provider. Vercel Privacy Policy.
• Google reCAPTCHA — used to protect forms from spam. Subject to Google's Privacy Policy.

All third-party providers are required to handle your data in compliance with UK GDPR.

Under UK GDPR you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Ask us to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): Request deletion of your personal data, subject to legal retention requirements.
• Right to data portability: Receive your data in a structured, machine-readable format. You can download your booking data from your account settings.
• Right to restriction: Ask us to pause processing your data in certain circumstances.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Withdraw consent for analytics or marketing at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at mail@jacklongleygolf.co.uk. We will respond within 30 days. You may also delete your account and download your data directly from your account settings page.

We use the following types of cookies:

• Essential cookies: Required for the website to function (authentication session, booking flow). These cannot be disabled.
• Analytics cookies: Anonymised usage data via Vercel Analytics. Only set with your consent.

You can manage your cookie preferences at any time via the cookie banner shown on first visit.

We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. These include encrypted data storage, HTTPS-only connections, access controls, and rate limiting on our APIs. No method of transmission over the internet is 100% secure, but we continuously work to improve our security practices.

Our website allows parents or guardians to book junior golf lessons on behalf of children under 18. We do not knowingly collect personal data directly from children under 13. If you believe we have inadvertently collected such data, please contact us immediately.

We may update this Privacy Policy from time to time. The date at the top of this page indicates when it was last revised. Continued use of our website after changes constitutes acceptance of the updated policy.

If you have concerns about how we handle your data and are not satisfied with our response, you have the right to lodge a complaint with the UK's data protection regulator:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113