Privacy notice for learners

This is a plain-English summary. Your club is the data controller. GolfSec Ltd processes your data for your club under a data processing agreement.

What we hold about you

• Your name, your work email if you have one, and your role and staff groups at the club.
• Which lessons you've completed and how you answered the questions.
• Which club policies you've confirmed you've read, and when.
• If your club sends practice phishing emails: whether you clicked a link in one, and whether you reported it. We never collect anything you type into a practice page, and we don't track whether you open emails.

Why

Your club has a legitimate interest in keeping its members' data, payments and systems safe (UK GDPR Article 6(1)(f)). Training records also help the club show its insurer and Cyber Essentials assessor that staff are trained.

Who sees it

Your club admin can see your individual progress. Team managers only see their own team. The committee sees club-wide totals, never named results. GolfSec staff can only see your club's data during a time-limited, logged support session.

Results from practice phishing emails are used for coaching only, never for discipline.

How long we keep it

• Practice phishing results: 12 months, then they're kept only as club totals.
• Training and policy records: while you're at the club, plus two years.
• Seasonal staff are archived when their season ends and anonymised a year later.

Where it's stored

Your data is stored in the European Union, in the Netherlands, by GolfSec's hosting provider, Railway. UK data protection law recognises the EU as giving personal data adequate protection.

Your rights

You can ask your club for a copy of your data, ask for it to be corrected, or ask for it to be erased. You can also complain to the Information Commissioner's Office (ico.org.uk).