Privacy policy

Last updated: 27th August, 2026

This policy explains how The Table Tennis Project CIC (Company No. SC854222) collects and uses your personal data. We are the data controller for the information described here. This policy applies whether you book online or in person at our facility.

1. What We Collect

Depending on how you interact with us, we may collect:

  • Contact details — name, email address, phone number, postal address
  • Booking information — sessions booked, attendance history, membership status
  • Payment information — processed by our payment provider, including through our in-person card terminal. We do not store full card details
  • Health and accessibility information — where you choose to tell us about a medical condition, disability, or support need relevant to your participation
  • Emergency contact details — for participants under 18 and where otherwise provided
  • Photographs and video — where consent has been given
  • Website and system data — technical information such as IP address and browser type, collected by our booking system and website

Where you book in person, staff will enter your details into the same booking system used for online bookings, so your record is held in one place. You may make a one-off in-person booking without providing contact details, though we will then be unable to contact you about that booking.

2. Why We Use It

We use your data to:

  • Manage your bookings, memberships, and payments
  • Contact you about your bookings, including confirmations, reminders, and changes
  • Keep participants safe, including responding to accidents or medical incidents
  • Meet our safeguarding obligations
  • Improve our sessions and facilities
  • Report anonymised, aggregated participation data to funders and partners
  • Send you marketing about SpinLab, where you have opted in

3. Our Legal Basis

  • Contract — to deliver the bookings and memberships you have paid for
  • Legitimate interests — to run and improve the facility, keep records, and communicate about your bookings
  • Consent — for marketing communications and for photography or filming
  • Legal obligation — for financial records, health and safety, and safeguarding
  • Vital interests — in a medical emergency

Where we process health or disability information, we do so on the basis of your explicit consent, or where necessary to protect someone's vital interests.

4. Who We Share It With

We share data only where necessary, with:

  • Our booking system provider, SimplyBook.me, which hosts our booking, membership, and point-of-sale records. SimplyBook.me acts as our supplier and processes personal data on our behalf in line with their Privacy Policy and the Data Processing Agreement in place between us
  • Our payment provider, to process online and in-person transactions
  • Our coaches, who receive the information needed to run their sessions safely
  • Statutory agencies, where we are legally required to share information — for example, a safeguarding referral or an HSE-reportable incident
  • Funders, in anonymised and aggregated form only, unless we have your specific consent

We do not sell your data or share it with third parties for their own marketing.

5. How Long We Keep It

  • Booking, membership, and sales records: 6 years after your last interaction, for accounting and legal purposes
  • Accident and incident records: as required by law, and for a minimum of 3 years
  • Safeguarding records relating to children: in line with statutory guidance, which may require retention for an extended period
  • Marketing consents: until you withdraw consent
  • Photographs and video: until consent is withdrawn or the material is no longer in use

6. Your Rights

Under UK data protection law you have the right to:

  • Access the personal data we hold about you
  • Have inaccurate data corrected
  • Request deletion of your data, where we have no ongoing legal basis to keep it
  • Object to or restrict certain processing
  • Request a copy of your data in a portable format
  • Withdraw consent at any time, where consent is our basis for processing

To exercise any of these rights, contact us using the details below, or speak to a member of staff at reception. We will respond within one month.

If you are unhappy with how we have handled your data, you may complain to the Information Commissioner's Office (ICO) at ico.org.uk, or by calling 0303 123 1113.

7. Security

We take reasonable technical and organisational measures to protect your data, including restricted staff access to our booking system, secure handling of any paper records taken at reception, and use of a compliant card payment terminal.

Our booking system is provided by SimplyBook.me, who process data on our instructions only and under a Data Processing Agreement between us. Details of their own data handling practices are set out in their Privacy Policy.

No system is completely secure, but we will notify you and the ICO where required if a breach occurs that is likely to affect your rights.

8. Children's Data

Where a participant is under 16, we collect parental or guardian consent for the processing of their data and for any photography or filming. Where a child's session is booked in person, consent will be taken from the accompanying parent or guardian at the time of booking. Parents and guardians may exercise data rights on their child's behalf.

9. Changes to This Policy

We may update this policy. The current version will always be available on our website, our booking system, and on request at reception.

10. Contact

The Table Tennis Project CIC, 14 South College Street, Aberdeen, AB11 6JX.