Privacy Policy

SmashBook is a trading name of Smashbook Ltd, a company registered in England and Wales under company number 17199373. Our registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

Smashbook Ltd is responsible for the personal data described in this policy when acting as a data controller.

Clubs generally decide how player and staff data is used for club operations. In those cases, the Club may be the data controller and Smashbook Ltd may act as a data processor. Smashbook Ltd may act as an independent controller for website enquiries, club-account management, billing, security, fraud prevention, legal compliance, support, and internal business administration. Privacy requests relating to Club-controlled data may need to be handled by the relevant Club.

• name, email address, phone number, account credentials, and profile information
• tenant or club information, staff role, permissions, and account status
• booking, membership, court, tournament, event, coaching, and player activity records
• payment references, transaction status, refunds, wallet activity, and related financial records, but not full card details where Stripe or another payment provider handles card processing
• support messages, website enquiry details, uploaded content, communication preferences, and marketing preferences
• device information, IP address, browser information, app installation identifiers, push-notification tokens, login records, audit logs, analytics data, and usage data

• directly from users when they create an account, contact us, use the website, or use SmashBook applications
• from Clubs that configure their venue, staff, members, bookings, events, and player records
• from payment providers such as Stripe when payments are processed
• from authentication providers, device and browser technologies, support interactions, logs, monitoring, and analytics tools

Where Smashbook Ltd acts only as a processor, the relevant Club determines the lawful basis for processing. Where we act as controller, we rely on the bases below as appropriate.

We do not sell personal data.

• cloud hosting, database, monitoring, security, and infrastructure providers, including Google Cloud or Firebase where used
• payment processors such as Stripe
• email, notification, analytics, customer-support, and communications providers
• professional advisers, insurers, auditors, regulators, courts, and law-enforcement authorities where legally required
• Clubs and Authorised Users where needed to provide the Platform and manage club operations

Some providers may process data outside the United Kingdom. Where required, we use appropriate safeguards such as adequacy regulations, the UK International Data Transfer Agreement, an approved UK addendum, or other legally recognised safeguards.

• account data is kept for the customer relationship and a reasonable period afterward
• financial records are kept for legally required accounting and tax periods
• booking, transaction, membership, and activity records are kept for operational, reporting, and dispute-resolution purposes
• support records are kept for a limited period after resolution, depending on the nature of the request
• security logs are kept for a defined or risk-based period needed for security, audit, and incident response
• marketing preferences are kept until withdrawal, unsubscribe, or replacement by updated preferences
• deleted data may remain temporarily in backups before scheduled deletion

Depending on the circumstances and our legal role, individuals may have rights to:

• access personal data
• correct inaccurate data
• request deletion
• restrict processing
• object to processing
• request data portability
• withdraw consent where processing is based on consent
• raise concerns about automated decision-making where applicable

We may need to verify your identity before acting on a request. Requests about Club-controlled data may be referred to the relevant Club.

You have the right to make a complaint to the UK Information Commissioner's Office. We would appreciate the opportunity to address your concerns first, so please contact us using the details below.

The Platform may be used by Clubs offering services to children. Clubs are responsible for ensuring they have an appropriate legal basis or guardian authority where required. Children should not independently provide personal information where parental or guardian involvement is legally required. SmashBook does not knowingly use children's data for unrelated advertising.

The public website uses local storage for the site theme preference. SmashBook applications may use essential cookies, local storage, device identifiers, or similar technologies for authentication, security, preferences, notifications, analytics, and service operation. Essential technologies are needed to provide the service. Where non-essential analytics or marketing cookies are used and consent is required, they should only be used with consent.

Smashbook Ltd uses reasonable technical and organisational measures to protect personal data, including access controls, encrypted connections, authentication, monitoring, backups, least-privilege access, and vendor-security reviews. No system can be guaranteed completely secure.

SmashBook may provide analytics, forecasts, recommendations, player matching, or AI-assisted features. These features are intended to support human decision-making. Unless specifically stated otherwise, they do not make solely automated decisions that produce legal or similarly significant effects on individuals.

Privacy contact email: [email protected]

Smashbook Ltd, trading as SmashBook. Company number: 17199373. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.