Privacy Policy

PRIVACY POLICY

Introduction
Puttshack is committed in respecting and protecting your personal data. Puttshack Ltd (company number 09875975) is the controller and responsible for your personal data. The following privacy policy outlines that we are committed to ensuring privacy and security of your data and shows the general processes we go through once you provide your information. As well as detailing what information we collect from you, our policy also details how and when it is used to ensure your privacy and legal rights to your data. We also advise how best to contact us, should you want us to stop using your data at any time. If you have any questions or comments on this privacy policy, please do not hesitate to contact us through the following methods: Contact us via email: info@puttshack.com Write to us at: Puttshack, 27-32 Old Jewry, 2nd Floor, London, EC2R 8DQ You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

What data Puttshack collects
As a visitor to our website or a customer at our venues, we will collect and use various types
of personal data relating to you. This data includes:
• data you provide to us when you submit information through our booking forms, last
minute booking forms, guest list sign-up forms, newsletter sign up forms and Wi-Fi
sign ups. This data is any information that identifies you which includes first and last
name, email address, telephone number, company name and payment details;
• information you may have voluntarily shared with us or made public via social media
platforms or information you have given to us as part of a survey;
• transaction and financial data such as your bank account and payment card details;
• marketing data where you have signed up to receive marketing communications from
us, for further details please see the “Marketing” section below;
• cookies and technical data relating to the use of our website such as internet protocol
address, browser type, location. For further details, please see the “Cookies” section
below;
• player data relating to your usage of our venues, scores and player account profile;
• filming for the purposes of providing you with action replays;
• filming and photography from our venues, where we have the necessary consent to
use this data for our marketing purposes, for further details please see the “Marketing”
section below.
• CCTV data at our venues.

The above list is not exhaustive and there may be occasions where it is necessary to
collect additional information from you. In this event, we will request this in advance of
collection and ensure you are made aware of what we intend to do with that information.
We do not intentionally collect personal information from minors (those under the age of
18) but where there is a possibility this may be the case, for example in relation to any
filming or photography as described further in the “Marketing” section below, we will
seek parental consent from minors.

We do not ordinarily collect or process special categories of personal data about you as a
customer at our venue or visitor to our website. Special categories of personal data
include details about your health, race or ethnicity, religious or philosophical beliefs and
political opinions. However, if you are injured at one of our venues or provide us with
this type of data for allergy purposes, we will need to collect and process the data and will
make you aware of that at the time of collection. We will need to keep a record of any
injuries sustained at our venues for health and safety purposes and in the event there are
any resulting legal claims.

We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with services).

Cookies
A cookie is a small piece of information that is placed on your computer when you
visit certain websites. When we refer to “cookies” we include other technologies with similar
purposes, such as tags and identifiers. Find out more about the use of cookies on
http://www.cookiecentral.com/.

As soon as you visit our website, our web server will automatically record an anonymous profile of which website you visited us from, pages you have visited and what sequence, and the date and length of your visit. This is aggregated data and does not identify you specifically. When you first visit our sites using a new browser, or if you visit in private browsing mode, we will provide you with a cookies permission banner seeking your consent to use of cookies as required by law. From this banner you will be able to access our cookies management tool. By clicking OK or clicking through to any part of the site, we will start to manage your visit using cookies. We use the following types of cookie, as will your browser:

(1) Analytics cookies that remember your computer or mobile device when you visit our website and recognise visits to our website across different devices. They keep track of browsing patterns and help us to build up a profile of how our readers use the website. We use that information for customer analytics and to serve advertisements that we think might be of particular interest to you on our and other websites. Your browser may use similar cookies for similar purposes and to serve advertisements for others.

(2) Service cookies that help us to make our website work as efficiently as possible; remember your registration and login details; remember your settings preferences; to detect what device you are using and adapt how we present our services according to the screen size of that device; and meter the number of pages you view.

(3) Third party advertising and analytics cookies, which are placed by or on behalf of independent advertisers who are advertising on our site. These cookies may be placed within the advertisement and elsewhere on our site by us or by your browser. They can allow the advertiser or your browser to tailor advertising to you when you visit other websites. They are used for statistical analysis by allowing the advertiser to count how many people have seen their advertisement or have seen it more than once, to make sure you are not repeatedly served with the same advertising messages.

(4) We also place third party cookies to enable the serving of our own advertisements, for example, for our subscriptions offers, on other websites. These advertisements will be based on your browsing behaviour on our website and will be tailored to your interests. The information we gather from your visit is limited to page URLs.

