Splays Privacy Policy

Last updated: 26 July 2026

This Privacy Policy explains how Splays Digital Ltd ("Splays", "we", "us", "our") handles personal data in connection with the Splays platform — fully-managed interactive screens for golf and sports clubs, used to display notices, events, sponsors, weather, a golf course guide and similar content, and to collect optional visitor sign-ups at the clubhouse.

This policy is written for the people whose data we may handle: club administrators, and visitors who sign up at a club's kiosk. It also explains the difference between data we control ourselves and data we handle on behalf of a club.

1. Who we are

Splays is a product operated by:

Company: Splays Digital Ltd
Company registration number: 17357759 (registered in England & Wales)
Registered address: 4-6 Swaby's Yard, Walkergate, Beverley, East Yorkshire, HU17 9BZ
General contact: hello@splays.co.uk
Privacy / data protection contact: hello@splays.co.uk

We are based in, and operate under the laws of, England & Wales. We comply with the UK GDPR and the Data Protection Act 2018.

2. Controller and processor — an important distinction

Data protection law distinguishes between a data controller (who decides why and how personal data is used) and a data processor (who handles data on the controller's instructions). Splays plays both roles depending on the data:

Data	Who is the controller?	Splays' role
Visitor sign-up data collected at a club's kiosk (name, email address + marketing consent)	The club (e.g. Brough Golf Club)	We are the processor, acting on the club's instructions
Club administrator accounts (name + email used to log in and manage screens)	Splays	We are the controller
Screen / device telemetry (no personal data)	n/a	n/a

Where a club is the controller of visitor data, that club's own privacy notice governs how the data is used, and the relationship between us and the club is set out in a separate Data Processing Agreement (DPA). This Privacy Policy primarily describes the data for which Splays is the controller, and is transparent about the visitor data we process on a club's behalf.

3. What data we collect, and why

We only collect the data described below. We do not collect special category data, and we do not store payment card data in the app.

3.1 Visitor sign-ups at the kiosk (club is the controller)

What: a name and email address, and a marketing consent flag recording that the visitor opted in (for example, to join a club mailing list or to obtain WiFi access). The data is stored separately for each club.
Why: so the club can contact visitors who have asked to hear from it.
Our role: we store and process this data on behalf of the club as a processor. We do not use it for our own purposes.

3.2 Club administrator accounts (Splays is the controller)

What: name and email address, obtained when an administrator signs in. Sign-in is via Microsoft Entra ID single sign-on (in non-production environments, a development login may be used instead).
Why: to create and secure administrator accounts, to control who can manage a club's screens, and to operate and support the service.

3.3 Screen / device telemetry (no personal data)

What: technical information from screens and devices — app version, memory use, uptime, error messages and the current URL being displayed.
Why: to monitor the health of screens, diagnose faults and improve reliability.
Note: this telemetry does not contain personal data.

4. Lawful bases for processing

Under the UK GDPR we must have a lawful basis for processing personal data. Our bases are:

Data	Lawful basis
Visitor marketing sign-ups	Consent (Article 6(1)(a)) — the visitor opts in. The club, as controller, relies on this consent; we process on its instruction.
Club administrator accounts	Contract (Article 6(1)(b)) — to provide the service to the club — and legitimate interests (Article 6(1)(f)) in securing and administering accounts.
Telemetry (technical, no personal data)	Not applicable — no personal data is processed.

Where consent is the basis, the individual can withdraw it at any time (see section 8).

5. How long we keep data

Data	Retention
Visitor sign-up data	Kept on the club's instructions for as long as the club uses the service. It is exported or deleted on request, and on the club's exit from the service. A visitor may ask to be removed at any time. (See the DPA — the club is the controller.)
Club administrator accounts	Kept for as long as the person is an active administrator, and deleted within 90 days of the account being closed or the club leaving the service.
Telemetry	Kept for 90 days for operational monitoring, then deleted.

