Privacy notice

Who we are

Andrew Cook, trading as Cookie Golf Studios, of 45 King Street, Stirling, FK8 1DN, is the data controller for the personal data described here. When Cookie Golf Studios Ltd is incorporated it will take over that role, and this notice will be updated to say so. We are an indoor golf business in Stirling.

For anything about your personal data, contact us at [email protected].

What we collect, and why

If you join the mailing list

First name

To address messages to you

Email address

To send you the messages you asked for

Mobile number, if you give it

To send you SMS or WhatsApp messages, if you agreed to those

Postcode, optional

To understand where interest is coming from, so we plan opening hours and staffing sensibly

Our lawful basis is your consent. You can withdraw it at any time and we will stop.

If you buy a founding membership or a membership

Name, email, mobile number

To manage your membership and contact you about it

Billing address

Required for card payments and for our tax records

Payment reference, card type, last four digits

To identify your payment. We never see or hold your full card number

Your tier, hours used and hours remaining

To run the membership

Booking history

To manage bookings and resolve disputes

Our lawful basis is performance of a contract, and legal obligation for the tax records we have to keep.

If you make a group or corporate enquiry

Your name, email address, phone number, company name if you give one, and the details of what you are asking for. Our lawful basis is legitimate interests, specifically responding to an enquiry you made. If we do not hear back from you, we delete the enquiry after twelve months.

If you enquire about investing

Your name, email address and phone number. Our lawful basis is legitimate interests, specifically responding to an enquiry you made about the company.

We use these details to contact you about this funding round and for nothing else. An investor enquiry does not put you on our mailing list, and we do not send you anything automatically. If a conversation does not go anywhere, we delete the enquiry after twelve months. If you do invest, your details are then kept under our statutory obligations to maintain a register of members and our tax records.

If you visit this website

With your consent, Google Analytics and the Meta pixel collect information about your visit, including your IP address, the pages you look at and the device you use. See Cookies and tracking. Without your consent, neither runs.

What we do not collect

We do not collect special category data. We do not ask about your health, and we do not want it. We do not buy or rent marketing lists, and we will never add you to ours because somebody else gave us your details.

Marketing messages

If you have consented, we will send you news about the build, the opening date and how to book, and after we open, offers, events, league news and membership news.

We send these by email, SMS and WhatsApp, depending on which you agreed to and what you gave us.

Every message includes a way to stop it. You can also reply STOP to an SMS, or email [email protected]. We act on it within three working days.

If you buy from us we may send you messages about similar things without asking again, which the law permits, but we will always give you a way to opt out. Service messages that are not marketing, such as a booking confirmation, the door code or a payment receipt, are sent regardless, because you need them.

When you opt out we keep a record that you opted out. That is the only way to be sure we do not contact you again by mistake. It is a minimal record and it is never used to market to you.

Who we share your data with

We use other companies to run the business. Each one only gets what it needs, and may only use it on our instructions.

GoHighLevel

Our CRM, forms, and email, SMS and WhatsApp sending. United States

Stripe

Card payments. Stripe holds your card details, we do not. United States and Ireland

Cloudflare

Website hosting and security. United States

Google

Google Analytics, with your consent. United States

Meta

The Meta pixel, with your consent. United States

Our accountant

Bookkeeping and tax. United Kingdom

We may also share data where the law requires it, or to establish or defend a legal claim.

We do not sell your personal data. We never will.

Data going outside the UK

Several of the companies above are in the United States. When your data goes there we rely on the UK Extension to the EU-US Data Privacy Framework where the company is certified under it, or on the UK International Data Transfer Agreement or Addendum, with a transfer risk assessment on file.

Ask us at [email protected] and we will tell you which applies to a particular company.

Cookies and tracking

Essential

Makes the site and the booking process work. No consent needed, the site cannot function without these

Analytics

Google Analytics, so we can see which pages people use. Consent needed

Marketing

The Meta pixel, so we can measure and target advertising. Consent needed

Analytics and marketing cookies do not run until you accept them. You can change your mind at any time using the cookie settings link in the footer.

Google Analytics data is deleted after 14 months.

How long we keep things

Mailing list, if you never buy anything

While your consent stands. If you have not opened or clicked anything for 24 months we will ask whether you still want to hear from us, and delete you if you do not reply

Group and corporate enquiries that go nowhere

12 months

Investor enquiries that go nowhere

12 months

Member and customer records, including bookings

6 years after your membership or last booking ends. Six years is how long we must keep records for tax, and it also covers the period in which a claim could be brought

Payment records

6 years, for tax

Opt-out records

Kept indefinitely, because deleting them would mean contacting you again by mistake

Website analytics

14 months

CCTV, once the studio is open

30 days, unless it is needed for an incident

When a period ends we delete the data, or anonymise it so it can no longer identify you.

Your rights

You can ask us to:

• Give you a copy of the personal data we hold about you
• Correct it if it is wrong
• Delete it, where we do not have to keep it for tax or legal reasons
• Restrict what we do with it while a query is sorted out
• Send it to you or someone else in a portable format
• Stop using it, where we rely on legitimate interests
• Stop marketing to you, at any time, no reason needed

You can withdraw consent at any time. Withdrawing it does not undo anything we did lawfully before you withdrew it.

Email [email protected]. We reply within one month. There is no charge.

If you are unhappy with how we have handled your data, tell us first and we will try to fix it. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or 0303 123 1113. Complaining to us first does not stop you complaining to them.

Children

Membership, mailing list sign-up and online booking are for people aged 18 and over. We ask you to confirm your age when you sign up, and we do not knowingly collect personal data from anyone under 18 through this website.

Under-18s are welcome to play. A booking that includes anyone under 18 must be made and paid for by a responsible adult aged 18 or over, and we hold that adult's details, not the young people's. We do not ask for names, ages or contact details for anyone under 18 in a group.

If you believe a child has given us personal data, email [email protected] and we will delete it.

Changes to this notice

If we change how we use your personal data we will update this page and change the date at the top. If the change is significant, and we have your contact details and your permission to use them, we will tell you directly.