Why we collect information from you
We collect your data to enable us to:
• provide a better user experience on our website and at our venues;
• send you content that would be of interest to you through newsletters and other marketing communications;
• carry out promotional activities and to constantly build stronger marketing campaigns both online and offline based on customer needs and wants;
• improve our service through reservation and sales by dealing with enquiries or queries and booking process;
• pursue leads through sales and events;
• allow you to make bookings on our website;
• provide customer service on-site at our venues and comply with our legal obligations to prevent any fraudulent transactions or criminal activity

Marketing
Where you are a consumer customer and have consented to us providing you with marketing materials, we will use your email address, home address and/or your telephone number to send you emails, mail shots or texts for marketing purposes. This includes communications with you where you have consented to be part of our loyalty programme or other promotions from time to time.

We will provide you with a clear choice when we collect your personal information to opt
into receiving these marketing materials.
.
If you ever decide you no longer wish to receive our marketing communications, you can do
so at any time by selecting the ‘opt out/ unsubscribe’ links contained in all email marketing
communications or by contacting Puttshack using the ‘contact us’ form on our website. If you
do unsubscribe, your details will be held in a suppression list and deleted after 1 year. You
will not receive further marketing communications from us unless you re-subscribe. Please
note that we may still email you from time to time where necessary relating to any bookings
you have made.

To enhance the player experience, we film your shots and highlights during the game to play back to validate your win on the “Wheel of Fortune” hole. We do not use this footage for anything else and it is deleted after one week.

We may from time to time ask you for consent so that we can use your footage in marketing
materials, including on our social media accounts. We’ll make it clear at the time of asking
for consent what we intend to do with the footage. Please note that if you’re under the age of 18 we’ll need to ask for parental consent. Any footage or photography that we collect will be used by us and not sold to any third party.

If you represent another business, we may provide you with direct marketing communications where we feel that this may be relevant to your business (provided that you have not opted out of such communications). When we use your personal data for such purposes, we do so on the basis that it is in our legitimate interests to pursue direct marketing, provided that it constitutes fair processing of your personal data to do so.

Our legal basis for processing personal data
To ensure that Puttshack’s use of your personal information always complies with all applicable data protection legislation, uses must fall under at least one of the specific lawful reasons and we set out the ones we rely on below:
• performance of a contract with you. This is relevant where we use your personal details for bookings and to manage our relationship with you which includes providing you with customer services;
• our legitimate interests. This means our interest in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). Our legitimate interest is relevant for all of our other activities such as marketing, enabling you to take part in promotional activities, providing better user experiences and content (for example, filming footage for the action replays), improving our services and providing you with customer services as these activities are necessary for us to keep our records updated, study how our products are used and to develop and grow our business;
• complying with our legal obligations to protect individuals and maintain their safety and welfare and administering our website and business to prevent fraud; and
• consent from you where we require this for marketing purposes that do not fall within our legitimate interests and where we need to rely on your express consent for processing activities relating to filming and photographing you at our venues.

How Puttshack will store your personal data?
We store all personal data locally. Our system is hosted inAWS, Azure, IOMart, Mailgun, Twilio, SendGrid, and local DB servers at our venues, as we improve our booking process. Your information will not be stored for longer than is necessary for the purposes described in this privacy policy.

Will Puttshack share your personal data with anyone else?
Puttshack may share your data between entities within Puttshack for operational purposes. By using our website and submitting your personal data, you agree for anyone working in Puttshack to access your data and use for the purposes as outlined in this privacy policy. Your data may be shared with third parties who are providing a service to Puttshack, these third parties are listed below. We may also provide anonymous or aggregate data with advertisers and business partnerships to understand customer trends and patterns, as well as maintaining our business relationships. This data will be anonymous and will not identify you as an individual. As Puttshack continues to grow and expand, we may share your personal data with potential new partners, sponsors and brands that work in association with us, this is purely for your interest in our brand. Please note, we will not be selling your data to any third parties.

Third party partners:

Ignite Creates (Marketing)

Punchh (Marketing)

Braze (Marketing)

We are Descriptive (Marketing)

CACI (Market research demographics)

Any third parties who provide services to us at our venues such as for the purposes of catering (including, any third party applications or software for menus or placing orders).

The data shared with the above parties would be your name and email address and this sharing is necessary for the purposes of running our business. We do not allow our third-party processors to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

We will not usually disclose your personal data other than as set out above. However, there may be circumstances where we need to share personal data other than as anticipated above. These include:

• where we are legally required to disclose the information, for example because a court orders us to do so;
• where the disclosure of the personal data is required for the purposes of the prevention and detection of crime. This includes sharing the personal data with tax authorities and law enforcement agencies;
• where we need to disclose the personal data for the purpose of or in connection with any legal proceedings, or for the purpose of obtaining legal advice, or the disclosure is otherwise necessary for the purposes of establishing, exercising or defending legal rights;
• where disclosure is necessary to protect your vital interests (for example if you are unwell at our premises, we may need to seek medical assistance); and
• to any actual or prospective purchaser of our business assets or organisation.

