Privacy Notice

Who we are

ClubDesk is a booking and management platform operated by NexQ Ltd. Each club on the platform is an independent data controller for data about their members; ClubDesk acts as a data processor on their behalf.

What data we collect

• Parent / guardian details: name, email, phone, address, postcode
• Child details: name, date of birth, medical information, allergies
• Booking records: which classes are booked, booking type, payment status
• Safeguarding incident records (where applicable)
• Login and access logs, passkeys / authenticator devices, trusted-device tokens, and one-time email sign-in codes

Legal basis for processing

We process your data under the following legal bases:

• Contract — to manage your bookings and deliver the service
• Legitimate interests — to operate the platform securely, prevent fraud, and maintain audit records
• Legal obligation — safeguarding records are retained as required by law
• Explicit consent — for special-category data (medical, allergies) where required

How we protect your data

• Sensitive fields (date of birth, medical information, allergies) are encrypted at rest using AES-256 Fernet encryption
• Every staff access to a child's sensitive data is logged
• Safeguarding incident records carry a full audit trail
• Data is stored in EU-region servers (UK GDPR compliant)
• HTTPS is enforced on all connections

How long we keep your data

We retain personal data for as long as your account is active and for up to 2 years after your last booking, unless a shorter or longer period is required by law. Safeguarding records are retained for the period required by the relevant statutory guidance.

Your rights

Under UK GDPR you have the following rights:

• Right of Access (Art.15) — request a copy of all personal data we hold about you
• Right to Portability (Art.20) — download your data in a machine-readable format
• Right to Erasure (Art.17) — request deletion of your personal data (subject to legal retention requirements)
• Right to Rectification (Art.16) — ask us to correct inaccurate data
• Right to Restriction (Art.18) — ask us to restrict processing of your data
• Right to Object (Art.21) — object to processing based on legitimate interests

Exercising your rights

To submit a Subject Access Request or Right to Erasure request, log in to your account and visit your dashboard. If you have a complaint, you can contact the Information Commissioner's Office (ICO) at ico.org.uk.

Cookies

We use strictly necessary session cookies to keep you logged in. We do not use analytics, advertising, or tracking cookies.

Contact

If you have questions about this privacy notice, please contact your club administrator or reach us at [email protected].

Last updated: June 2026