Data processing terms
Last updated 11 October 2026. For the club or society, not the player — if you’re here to check what we do with your details, the privacy page is the one you want.
When your club or society uses Swindl., you are the data controller for your members’ details and we are your processor. You decide who is on your roster and why; we hold it and do what your organisers tell us. UK GDPR requires that arrangement to be written down, and this is it. It applies automatically from the day your group is created — there’s nothing to sign.
What we process for you
Members’ names, email addresses, golf scores, handicaps, prize winnings and the audit trail of who did what. For as long as your group is with us, and for up to 90 days after it leaves.
What we undertake
- We act only on your instructions, and the product is the instruction — we don’t do anything with your members’ data that your organisers didn’t ask for.
- We never sell it, never pass it on, and never use it to train anything.
- We do not use your roster to market to your members. A member may choose for themselves, on their own Swindl. account, to receive news and golf offers from us and our partners; that choice is theirs, it is off unless they turn it on, and for those emails we are responsible, not you.
- Everyone with access is bound to confidentiality.
- Encrypted in transit and at rest; backed up nightly; access limited to the people who need it, and logged into your own audit trail when we use it.
- We tell you within 72 hours if there’s a breach affecting your members, with what we know and what we’re doing.
- We help you answer your members’ requests — access, correction and removal are all things your organisers can do themselves from the manage pages.
- On request when you leave, we delete or return your data.
- You can ask us to demonstrate all of this.
Who else is involved
We use these sub-processors, and we’ll tell you before that list changes so you can object:
| Who | What for | Where |
|---|---|---|
| Render | Hosting and database | EU |
| Amazon Web Services (Amazon SES) | Sign-in code emails | EU (Stockholm, Sweden) |
| Cloudflare R2 | Encrypted backups | EU |
| Sentry | Error reports | EU |
One thing worth knowing
When a member asks to be removed, we take their name, email and account off and keep their scores. Other people played in those competitions and their results depend on the field being what it was. Once a record can’t identify anybody it stops being personal data, so this satisfies the request rather than dodging it — but your organisers should know it’s what happens, because a member may ask.
Questions, or your committee wants something signed: privacy@swindl.golf.