PRIVACY POLICY

PLINKY PLONK ("we", "us", "our") operates the court-sports marketplace at plinkyplonk.app and related white-label venue websites. This policy explains what personal data we collect, why we collect it, how we use it, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are (Data Controller)

PLINKY PLONK is the data controller for personal data collected via the platform. Contact: hello@plinkyplonk.app.

2. What data we collect

• Account data — name, email, phone number, password hash, profile photo.
• Booking data — venue, court, date/time, participants, sport (pickleball, padel, tennis), coach.
• Payment data — processed by our payment provider(s). We store the last 4 digits of the card, brand, transaction reference and amount. We do not store full card numbers or CVV.
• Communications — messages you send us or send through the platform to venues and coaches.
• Location data — approximate location (city/region) to show nearby courts, only with your permission.
• Device & usage data — IP address, browser, device type, pages visited, referring URL, essential cookies (see our Cookie Policy).
• Marketing preferences — email opt-in/out status and unsubscribe tokens.

3. How we use your data (legal basis)

• To provide the service (contract): create your account, take bookings, process payments, send confirmations, connect you with venues and coaches.
• To operate the marketplace (legitimate interest): share necessary booking details with the venue or coach you booked (name, contact, session details).
• To send transactional emails (contract): receipts, booking confirmations, cancellations, refunds, safety notices.
• Marketing (consent): occasional updates about new venues, features, and offers. You can unsubscribe at any time.
• Fraud prevention, security, legal compliance (legal obligation / legitimate interest).

4. Who we share your data with

• Venues, coaches, and their booking system providers, solely to fulfil bookings.
• Our payment processing partners, to process payments securely.
• Email delivery — transactional and marketing email providers.
• Hosting & infrastructure — cloud providers used to run the platform.
• Authorities — where legally required.

We do not sell your personal data.

5. Sharing data with venues and their booking systems

When you book a court, session, or coach through PLINKY PLONK, we share the details needed to fulfil your booking with the venue or coach you have booked. Where a venue manages its schedule through a third-party booking system, we pass your booking details into that system on the venue's behalf. The information shared is limited to what is needed to deliver your booking: your name, contact details, and the booking details (date, time, session, number of players). We do this because it is necessary to perform the contract you enter when you make a booking. Venues and their booking system providers may only use this information to fulfil and manage your booking. They may not use it for their own marketing unless you separately opt in with them directly. We put data sharing agreements in place with venue partners covering this. Your rights over your data, described elsewhere in this policy, are unaffected.

6. International transfers

Some processors (e.g. Stripe, email providers) may process data outside the UK/EEA. Where they do, we rely on Standard Contractual Clauses or an adequacy decision to protect your data.

7. How long we keep data

• Account data — while your account is active, plus up to 24 months after closure.
• Booking and payment records — 7 years, to meet UK tax and accounting law.
• Marketing preferences — until you unsubscribe.
• Support communications — up to 3 years.

8. Your rights

Under UK GDPR you have the right to:

• Access a copy of your personal data.
• Correct inaccurate data.
• Ask us to delete data ("right to be forgotten"), subject to legal retention.
• Restrict or object to processing, including direct marketing.
• Portability — receive your data in a machine-readable format.
• Withdraw consent at any time (does not affect prior processing).
• Complain to the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any right, email hello@plinkyplonk.app. We respond within 30 days.

9. Children

The platform is not intended for children under 13. Under-18s may only book courts and coaching with the consent of a parent or guardian, who must set up and manage the account.

10. Security

We use encryption in transit (HTTPS), encrypted storage, role-based access controls and row-level security on our database. No system is 100% secure — please use a strong unique password.

11. Cookies

We use essential cookies only. See our Cookie Policy for details.

12. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email or an in-app notice.

13. Contact

Data queries: hello@plinkyplonk.app