Privacy policy

1. Who we are

HG Club is run by [Company name], a company registered in England and Wales (company number [number]), with its registered office at [address].

We are the data controller for the personal data described in this policy. This means we decide how and why it is used. We are registered with the Information Commissioner's Office (ICO), registration number [ICO number].

Contact us about your data at [privacy@yourdomain.co.uk] or by WhatsApp on +44 7700 900555. We haven't appointed a Data Protection Officer because the law doesn't require one for a business of our type and size. Our privacy lead is [name].

2. What we collect

If you're a member

• Identity and contact details: name, email address, mobile number
• That you confirmed you're 18 or over, and when
• Whether you live in Harrogate or are visiting, and your postcode or visit dates if you give them
• Your preferences: channels, how often, interests
• Offers you view and claim, when you claimed them and which message you came from
• For offers with a QR code: each time a venue marks your code as used, and when
• At venues that run a loyalty scheme: your loyalty card for it, each visit and the bill amount staff enter, free items earned and given, and when. Venues see totals and card numbers, never your name; staff see your name at the till, as they do for offers.
• Consent records: what you agreed to, the exact wording shown, when and where
• Messages you send us by email, text, WhatsApp or our contact form

If you sign up before launch

Signing up on our landing page before launch makes you a member straight away, so we hold the member details above and use them in the same way, starting with the first roundup the week we launch. If you signed up to our earlier waitlist, we've made you a member with the details you gave, kept your consent record, and emailed you a link to confirm your address.

If you represent a venue

• Your name, role, work email and mobile number
• Business details, including information from your public Google Business Profile (name, address, phone, website, opening hours, rating, photos)
• Verification results, offers you create and payment records. Card details are handled by Stripe, and we never see or store them.

If you use the website or our app

• Technical data such as IP address, browser and device type, collected by our hosting provider for security and to keep the site running
• Cookie data, as described in section 11
• In our iPhone and Android app: your device type, operating system and app version, so we can fix problems, and, only if you allow notifications, a notification token so we can send them. You can turn notifications off at any time in your phone's settings.

We don't collect your precise location, contacts, photos or any advertising identifier.

We don't collect special category data, such as health, religion or ethnicity, and we ask you not to send it to us.

3. Why we use it and our lawful basis

We only use your data when the law allows it. The table below shows what we do and the lawful basis under Article 6 of the UK GDPR.

Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for details of this assessment.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Matching offers to your interests is a simple filter you control.

4. Marketing messages

We follow the Privacy and Electronic Communications Regulations (PECR). We only send offers by the channels you choose, and only after you've confirmed your email address and mobile number. Texts are only sent between 9am and 8pm UK time.

You can stop at any time. Reply STOP to any text, use the unsubscribe link in any email, or change your preferences in your account. We act on it straight away. Visitors can also ask us to stop messages automatically after their stay.

5. Age checks

Membership is only for people aged 18 or over. We ask you to confirm you're 18 or over when you join, and offers that include alcohol are marked 18+. If you're under 18 we don't create an account or keep your details. If we learn that a member is under 18, we delete their account.

6. Who we share it with

We never sell your data. Venues never receive your email address or phone number.

When staff scan your QR code for an offer, or your HG Club card, their screen shows your name so they can check it's yours. Your name isn't kept by the venue or shown in their reports: they see how many times codes were used and what was recorded on loyalty cards, linked only by a claim number or a card number. If you delete your account, your loyalty cards are unlinked from you, so venues keep only anonymous totals.

We don't track you. We don't show adverts, and we don't follow what you do on other companies' websites or apps, or share your data with data brokers or advertisers.

We use these service providers, known as processors, to run the service. Each one only uses your data on our instructions, under a written contract.

We may also share data if the law requires it, to protect our rights or someone's safety, or with a buyer if our business is sold, in which case this policy would still apply.

7. Transfers outside the UK

Some providers process data in the USA. When that happens we make sure it's protected by one of these: the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for a copy of the safeguards we use.

8. How long we keep it

We keep data only as long as we need it. These periods are our proposal and will be confirmed before launch.

9. Keeping it secure

We use encryption in transit and at rest, access controls so staff only see what they need, sign-in by one-time code, and regular reviews of who has access. If a data breach puts your rights at risk, we'll tell the ICO within 72 hours and tell you without undue delay.

10. Your rights

Under the UK GDPR you have the right to:

• Access: get a copy of the data we hold about you
• Rectification: have wrong or incomplete data corrected
• Erasure: have your data deleted. You can delete your account yourself on the website or in the app at any time; here's how, and what we keep.
• Restriction: ask us to limit how we use your data
• Portability: get your data in a format you can take elsewhere
• Object: object to us using your data based on legitimate interests
• Withdraw consent: stop marketing at any time. This doesn't affect anything we did before.

To use any of these rights, contact us. We'll reply within one month, and we may ask you to confirm who you are. Making a request is free.

11. Cookies

We use only the cookies needed to keep you signed in and the site working. We count page visits with Vercel Web Analytics, which doesn't use cookies or identify you: it sees the page, your rough location and device type, and discards your IP address. We also keep our own daily visit totals. To count each visitor once a day, we store a scrambled one-way code made from the date, your IP address and browser, which can't be turned back into them and is deleted after two days. If we add any non-essential cookies, we'll ask for your consent first and list them in a cookie policy.

12. Complaints

Please contact us first so we can put things right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk · 0303 123 1113 · Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

If you live in the EU, you can also complain to the data protection authority in your country.

13. Changes to this policy

We'll post any changes here and update the date below. If a change is significant, we'll email members before it takes effect.