Privacy Policy
Carnoustie Golf Heritage and Hospitality Group Limited Privacy Notice
Carnoustie Golf Heritage and Hospitality Group Limited (Company Number: 13138268), registered address: 22 Manchester Square, London, United Kingdom, W1U 3PT (“we”, “us” “Carnoustie Golf Links”) is the Data Controller over any personal data (defined below) we process about you for the purposes set out in this Privacy Notice.
This privacy notice is for:
- our guests/customers/visitors/members/coaching participants/ volunteers/those that participate in our community programmes such as school coaching. Season Ticket Holders have a separate privacy notice which can be accessed via the Season Ticket Holder portal;
- those who visit our websites, including: carnoustie.com, proshop.carnoustie.com; therookerycarnoustie.com; and any other websites that we launch in the future, including mobile applications and/or purchase goods or services from such websites;
- those that have signed up to receive marketing communication;
- those that are on a waiting list for a tee time or Season Ticket;
- those that have otherwise engaged with us either through this website, or directly by telephone, post, social media or email where you may have provided us with personal data;
- Professional contacts at our Partners and Suppliers.
- Trustees of CGLMC Ltd.
This Privacy Policy explains how we use the personal data which we collect about you, how we keep it secure, who we share it with and to explain the legal rights you have in relation to your personal data. If you have any questions about this policy, please contact us by telephone at 01241 802270 or by email communications@carnoustie.com.
Our Promise
In accordance with the Data Protection Law, we will ensure that your data is:
- used fairly and lawfully and in a transparent manner;
- used only for specific, explicit and legitimate reasons;
- adequate, relevant and not excessive having regard to the reason for which it is collected;
- accurate and up to date where possible;
- kept for no longer than necessary;
- used in line with your rights;
- kept secure; and
- transferred internationally only where necessary steps have been taken to ensure the adequate protection and security of the data.
We reserve the right to make minor amends or modifications to this Privacy Notice from time to time, without notice to you, and if we do so, we will post the updated policy on our website. If we make an important change that we need to tell you about, we’ll email you to let you know wherever possible.
What is Personal Data?
Personal Data: means any information relating to an identified or identifiable living person (‘data subject’); an identifiable living person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to on or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identify of that natural person.
Special Category of Data: means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
When we use the term ‘personal data’ we mean both personal data and special category of data
Our Processing
Personal Data is collected in several different ways dependent on your interaction with us. We mostly receive the information from yourself but in some cases we may receive data from third parties such as a Golf Tour Operator. The table below sets out what personal data we process about you, where we get it from, why we use it, our legal basis and who we share it with. Otherwise we will only share your personal data:
- where we are required to share your personal data in accordance with law e.g. such as under a Court order, other authorities or any regulatory requirement to which we may be subject. We may also share information with the Police if we think it is necessary to assist in the apprehension of offenders or detection of crime;
- where we use third parties to undertake certain services on our behalf and in doing so they require to process personal data in order to do this. If so, we will ensure that adequate arrangements are in place to protect your personal data. These third parties include: our professional advisors, our website host provider, cloud storage suppliers, CRM suppliers, marketing platforms (including parties used for sending email marketing communications), IT infrastructure suppliers, tournament hosting and event management software, booking and scheduling software, online coaching software, restaurant booking platform, prize draw and competition hosting sites;
- within our corporate group to the extent this is necessary for the purpose for which it was collected;
- where we need to share your personal information as part of a sale of our assets, or corporate restructure;
- where we have your consent.
Purpose | Personal Data | Lawful Basis | Will we share it with anyone not covered above? |
To respond to your enquiries made by email, post, phone and social media.
| Name, email address, telephone number, social media handle, postal address, any other you provide. | Legitimate Interest – to respond to enquiries. | No |
When you telephone us, we will record your calls. | Any personal data provided on the call. | Legitimate Interest – for training and quality purposes. | No |
When you visit The Rookery. | Name, email, mobile, any dietary requirements, payment information. | Performance of a contract – to book a place at our restaurant or at one of our events. If you do not provide the requested personal data we may not be able to provide the services to you.
Legitimate Interest – to manage the booking.
| No |
To provide you with our goods and services including allowing you to play at our golf courses and Performance Centre, booking a Caddie, entering a waiting list, booking tee-times, golf offers and packages, golf vouchers, custom fitting, lessons/tuition at our Golf Academy or other programme(s) (not including the Professional Shop) . | Name, email, telephone number, payment information (where applicable). | Performance of a contract. If you do not provide the request personal data we may not be able to provide the goods or services to you.
| No |
When you purchase goods from our online or on-site Professional Shop.
| Name, email, telephone number, address for delivery, billing address, payment information as applicable. | Performance of a contract. If you do not provide the requested personal data we may not be able to provide the goods or services to you.
