Privacy Policy

1. Who We Are

Golfa Labs Ltd (“Golfa”, “we”, “us”, or “our”) is a company registered in England and Wales. We operate the website golfa.co and related services (the “Service”).

For the purposes of UK data protection law, Golfa is the data controller of your personal data unless otherwise stated.

If you have any questions about this policy or how we handle your data, you can contact us at: support@golfa.co

2. Scope of This Policy

This Privacy Policy explains:

• what personal data we collect
• how we use it
• who we share it with
• your rights

This policy applies to all users of the Service, including visitors, account holders, and customers making bookings.

3. Information We Collect

We collect the following categories of personal data:

a. Information you provide directly

• name
• email address
• phone number (where relevant for bookings)
• account login credentials
• any communications you send to us

b. Booking and transaction data

• booking details (date, time, location, Provider)
• payment status and transaction references (we do not store full payment card details)

c. Location data

• approximate location derived from your device or browser
• used to show relevant nearby clubs or coaches

d. Technical and usage data

• IP address
• browser type and version
• device type and operating system
• pages visited and interactions with the Service
• timestamps and session data

e. Cookies and tracking technologies

We use cookies and similar technologies to:

• operate the Service
• analyse usage
• improve performance

You can control cookies through your browser settings.

f. Google account data (optional)

If you choose to sign in with Google or connect Google Calendar (coaches only), we receive information from Google as described in section 16 below.

4. How We Use Your Information

We use your personal data for the following purposes:

a. To provide the Service

• create and manage your account
• process and manage bookings
• enable communication between you and Providers

b. To operate and improve the platform

• personalise content (e.g. nearby clubs)
• analyse usage and performance
• develop new features

c. To communicate with you

• booking confirmations and updates
• service-related notifications
• customer support

d. For marketing (where permitted)

• send promotional emails or updates
• you can opt out at any time

e. For security and compliance

• detect fraud, misuse, or security incidents
• comply with legal and regulatory obligations

f. Google Calendar sync (coaches, optional)

If you are a coach and connect Google Calendar, we use Google data solely to create, update, and delete calendar events in your Google Calendar that correspond to Golfa lesson bookings. See section 16 for full details.

5. Legal Bases for Processing

Under UK GDPR, we rely on the following legal bases:

• Contract: to provide the Service and fulfil bookings
• Legitimate interests: to improve the Service, ensure security, and operate effectively
• Consent: for marketing communications, certain cookies, and optional Google Calendar connection by coaches
• Legal obligation: where required by law (e.g. tax, regulatory compliance)

6. Sharing of Your Information

We may share your personal data with:

a. Providers (golf clubs and coaches)

• to fulfil your booking
• typically includes your name and booking details
• for lessons booked through Golfa, Providers do not receive your email unless necessary

b. Service providers

We use trusted third parties to operate the Service, including:

• payment processors (e.g. Stripe)
• hosting and infrastructure providers
• email delivery providers
• authentication providers (including Google, for sign-in and optional Calendar sync)
• analytics tools
• customer support systems

These providers are bound by contractual obligations to process data securely and only on our instructions.

c. Legal and regulatory authorities

We may disclose data where required:

• by law
• to enforce our Terms
• to protect rights, safety, or property

d. Business transfers

If Golfa is involved in a merger, acquisition, or sale, your data may be transferred as part of that transaction.

We do not sell your personal data.

7. International Data Transfers

Your data is primarily processed in the United Kingdom.

Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as:

• UK adequacy regulations
• Standard Contractual Clauses (SCCs)
• equivalent lawful transfer mechanisms

8. Data Retention

We retain personal data only as long as necessary to:

• provide the Service
• comply with legal obligations
• resolve disputes
• enforce our agreements

Retention periods may vary depending on:

• account activity
• legal requirements (e.g. tax records)
• legitimate business needs

When data is no longer required, it is securely deleted or anonymised. If you disconnect Google Calendar or delete your account, we delete stored Google Calendar credentials and stop syncing events.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• encryption (in transit and at rest where appropriate)
• access controls
• secure hosting environments

However:

• no system is completely secure
• we cannot guarantee absolute security

You are responsible for keeping your account credentials secure.

10. Your Rights

Under UK data protection law, you have the right to:

• access your personal data
• request correction of inaccurate data
• request deletion of your data
• restrict or object to processing
• request data portability
• withdraw consent at any time (where applicable)

To exercise your rights, contact: support@golfa.co

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO): https://ico.org.uk

11. Automated Decision-Making

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

We may use basic profiling (e.g. location-based recommendations), but this does not materially impact your rights.

12. Cookies

We use cookies and similar technologies to:

• ensure the Service functions properly
• remember your preferences
• analyse usage

Where required, we will request your consent before placing non-essential cookies.

You can:

• manage cookies through your browser
• disable cookies (note: this may affect functionality)

13. Third-Party Links

The Service may contain links to third-party websites.

We are not responsible for:

• their privacy practices
• their content

You should review their policies separately.

14. Children’s Data

The Service is not intended for individuals under 18.

We do not knowingly collect personal data from children. If we become aware that we have collected such data, we will delete it.

16. Google Sign-In and Google Calendar

Golfa uses Google services in two ways. Both are optional except where you choose Google as your sign-in method.

a. Sign in with Google

If you sign in with Google, we receive basic profile information from Google (such as your name and email address) to create and manage your Golfa account. We do not access your Google Calendar through sign-in alone.

b. Google Calendar sync (coaches only)

Coaches may optionally connect Google Calendar in Account settings. This is separate from sign-in and requires an explicit connection step.

What we access

• Google Calendar scope: https://www.googleapis.com/auth/calendar.events
• We use this scope only to create, update, and delete calendar events in the coach's Google Calendar that relate to Golfa lesson bookings
• We do not read, import, or sync events from your Google Calendar into Golfa, and we do not use Calendar data for advertising

What we store

• an OAuth refresh token and calendar identifier, stored securely on our servers (not in your browser)
• Google Calendar event IDs on relevant lesson bookings, so we can update or remove the correct event when a booking changes
• event details we send to Google (lesson date and time, lesson type, golfer name, venue/bay, and booking reference)

Why we use it

To keep a coach's Google Calendar up to date when Golfa bookings are created, rescheduled, cancelled, or marked as a no-show — so coaches can see their lessons alongside other commitments.

How to disconnect

• in Golfa: Settings → Account → Google Calendar → Disconnect
• in Google: Google Account permissions — remove Golfa's access

Disconnecting stops future sync. Events already added to your calendar remain in Google Calendar unless you delete them there.

Google API Services User Data Policy

Golfa's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only use Google user data to provide or improve user-facing features of Golfa, and we do not transfer Google user data to third parties except as needed to provide the Service (e.g. secure hosting), to comply with law, or as part of a merger or acquisition.

Google's own privacy policy applies to your use of Google services: https://policies.google.com/privacy

17. Changes to This Policy

We may update this Privacy Policy from time to time.

Updates will be posted on this page with a revised date. Continued use of the Service constitutes acceptance of the updated policy.

18. Contact

If you have questions about this Privacy Policy or your data, contact:

Golfa Labs Ltd
Email: support@golfa.co