Privacy Policy

1. Who We Are

Golfa Labs Ltd (“Golfa”, “we”, “us”, or “our”) is a company registered in England and Wales. We operate the website golfa.co and related services (the “Service”).

For the purposes of UK data protection law, Golfa is the data controller of your personal data unless otherwise stated.

If you have any questions about this policy or how we handle your data, you can contact us at: support@golfa.co

2. Scope of This Policy

This Privacy Policy explains:

• what personal data we collect
• how we use it
• who we share it with
• your rights

This policy applies to all users of the Service, including visitors, golfers, coaches, team members, account holders, and customers making bookings.

3. Information We Collect

We collect the following categories of personal data:

a. Information you provide directly

• name
• email address
• phone number (where relevant for bookings)
• account login credentials
• profile photo, country, home club, and handicap
• any communications you send to us

b. Booking and transaction data

• booking details (date, time, location, Provider)
• payment status and transaction references (we do not store full payment card details)

c. Golf activity, scorecard, and community data

• rounds, courses, tees, holes, gross scores, handicaps, and calculated results
• practice sessions, lesson activity, captions, photos, and other journal content
• players, teams, Golfa account tags, guest names, reactions, and follows
• the audience you select for shared activity, such as everyone, followers, or only you

If another golfer includes your Golfa account in a round, that round and your recorded score may appear in your Activity and to the audience selected for the post.

d. Location data

• device location when you choose to allow location access
• country and search area you provide
• used to show and rank nearby courses, clubs, or coaches

Golfa does not use this feature to continuously track your location. You can deny or revoke location access in your browser or device settings and search manually instead.

e. Technical and usage data

• IP address
• browser type and version
• device type and operating system
• pages visited and interactions with the Service
• timestamps and session data

f. Cookies and tracking technologies

We use cookies and similar technologies to:

• operate the Service
• analyse usage
• improve performance

You can control cookies through your browser settings.

g. Google account data (optional)

If you choose to sign in with Google or connect Google Calendar (coaches only), we receive information from Google as described in section 16 below.

4. How We Use Your Information

We use your personal data for the following purposes:

a. To provide the Service

• create and manage your account
• process and manage bookings
• enable communication between you and Providers
• save, resume, calculate, and display rounds and scorecards
• operate journals, profiles, community activity, tags, follows, and reactions

b. To operate and improve the platform

• personalise content (e.g. nearby clubs)
• retrieve course, hole, par, tee, and stroke-index information
• analyse usage and performance
• develop new features

c. To communicate with you

• booking confirmations and updates
• service-related notifications
• customer support

d. For marketing (where permitted)

• send promotional emails or updates
• you can opt out at any time

e. For security and compliance

• detect fraud, misuse, or security incidents
• comply with legal and regulatory obligations

f. Google Calendar sync (coaches, optional)

If you are a coach and connect Google Calendar, we use Google data solely to create, update, and delete calendar events in your Google Calendar that correspond to Golfa lesson bookings. See section 16 for full details.

5. Legal Bases for Processing

Under UK GDPR, we rely on the following legal bases:

• Contract: to provide the Service and fulfil bookings
• Legitimate interests: to improve the Service, ensure security, and operate effectively
• Consent: for marketing communications, certain cookies, and optional Google Calendar connection by coaches
• Legal obligation: where required by law (e.g. tax, regulatory compliance)

6. Sharing of Your Information

We may share your personal data with:

a. Providers (golf clubs and coaches)

• to fulfil your booking
• typically includes your name and booking details
• for lessons booked through Golfa, Providers do not receive your email unless necessary

b. Service providers

We use trusted third parties to operate the Service, including:

• payment processors (e.g. Stripe)
• hosting and infrastructure providers
• email delivery providers
• authentication providers (including Google, for sign-in and optional Calendar sync)
• golf course data, mapping, and geocoding providers
• analytics tools
• customer support systems

These providers are bound by contractual obligations to process data securely and only on our instructions.

c. Other golfers and the public

Your profile and golf activity are shared according to the audience you select and the features you use. Shared activity can include your name, profile photo, course, score, caption, media, tagged players, team result, and reactions. Activity set to only you is not shown in community feeds. Public activity may be viewable without a Golfa account.

