Privacy Policy

1. Who is responsible for your data

Divotery is the data controller for the personal data described in this policy. We operate from Denmark.

For any privacy question or request, write to support@divotery.com.

We have not appointed a Data Protection Officer. Privacy requests are handled by our team at that address.

2. The data we collect

Account and profile

• Name, email address and password. The password is stored only as a secure hash, so we never see it.
• Whether you are a player or a coach, your preferred language and your country.
• Optional: your home club and your handicap.

Coach profiles

• Your bio, the place you teach and the golf course you are attached to, including its coordinates so players can find you by distance.
• A profile photo, if you upload one.
• Your approval status, any badge such as certified, and whether your payouts are active.

Bookings and payments

• The lessons you book, their times, prices, currency and status, and the confirmation code for each session.
• Payment and payout references from Stripe. We never store card numbers.

Messages and reviews

• Messages you send through the platform, and any review you write, shown publicly with your first name.

Technical

• Ordinary log data created when you use the service, such as IP address, browser and device type, used to run and protect the service.

3. Where the data comes from

Most of it comes from you, when you sign up, fill in a profile or book a lesson.

Some is created by your use of the service, such as bookings, messages and reviews.

Some comes from Stripe, such as whether a payment succeeded and whether a coach has completed verification. We never receive your full card number.

4. Why we use your data, and our legal basis

To perform our contract with you (GDPR article 6(1)(b)): creating your account, showing you coaches, taking payment, holding and releasing funds, sending booking confirmations, reminders and refund notices, and running messaging between you and your coach.

To meet legal obligations (article 6(1)(c)): keeping accounting records, meeting tax duties, and responding to lawful requests from authorities.

For our legitimate interests (article 6(1)(f)): keeping the platform secure, preventing fraud and abuse, reviewing coaches before they go live, handling support and disputes, and improving the service. We weigh these interests against your rights and freedoms.

With your consent (article 6(1)(a)): where we ask for it, such as using your device location to sort coaches by distance. You can withdraw consent at any time.

5. Location data

If you allow it, we use your device location to sort coaches by distance. We use it to produce that result and we do not build a history of where you have been.

You can refuse it, or turn it off later in your browser or device settings. The rest of the service keeps working without it.

A coach's teaching location, including the course and its coordinates, is part of their public profile.

6. Payments and Stripe

Payments and payouts run through Stripe. Card details go directly to Stripe and never reach our servers.

For players, Stripe processes the payment and can store your card for faster future bookings if you choose that.

For coaches, Stripe collects the identity and bank details it needs for verification and payouts. For that verification Stripe acts as an independent data controller under its own privacy policy, and coaches also accept the Stripe Connected Account Agreement.

7. Who we share data with

Other users

• A coach sees the name and booking details of the player who booked them, plus any messages you send.
• If you sign up for a coach's demo day, that coach sees your name on their attendee list. Brands or sponsors involved in the event are only ever given the number of attendees, never your name or contact details, unless you separately agree to it.
• Players see a coach's public profile. Reviews are public, with your first name.

Providers who process data for us

• Supabase: database, login and file storage.
• Heroku: application hosting.
• Cloudflare: sending transactional email such as confirmations and reminders.
• Stripe: payments, payouts and verification.
• OpenGolfAPI: when a coach searches for their golf club, we send the search text to look up matching courses.

Others

• Authorities or advisers, where the law requires it, or to establish or defend legal claims.

We do not sell your personal data, and we do not use it for advertising.

8. Where your data is stored, and transfers outside the EU

Our database, logins and uploaded files are hosted by Supabase in the EU, in Paris, France. Our applications run on Heroku in the EU, in Ireland.

Some providers, in particular Stripe and Cloudflare, may process data outside the EU and EEA. Where that happens, the transfer is covered by an adequacy decision or by the European Commission's Standard Contractual Clauses, together with additional safeguards where needed.

9. How long we keep your data

We keep personal data only as long as we need it, and different data has different retention periods.

Account and profile data is kept while your account exists. If you delete your account, we delete or anonymise your profile within 30 days, except where we must keep something for one of the reasons below.

Bookings, payments and payouts are accounting records. Danish bookkeeping law requires us to keep them for five years from the end of the financial year they relate to, so we cannot delete them sooner even if you close your account. After that they are deleted or anonymised.

Messages between a player and a coach are kept while both accounts exist and are removed when either account is deleted.

Reviews remain visible after a player deletes their account, because other players rely on them, but we detach them from your identity so they are no longer linked to you.

Demo day signups are kept until the event has taken place and for a short period afterwards so the hosting coach can follow up, then deleted.

Records of emails we sent you, such as booking confirmations and reminders, are kept for up to 12 months so we can investigate delivery problems.

The record of your acceptance of our terms and this policy is kept for as long as the agreement remains relevant, so that we can show what you agreed to and when.

Backups run on a rolling cycle and are overwritten in the normal course, so data deleted from the live system disappears from backups as those backups age out.

10. Your rights

You can ask us to:

• give you a copy of your personal data (access);
• correct data that is wrong or incomplete (rectification);
• delete your data (erasure), where we are not required to keep it;
• restrict how we use it, or object to use based on our legitimate interests;
• send you your data in a portable, machine-readable format;
• withdraw consent, where processing is based on consent. This does not affect what we did before you withdrew it.

Write to support@divotery.com. We reply within one month. We may need to confirm your identity before we act.

If you believe we handle your data incorrectly, you can complain to the Danish Data Protection Agency (Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk), or to the supervisory authority in the country where you live.

11. Cookies and local storage

We do not use advertising or analytics cookies, and we do not track you across other websites or build profiles for marketing.

We store only what the service needs to function:

• your login session, so you stay signed in;
• your language choice, so the site opens in the language you picked.

This is strictly necessary storage, so it does not require a consent banner. If you clear your browser storage you will be signed out and your language choice will reset.

12. Children

Divotery is not meant for children to use on their own, and accounts are for adults.

A parent or guardian can book lessons for a child. They are responsible for that booking and for any information they give us about the child. If you believe a child has given us personal data directly, contact us and we will delete it.

13. How we protect your data

Data is encrypted while in transit. Passwords are stored only as hashes. Access to the database is restricted by row level security, so each account reaches only its own records, and administrative access is limited to the people who need it.

No system is ever completely secure. If a breach is likely to put your rights at risk, we will inform you and notify Datatilsynet as the law requires.

14. Automated processing

We do not make decisions about you by purely automated means that produce legal effects or similarly significant effects, and we do not profile you for marketing.

Two parts of the service do run automatically on fixed rules: a booking is refunded in full if the coach does not confirm it within 36 hours after the lesson was due to end, and reminders are sent before a lesson. If you think one of these produced the wrong outcome, contact us and a person will look at it.

Approval of a coach is always a manual review by a person.

15. Changes to this policy

We may update this policy. The date at the top of the page shows the current version. Where a change matters to you, we will tell you by email or in the app.

16. Contact

For any privacy question, or to exercise any of the rights above, write to support@divotery.com.