Privacy Policy

Last updated 20 October 2026

OnTheTee ("we", "us", "our") provides a tee-time booking platform for golf clubs ("clubs") and the golfers who book with them. This policy explains what personal data we collect, why, and what rights you have over it. It applies to golfers, club owners, and club staff using onthetee.app.

OnTheTee is a partner brand owned and operated by HFB Global, Friesestraatweg 16, 9718 NG Groningen, Netherlands (KVK 82762201), which is the data controller for the personal data described here.

What we collect

If you book a tee time: your name, email address, phone number (if you provide it), and details of the booking itself (club, tee time, number of players, any add-ons). If you name other players in your group, we also hold their name and email so we can send them a confirmation.

If you join a club as a member: the details your club adds to your membership record: name, email, phone, membership type, handicap, handicap number (the number your golf federation knows you by), and membership dates. If you sign up through OnTheTee, we also hold the answers you give on the club's signup form and pass them on to the club. You pay your membership fee to the club directly, not through us. If you choose a direct debit the club arranges, we hold the bank details you enter (and, in South Africa, your ID or passport number if you choose to give it) so the club can set up the debit. If the club collects by Direct Debit through GoCardless, you enter your bank details on GoCardless's own page and they go to GoCardless, not to us: we pass GoCardless your name and email to start your Direct Debit, and keep only the status of your mandate and of each collection, so the club can see them.

If you enter a tournament: your name, email address, handicap and handicap number (if given), and those of anyone entered with you, as you or the club enter them. The club uses handicap numbers to record the scores with the players' golf federation or handicap system; only the club's staff and the golfer who made the entry see them. If you give your own handicap number when you enter, we save it to your profile so your next entry fills it in; you can change or remove it there. Where a tournament is for men or ladies only, sets a separate handicap limit for ladies, or has an age limit, each player entered online also gives their gender or date of birth, which we check against those rules; only the club's staff and the golfer who made the entry see them. Your own are filled in from your profile when you've given them there. Where the club asks its own questions on the entry (a cell number or home club, say), each player's answers are kept with the entry, and only the club's staff and the golfer who made the entry see them. Players with an email get the tournament's emails (entry, start time, withdrawal or cancellation); a player entered without one gets none. Once the club publishes the start sheet and the results, players' names (never their email, handicap, handicap number, gender, date of birth or answers) appear on the tournament's public page, as clubs have always posted them.

If you run or work at a club: your name, email, and role, plus your club's details (name, location, currency, bank payout information via our payment processors).

Payment details: we never see or store your card number. Payments are handled directly by Stripe or Paystack (see Who we share data with below), and we only receive confirmation that a payment succeeded and the amount.

Technical data: a session cookie that keeps you signed in, and standard server logs (IP address, browser, timestamps) kept for security and debugging.

How we use it

To create bookings and process payments, send confirmation and reminder emails, let clubs manage their tee sheet and members, prevent fraud and abuse, and meet our own legal and accounting obligations. We don't sell personal data, and we don't use it for advertising.

Legal basis for processing

Mostly performance of a contract: we need your details to take a booking or run your club's account. Where that doesn't apply, we rely on our legitimate interest in keeping the service secure and working properly, or on your consent (for example, optional cookies, if we introduce any in future).

Who we share data with

We share data with the processors that make the service work, and nobody else:

• Stripe: card payments and club payouts for bookings in most supported countries, and our own subscription billing everywhere.
• Paystack: card payments for South African bookings. Paystack is a Stripe company, headquartered in Lagos, Nigeria, with an office in Cape Town.
• GoCardless: Direct Debit for membership fees, for clubs that connect their own GoCardless account. GoCardless collects on the club's behalf, under its agreement with the club and its own privacy notice.
• Supabase: our database and account login, hosted in the EU (Ireland).
• Resend: sends booking confirmation, reminder, and membership emails on our behalf.
• Vercel: hosts the application.

A club can see the bookings, members, and contact details relevant to their own club, never another club's data.

International transfers

Our database is hosted in the EU (Ireland), including for clubs and golfers outside Europe, so if you book with a club in South Africa, the United States or Singapore, your booking data is stored in the EU. Some of the processors above are based outside the EU/UK (or transfer data there as part of running their service); South African payments in particular are processed by Paystack, which is headquartered in Nigeria with an office in South Africa and may transfer data internationally as part of running its own service. Where data crosses a border, we rely on the safeguards those providers offer, such as EU Standard Contractual Clauses, to keep it protected.

How long we keep it

We keep booking and payment records for as long as we're legally required to for accounting and tax purposes. When you delete your account, these are kept but anonymized, so a club's financial records stay intact without identifying you. Account and membership data is kept while your account or membership is active, and for a reasonable period after in case you return. You can delete your account data sooner; see Your rights below.

Cookies

We use one essential cookie to keep you signed in. It's required for the service to work and isn't used for tracking or advertising. We don't currently use analytics or marketing cookies.

You'll still see a cookie banner on your first visit. It records your choice up front, so that if we ever do introduce non-essential cookies we already have your preference, and rejecting them is a real choice, not a formality. Your answer is stored in your own browser; you can clear it any time through your browser's site data settings.

Your rights

You have the right to access, correct, delete, or export your personal data, and to object to or restrict how we use it. We apply these rights to everyone who uses OnTheTee, in any of the countries we operate in, not only where local law requires it.

Golfers can delete their own account from My account at any time. This schedules deletion for 14 days later (giving you a window to cancel if you change your mind or requested it by mistake), and requires cancelling any upcoming booking and ending any active club membership first. For anything else, or if you run or work at a club, contact us using the details below. You can also complain to your local data protection authority, for example the Dutch Autoriteit Persoonsgegevens or another EU supervisory authority, the UK Information Commissioner's Office, or the South African Information Regulator.

Children

OnTheTee isn't directed at children, though junior members may be added to a club's member list by a parent, guardian, or the club itself.

Changes to this policy

We'll update this page if how we handle data changes, and update the date at the top.

Contact us

Questions about this policy or your data: hello@onthetee.app