Third party sponsors and links from our website
From time to time we may have links on our website that direct you straight to third party websites and in which have their own privacy policies different to ours. We are not responsible for any data collected from these third-party sites and their use and we encourage you to read the privacy statements on the other websites you visit.

Will Puttshack transfer your personal data out of the UK?
We store all personal data locally. We store your data in the UK but Puttshack is also looking to grow globally so it may be necessary that we transfer personal data to international operations. If we do need to do so, we will update this privacy policy and we will put appropriate safeguarding measures in place to protect your data.

Your rights
You have rights in respect of your personal data and this section explains a bit more about those rights that are applicable to what we do with your personal data and when you can exercise them. If you would like more information about any of your rights, please contact us on the details set out below

1. Accessing your personal data
We want you to fully understand and be comfortable with how we use your personal data. The purposes for which we use your personal data are set out in this privacy policy. In addition, you can contact us at any time to ask whether we process any personal data about you. If we do hold or use your personal data in any way, you have the right to access that personal data. All we ask is that:
o you make your request to access your personal data in writing to the contact details below;
o you provide any documents we ask for so that we can verify your identity; and
o you are fair and reasonable with how often you make this kind of request.

2. You have the right to request that we rectify any inaccurate personal data about you
that we may hold, in which case we may ask you to verify the corrected information.

3. You have the right to request that we erase your personal data. Please be aware that
we can only comply with such a request if:
o your personal data is no longer required for the purposes it was collected for;
o the personal data has been unlawfully processed;
o the personal data needs to be deleted to comply with a legal obligation; or
o you have objected to the processing in accordance with the below and we don’t have any other legitimate reason to process your personal data.

We will not be able to comply with a request for erasure if your personal data is required for purposes of establishing, exercising or defending a legal claim such as in the conduct of legal proceedings, if the processing is required to comply with a legal obligation or if the processing is in the public interest.

4. You have the right to request that we restrict processing of your personal data (which means that we only store your personal data and do not carry out any further processing with it):
o for the time it takes us to verify the accuracy of your personal data where you have disputed its accuracy;
o where the collection, storage or use of the personal data by us is unlawful but you decide not to ask for erasure;
o where we no longer need your personal data but you need the data for the purposes of establishing, exercising or defending a legal claim; or
o for the time it takes to determine whether we have an overriding legitimate ground to continue to process your personal data, where you have exercised your right to object to processing.

5. You have the right to data portability in respect of information we have collected from you based on consent or for the reason of entering into or performing a contract. This means that you have the right to have a copy of your personal data transferred to you in a common electronic format.

6. You have the right to object to our use of your personal data:
o where we are using that information based on our legitimate interests, and where we do not have compelling overriding grounds to continue to use your personal data; or
o at any time, where we use your personal data to send you the newsletter or any other type of direct marketing, in which case it will no longer be used for that purpose, but we may use it for another lawful purpose.

7. You may withdraw consent at any time where we are relying on consent to process your personal data:

however, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

Please allow us up to one month from receipt of your request in order to provide a response. If your request is particularly complex or you have made numerous requests, it may take up to three months from receipt to respond. We will let you know if this is going to be the case.

We do not use automated decision-making (including profiling) to make any decisions which would produce a legal effect or similarly significantly affect a data subject.

How long we retain your personal data.
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements. Generally, we retain your personal data for a period of 6 years but some types of personal data are retained for a much shorter period. For example, any footage taken for action replays is deleted after one week, and if you unsubscribe from our marketing lists, we retain your personal data in a suppression list which is then deleted after one year

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and the Information Commissioner’s Office of a breach where we are legally required to do so.

Contact us If you wish to exercise any of the above rights, or indeed make a complaint about
the way in which you find your data has been handled/ utilised you may do so by emailing us
at info@puttshack.com

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

If you are still not satisfied with the way your complaint or request was handled, you can refer your concerns to the UK Information Commissioner’s Office. https://ico.org.uk/concerns/

Changes to this Privacy Policy
There may be occasions when we will need to update this privacy policy to reflect company initiatives, changes in the law or technology or changes in our practices regarding the collection and use of your personal data. The date this policy was last updated can be found at the top of the page. Our company registration number is
09875975. Our office is registered at 7 Savoy Court, London, United Kingdom, WC2R 0EX