Privacy notice

Who is responsible

Court Board is a personal, non-commercial project built and run by Hasha Dar, who is responsible for the data it holds. It is not a paid service and is not run by or for any employer. Each club's committee runs its own sessions and sets its own rules. Each club's data is kept separately, and an organiser can only see their own club.

To ask a question or make a request about your data, message Hasha Dar on LinkedIn. An organiser can also remove you from a club's list.

What is collected

Court Board keeps only what it needs to run the list:

• Your name, as you type it.
• Your mobile number, kept only as a scrambled code (a keyed hash) that cannot be read back as a number. The full number exists only for the moment you type it, to work out that code. The last three digits are also kept, and only organisers can see them, so they can tell two people with the same name apart.
• Your Tier (Employee, Alumni or External), so it can be filled in next time.
• Your PIN, kept only as a hash.
• The places you take, the guests you bring, whether an organiser marked you as attending, and any penalty.
• A scrambled form of your network address, used only to limit wrong PIN guesses and spam.

Why it is used

To run each session's list and apply the club's rules fairly. The legal basis is legitimate interests (running the club fairly), not consent.

Who sees what

• Your name is visible to anyone with the session link.
• Committee members' names, if the organisers add them, are shown on every session page so players know who to ask.
• Organisers can also see the last three digits of your number, whether you attended, and any penalty.
• Penalties are never shown publicly: only you and the organisers can see them.
• Your full number and your PIN are never stored in readable form, so nobody can look them up, including the person who runs the site.

Who handles the data

The data is stored with Amazon Web Services in the London region (eu-west-2). There is no advertising and no analytics, and the data is never sold.

Like most websites, the hosting provider (AWS) keeps standard web server logs for security and troubleshooting. These record your network (IP) address, the page you asked for, the time and your browser type. They never include your phone number, your PIN or anything you type into a form.

Cookies

Players do not get any cookies. Organisers get one cookie that keeps them signed in. It is strictly necessary and does not need consent.

How long it is kept

• Places you took: deleted 8 weeks after the session.
• Your remembered name, Tier and PIN: deleted 12 months after you last took a place.
• Penalties: deleted when the penalty period ends.
• Wrong-PIN and spam-limit records: kept for 24 hours, then deleted automatically within a few days.
• Backups: the database keeps rolling backups for up to 35 days, so deleted data can remain in a backup for up to 35 days before it is gone for good.
• Hosting logs: kept by AWS for a limited period for security and troubleshooting, then deleted automatically.

Your rights

You can ask to see the data held about you, correct it, have it deleted, or object to how it is used. Ask using the LinkedIn contact above, or ask an organiser, who can delete your details.

If you are unhappy, you can complain to the Information Commissioner's Office at ico.org.uk.

Automatic decisions

The order of each list and any penalty follow the club's published rules automatically. An organiser can correct a Tier, or clear or shorten a penalty.

Children

Court Board is not designed for children.