Guest player names are shown only as part of the relevant round experience and shared result. Do not add another person's name or information unless you have permission to do so.

d. Legal and regulatory authorities

We may disclose data where required:

• by law
• to enforce our Terms
• to protect rights, safety, or property

e. Business transfers

If Golfa is involved in a merger, acquisition, or sale, your data may be transferred as part of that transaction.

We do not sell your personal data.

7. International Data Transfers

Your data is primarily processed in the United Kingdom.

Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as:

• UK adequacy regulations
• Standard Contractual Clauses (SCCs)
• equivalent lawful transfer mechanisms

8. Data Retention

We retain personal data only as long as necessary to:

• provide the Service
• comply with legal obligations
• resolve disputes
• enforce our agreements

Retention periods may vary depending on:

• account activity
• journal, scorecard, social, and booking history needed to provide the Service
• legal requirements (e.g. tax records)
• legitimate business needs

When data is no longer required, it is securely deleted or anonymised. If you disconnect Google Calendar or delete your account, we delete stored Google Calendar credentials and stop syncing events.

You can edit or delete your own journal entries and finished-round posts in the Service. Deleting a post removes it from Golfa feeds, including the Activity of tagged golfers, subject to limited backup, security, and legal retention.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• encryption (in transit and at rest where appropriate)
• access controls
• secure hosting environments

However:

• no system is completely secure
• we cannot guarantee absolute security

You are responsible for keeping your account credentials secure.

10. Your Rights

Under UK data protection law, you have the right to:

• access your personal data
• request correction of inaccurate data
• request deletion of your data
• restrict or object to processing
• request data portability
• withdraw consent at any time (where applicable)

To exercise your rights, contact: support@golfa.co

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO): https://ico.org.uk

11. Automated Decision-Making

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

We may use basic profiling (e.g. location-based recommendations), but this does not materially impact your rights.

12. Cookies

We use cookies and similar technologies to:

• ensure the Service functions properly
• remember your preferences
• analyse usage

Where required, we will request your consent before placing non-essential cookies.

You can:

• manage cookies through your browser
• disable cookies (note: this may affect functionality)

13. Third-Party Links

The Service may contain links to third-party websites.

We are not responsible for:

• their privacy practices
• their content

You should review their policies separately.

14. Children’s Data

The Service is not intended for individuals under 18.

We do not knowingly collect personal data from children. If we become aware that we have collected such data, we will delete it.

16. Google Sign-In and Google Calendar

Golfa uses Google services in two ways. Both are optional except where you choose Google as your sign-in method.

a. Sign in with Google

If you sign in with Google, we receive basic profile information from Google (such as your name and email address) to create and manage your Golfa account. We do not access your Google Calendar through sign-in alone.

b. Google Calendar sync (coaches only)

Coaches may optionally connect Google Calendar in Lessons. This is separate from sign-in and requires an explicit connection step.

What we access

• Google Calendar scope: https://www.googleapis.com/auth/calendar.events
• We use this scope only to create, update, and delete calendar events in the coach's Google Calendar that relate to Golfa lesson bookings
• We do not read, import, or sync events from your Google Calendar into Golfa, and we do not use Calendar data for advertising

What we store

• an OAuth refresh token and calendar identifier, stored securely on our servers (not in your browser)
• Google Calendar event IDs on relevant lesson bookings, so we can update or remove the correct event when a booking changes
• event details we send to Google (lesson date and time, lesson type, golfer name, venue/bay, and booking reference)

Why we use it

To keep a coach's Google Calendar up to date when Golfa bookings are created, rescheduled, cancelled, or marked as a no-show — so coaches can see their lessons alongside other commitments.

How to disconnect

• in Golfa: Lessons → Google Calendar → Disconnect
• in Google: Google Account permissions — remove Golfa's access

Disconnecting stops future sync. Events already added to your calendar remain in Google Calendar unless you delete them there.

Google API Services User Data Policy

Golfa's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only use Google user data to provide or improve user-facing features of Golfa, and we do not transfer Google user data to third parties except as needed to provide the Service (e.g. secure hosting), to comply with law, or as part of a merger or acquisition.

Google's own privacy policy applies to your use of Google services: https://policies.google.com/privacy

17. Changes to This Policy

We may update this Privacy Policy from time to time.

Updates will be posted on this page with a revised date. Continued use of the Service constitutes acceptance of the updated policy.

18. Contact

If you have questions about this Privacy Policy or your data, contact:

Golfa Labs Ltd
Email: support@golfa.co