Legitimate Interest – our processor Shopify uses limited automated decision making to prevent fraud (temporary blacklist of IP Addresses or credit cards). It is not considered to make a legal or significant decision/effect on you.
| Shopify, Shopify Payments, UPS for delivery, Fashion Master to fulfil your order, Paypal to process payments, Globo Product Options App to enhance customer experience and Pandectes GDRP Compliance to ensure our practices are compliant. If you want to know more about how these companies process your personal data please visit our Professional Shop privacy notice at The Online Professional Shop - Privacy Notice |
When you join our junior golf programmes such as The Carnoustie Craws, Girls.Lead.Golf Academy or participate in our school tuition programme or junior competitions.
| Name, email, telephone number, address, age of child, name and contact details of parent or responsible adult, Photograph. | Performance of a contract. If you do not provide the request personal data we may not be able to provide the goods or services to you.
Legitimate Interest – to provide golf tuition or tournament entry to children to support participation in golf.
Consent – for photographs. | If we have your consent we may post some information on our website or social media channels. |
When you register and/or participate to play in any of our tournaments.
| Name, email, telephone number, address, photograph. | Legitimate Interest – to organise the tournament. Consent – for photographs. | If we have your consent we may post some information on our website or social media channels to raise awareness of the event |
When you visit our premises, we may capture your image by CCTV, or via our webcams.
| Your image | Legitimate Interest – for security purposes to protect our staff and premises. | No |
When you enter any of our competitions and giveaways. | Name, email, telephone number, photograph. | Legitimate Interest – to manage the competition and notify you if you are the winner.
Consent – to publish your details as the winner on our social media page or website. | If we have your consent we may post some information on our website or social media channels to raise awareness of our the competition or giveaway.
Tournament Providers or Business Partners |
To send you marketing information and provide special offers on your birthday.
| Name, email, date of birth | Consent – for electronic marketing such as email or text. Please note you can unsubscribe at any time.
It is in our legitimate interest to market our business. | Mailchimp |
To use our App | Name, email | Legitimate Interest – to manage access to our app | No |
To understand usage of our websites and behaviour advertising on our website. | Technical data, such as your IP address when you visit our website.
| Legitimate Interest of understanding how our website is used so we can improve it. Legitimate Interest where we use essential cookies required to operate the website.
Consent – for non essential cookies. | Google Analytics, Meta. Please see our Cookie Notice for more information. The Online Professional Shop - Privacy and Cookies
|
When you complete a customer survey. | Name, email, gender, nationality, age | Legitimate Interest of understanding our customer needs. | Survey Monkey |
If you unfortunately incur an injury or are involved in an accident while playing with us, we will record details of this in our accident log and share certain information if necessary.
| Name, contact details, nature of accident, injury, etc. | Legitimate Interest of understanding accidents occurring on our premises to mitigate risk of recurrence.
Compliance with Health and Safety Legislation.
Vital Interest – to protect your vital interest in the event of an emergency. | Depending on nature of incident, potentially Police, Medical Professional or Health and Safety Executive. |
To manage our relationship with Partners and Suppliers. | Name, email, telephone number, | Legitimate Interest – of managing relationship. | No |
To represent CGLMC Ltd as a Trustee | Name, email, telephone, proof of ID, image | Performance of a contract. If you do not provide the request personal data, we may not be able to liaise with you as Trustee.
| No |
To contact you about important updates to the business | Your name, email, Season Ticket Number or reference number | Vital Interest – to keep you up to date with important updates to the business | |
When you use our Photobooth | Your Name, Your image | Consent | No |
Do we share your personal information outside of the UK?
Most of our suppliers are based in the UK, however some of our suppliers may host some of the data they process on our behalf outside the UK, including the EU and US. Where this is the case, we have ensured any sharing of your personal data with third parties is in accordance with Data Protection Law and appropriate transfer mechanism are in place to keep your personal data safe. Please contact us for further information if you have any questions on this point.
Keeping your personal data safe
We have put in place appropriate technical and organisational security measures to protect your personal information and prevent it from being lost, destroyed, damaged, used, altered or disclosed. These measures are in place to protect your personal data in all circumstances where we use it.
How long do we keep your data for?
We will only keep your data for as long as we need to for the reason we have collected it. Please contact us for details about our retention schedule.
Your legal rights
We aim to keep your personal data up to date and welcome any updates to your details or corrections to any inaccuracies. You have certain rights under Data Protection Law which are set out below. If you wish to exercise these rights, please email communications@carnoustie.com. Your rights are:
- right to request access to your personal information - you can request a copy of the personal information we hold on you;
- right to request correction of your personal information - if any personal information we hold on you is incorrect, you can request to have it corrected;
- right to request erasure of your personal information - you can ask us to delete your personal information in certain circumstances;
- right to object to processing or restrict processing of your personal information - you may object to our processing of your personal data in certain circumstances;
- right to request the transfer of your personal information - to provide you, or a third party you have chosen, with your personal information;
- right not to be subject to automated decision-making and profiling; and
- right to withdraw consent – where we process your data on the basis of consent, you can notify us that you want to withdraw consent any time. Please note that this would not affect the lawfulness of the processing prior to your withdrawal.
Please note these rights are not always absolute and there may be some instances where we cannot fully comply. Where this the case we will explain this to you at the time.
If you have any data protection complaints or concerns, you may contact the Information Commissioner's Office (ICO) by post at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Make a complaint about how an organisation has used your personal information | ICO
We’d like to try and help with any concerns you may have before you contact the ICO, so please get in touch with communications@carnoustie.com in the first instance.
Last Updated: February 2025