6. Who we share data with (sub-processors and suppliers)

We do not sell personal data. We share data only with trusted suppliers who help us run the service. Our current sub-processors and suppliers are:

Supplier	Purpose	Personal data involved?	Where processed
Microsoft Azure (App Service, Azure Database for PostgreSQL, Azure Storage, and Microsoft Entra ID for sign-in)	Hosting the application, database and media, and single sign-on for administrators	Yes — all club and member data	United Kingdom (UK South / UK West)
Microsoft Azure Communication Services	Sending service emails, such as secure sign-in links to administrators	Yes — recipient name and email address	European Union
Microsoft Azure Maps	Aerial course imagery for the golf course guide	No — only map coordinates are sent	Ireland (North Europe)
Google LLC (Google Fonts)	Serving the brand typeface on our website	Your IP address is visible to Google as part of the font request	United States
Open-Meteo	Weather data shown on screens, requested by coordinates	No — no personal data is sent	European Union
Payment processor (e.g. Stripe)	Billing — when card billing is introduced	(Future) billing details, handled by the processor	To be confirmed

When card billing is introduced, a payment processor (for example Stripe) will become a sub-processor; we will update this policy accordingly. The same list, with more detail, is maintained in Annex 2 of our Data Processing Agreement.

7. International transfers

All club and member data — the application, the database and uploaded media — is stored and processed in UK data centre regions on Microsoft Azure (UK South and UK West).

A small number of supporting services process limited data outside the UK:

Service emails (for example a secure sign-in link sent to an administrator) are sent via Microsoft Azure Communication Services, which processes them in the European Union.
Aerial course imagery for the golf course guide is requested from Microsoft Azure Maps in Ireland. Only map coordinates are sent — no personal data.
Google Fonts on our marketing website means your IP address is visible to Google LLC in the United States when your browser requests the typeface. See our Cookie Notice.

The European Economic Area benefits from UK adequacy regulations, so transfers there may be made without additional safeguards. For transfers to the United States, we rely on the supplier's appropriate safeguards (such as the UK Addendum to the EU Standard Contractual Clauses, and the UK Extension to the EU–US Data Privacy Framework where applicable).

If our arrangements change, we will ensure an appropriate safeguard is in place and update this policy.

8. Your rights under UK GDPR

You have the right to:

Be informed about how your data is used (this policy);
Access a copy of your personal data;
Rectify inaccurate or incomplete data;
Erase your data ("right to be forgotten");
Restrict or object to processing;
Data portability — receive your data in a usable format;
Withdraw consent at any time, where processing is based on consent (for example, marketing emails).

For visitor sign-up data, the club is the controller, so please contact the club directly — or contact us at hello@splays.co.uk and we will pass your request to the relevant club and assist them in responding.

For administrator account data, where we are the controller, contact us at hello@splays.co.uk.

We will respond within one month, as required by law.

9. Cookies and sessions

The Splays administrator area uses a session cookie that is strictly necessary to keep an administrator securely logged in while they manage their screens. This cookie does not track you across other websites and is not used for advertising. Because it is strictly necessary for the login to work, it does not require separate consent. The public kiosk display does not require visitors to log in. See our separate Cookie Notice for full details.

If we introduce any non-essential cookies in future (for example analytics), we will ask for consent first and update this policy.

10. How we keep data secure

We take security seriously. Measures currently in place include:

Microsoft (Entra) single sign-on for administrator access — admin endpoints reject anonymous callers;
Tenant isolation — each club's data is scoped by club_id and separated, with a dedicated isolation test suite;
Encryption in transit — all traffic is protected using HTTPS/TLS; HTTPS is enforced and the marketing site sends HSTS;
Security headers and CSRF protection — including nosniff, a strict referrer policy, a restrictive Permissions-Policy, clickjacking protection (frame-ancestors), and removal of X-Powered-By;
Session cookies set httpOnly and secure in production;
Input validation — all content writes are validated (bad input is rejected), with error-handling and process backstops so the platform survives bad requests;
Rate limiting on public endpoints (member sign-up, device pairing, heartbeat) to reduce abuse;
UK-hosted Azure managed PostgreSQL (UK South), with backups via the managed database, and point-in-time restore;
Secrets kept server-side — no secrets are exposed in the browser bundle.

11. How to complain

If you have a concern about how your data is handled, please contact us first at hello@splays.co.uk so we can try to put things right.

You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO):

Website: https://ico.org.uk
Helpline: 0303 123 1113

12. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows when it last changed. Significant changes will be communicated to clubs.

13. Contact us

General: hello@splays.co.uk
Privacy / data protection: hello@splays.co.uk
Post: 4-6 Swaby's Yard, Walkergate, Beverley, East Yorkshire, HU17 9BZ