Privacy policy

Who is responsible for your data

Haxby Town Council runs the Haxby Sports Courts at Sports Courts, Ethel Ward Playing Fields, Calf Close, Haxby, York YO32 3NU and decides how the personal data collected through this website is used. In data-protection terms the council is the data controller.

• Contact for anything in this policy: clerk@haxbytowncouncil.gov.uk
• Postal address: Haxby Town Council, care of the Town Clerk at the address above

What we collect

• Your email address. Required — it's how you sign in and how we send booking confirmations and reminders. You can change it yourself under Your account; we email both the old and the new address when you do, so a change nobody meant can't go unnoticed.
• An email address added by a club or an administrator. A partner club or a site administrator can add someone by email address so the club can book on their behalf — for example a coach adding their squad. If that happens we email you to say who added you and why, and you don't have to do anything: the account stays unused unless you sign in, and nobody can sign in to it without a one-time link sent to that same address. To have it removed, clerk@haxbytowncouncil.gov.uk and we'll delete it.
• Your name and phone number. Optional, and yours to set or clear at any time under Your account when you're signed in. A name helps the committee know who has the court rather than reading an email address off a list; a phone number is only used if we need to reach you about your booking. Your club's secretary or a site administrator can also fill in a name for you — that's how a club records who its members are before they've signed in — and you can change or remove it yourself afterwards.
• Your bookings. The court, sport, date and time, and whether the booking was cancelled.
• Court photographs, if you choose to add them. Optional. See below.
• Anything you send through the contact form. Your name, email address and the message itself, so we can answer you. It's stored so an enquiry can't get lost, kept while we deal with it, and deleted six months after it's resolved.
• A record of who did what on the site. When a booking is made, changed or cancelled, an enquiry answered, or an account altered, we store who did it and when — including when you sign in. It's how the committee can answer “who cancelled that?”. Only the committee can see it, and it's deleted after 12 months.
• Technical data needed to keep you signed in. See our cookie policy. We don't use analytics or advertising trackers.

We don't ask for, and have no use for, your date of birth, address, or any special category data (health, ethnicity, religion and so on).

Court photographs

When you arrive and when you leave you can add a photo showing the state of the court. This is how the committee keeps track of whether the courts are being looked after, and it protects you: if the court was already damaged when you arrived, your photo shows it.

Adding a photo is always optional. Your booking is valid without one and nothing about your use of the court depends on it.

Because children use these courts, we handle photographs carefully:

• Photograph the court, not people. We ask you not to include people in the shot. If someone is unavoidably in frame, please retake it.
• Only the committee can see them. Photos are stored in a private location and cannot be viewed from a link — the website has to prove who you are before it will show one. They are never public, never shown to other court users, and never published.
• Location data is removed. Photos are re-processed in your browser before upload, which strips the GPS coordinates and camera information phones normally embed.
• They are deleted automatically after 4 weeks. That happens on a schedule without anyone having to remember. The checklist and any note you left are kept for the committee's records; the image itself is gone.
• You can see your own photos on your bookings page, and ask us to delete one at any time.

If you believe a photo of a child has been uploaded, please tell us using the contact above and we will remove it. See also our safeguarding statement.

Why we're allowed to hold it

Under UK GDPR everyone processing personal data needs a lawful basis. Ours are:

• To perform a contract with you — your email and booking details. Without them we can't give you a court or tell you it's confirmed.
• To carry out a public task — running and maintaining a public sports facility on behalf of the community, which covers keeping records of who used a court and how it was left.
• Your consent — the optional court photographs, and your phone number. You're free not to give these, and free to withdraw them later.

Who else can see it

We don't sell your data, and we don't share it for marketing. It is visible to the council's committee members who administer the courts, and it's stored using these service providers, who process it on our instructions only:

• Vercel — runs the website and stores the court photographs.
• Neon — the database holding accounts and bookings, hosted in London.
• Resend — sends the sign-in links, confirmations and reminders.

Some of these providers are based outside the UK, and where data is transferred abroad it is protected by the safeguards UK data-protection law requires. We would also disclose data if the law obliged us to.

How long we keep it

• Court photographs: 4 weeks, then deleted automatically.
• Your account: until you ask us to delete it.
• Contact-form messages: deleted six months after being marked resolved.
• Booking records: kept while they're needed to run and account for the facility.
• The record of who did what: 12 months, then deleted automatically.

Your rights

You can ask us to:

• show you the data we hold about you;
• correct anything that's wrong;
• delete your account and data;
• stop or limit how we use it, or object to us using it;
• give you a copy in a portable format;
• withdraw a consent you gave — for example, remove a photo you added.

Contact us at clerk@haxbytowncouncil.gov.uk and we'll respond within one month, as the law requires. It's free.

If you're unhappy with how we've handled your data you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or call their helpline on 0303 123 1113. We'd appreciate the chance to put things right first.

Children

Accounts are intended for adults booking a court — a parent, guardian, coach or club secretary. We don't knowingly create accounts for under-13s. If you think a child has registered, tell us and we'll remove the account.

Changes

If we change how we use your data we'll update this page and, where the change is significant, tell account holders by email.