Privacy Policy

This privacy policy explains how Clubwater ("we", "us", "our") collects, uses, stores, and protects personal data in connection with the Clubwater platform, available at clubwater.co.uk and app.clubwater.co.uk.

Clubwater is operated as a trading name. For any privacy-related enquiries, please contact us at hello@clubwater.co.uk.

We take your privacy seriously and are committed to handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who this policy applies to

This policy applies to:

• Anglers — individuals who create a Clubwater wallet account to store and manage their fishing club memberships and EA rod licence
• Club administrators — club secretaries, treasurers, and other committee members who register their club and use the Clubwater admin portal
• Visitors — anyone who visits the Clubwater marketing website at clubwater.co.uk

2. Data we collect

Anglers

When you create a Clubwater account, we collect:

• Full name and email address
• Password (stored in encrypted form — we never store your plain text password)
• EA rod licence details you choose to store (licence number, licence type, valid dates)
• Club membership records issued to you through the platform
• Notification preferences

Club administrators

When you register your club on Clubwater, we collect:

• Your name and email address
• Club name and contact details
• Stripe Connect account information (processed directly by Stripe — we do not store your bank details)
• Club settings, membership types, and pricing information you configure
• Member records you add manually through the admin portal
• Booklet content you create (rules, fixtures, waters, contacts, news)

Automatically collected data

When you use the Clubwater platform, we may automatically collect:

• Log data including IP address, browser type, and pages visited
• Device information
• Usage data to help us improve the platform

3. How we use your data

We use personal data for the following purposes:

• To provide and operate the Clubwater platform
• To issue digital membership permits and maintain your wallet
• To process membership payments through Stripe
• To send automated renewal reminders for memberships approaching expiry
• To enable bailiff QR code verification of membership validity
• To send transactional emails such as payment receipts and welcome messages
• To allow club administrators to manage their member database
• To improve and develop the Clubwater platform
• To comply with our legal obligations

4. Legal basis for processing

We process personal data on the following legal bases under UK GDPR:

• Contract performance — processing necessary to provide the Clubwater service you have signed up for
• Legitimate interests — processing necessary for the legitimate interests of operating and improving the platform, where these interests are not overridden by your rights
• Legal obligation — processing necessary to comply with applicable laws and regulations
• Consent — where we have asked for and received your consent, such as for marketing communications

5. Data controller and data processor relationships

For the personal data of club members, the fishing club is the data controller — they determine the purpose and means of processing member data. Clubwater acts as a data processor on behalf of the club, processing member data only in accordance with the club's instructions and this privacy policy.

For data relating to club administrators and angler wallet accounts, Clubwater is the data controller.

Clubs registered on Clubwater are responsible for ensuring they have a lawful basis for sharing their members' personal data with Clubwater, and for maintaining their own privacy notices.

6. Third parties we share data with

We share personal data with the following third parties where necessary to provide the Clubwater service:

• Stripe — payment processing. Stripe processes payment card data directly and is PCI-DSS compliant. We do not store card details. Stripe's privacy policy is available at stripe.com/privacy
• Supabase — database and authentication infrastructure. Your data is stored on Supabase servers located in the EU (West Europe — London region)
• Resend — transactional email delivery. Used to send payment receipts, renewal reminders, and other platform emails
• Vercel — hosting infrastructure for the Clubwater platform

We do not sell your personal data to third parties. We do not share your data with third parties for marketing purposes without your explicit consent.

7. Data retention

We retain personal data for as long as necessary to provide the Clubwater service and comply with our legal obligations:

• Active account data is retained for as long as your account remains active
• Transaction and payment records are retained for 7 years in accordance with HMRC requirements
• If you close your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law
• Club membership records may be retained for up to 2 years after expiry for renewal and audit purposes

8. Your rights under UK GDPR

You have the following rights in relation to your personal data:

• Right of access — you can request a copy of the personal data we hold about you
• Right to rectification — you can ask us to correct inaccurate or incomplete data
• Right to erasure — you can ask us to delete your personal data in certain circumstances
• Right to restrict processing — you can ask us to limit how we use your data in certain circumstances
• Right to data portability — you can ask for your data in a machine-readable format
• Right to object — you can object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time

To exercise any of these rights, please contact us at hello@clubwater.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data correctly.

9. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. These measures include:

• Encryption of data in transit using HTTPS
• Row-level security on our database ensuring users can only access their own data
• Encrypted password storage — we never store plain text passwords
• Access controls limiting who can access personal data within our systems

While we take all reasonable steps to protect your data, no system is completely secure. If you believe your account has been compromised, please contact us immediately at hello@clubwater.co.uk.

10. Cookies

The Clubwater platform uses essential cookies necessary for the platform to function, including session cookies to keep you logged in. We do not currently use tracking or advertising cookies.

If we introduce analytics or other non-essential cookies in future, we will update this policy and seek your consent where required.

11. Children's data

The Clubwater platform supports junior fishing club memberships. Where a junior member is under the age of 13, we require parental or guardian consent before an account is created on their behalf. Club administrators adding junior members manually to the platform confirm they have obtained appropriate consent from the member's parent or guardian.

12. Changes to this policy

We may update this privacy policy from time to time. When we do, we will update the "last updated" date at the top of this page. For significant changes, we will notify registered users by email.

We encourage you to review this policy periodically to stay informed about how we protect your data.

13. Contact us

If you have any questions about this privacy policy or how we handle your personal data, please contact us at:

Clubwater
Email: hello@clubwater.co.uk