DRAFT. Replace every item in <angle brackets> with the club's real details, confirm the retention periods and legal basis, and have the notice reviewed before the app is used by real members. Then delete this box.

Privacy Notice

Last updated: <date>

This notice explains how personal data is used when you create an account and book club facilities (such as the Gym, Skills Area, pitches, or other club amenities) using this app.

1. Who is responsible for your data

<Straffan GAA Club legal name> ("the club", "we") is the data controller.
Address: <club address>
Privacy contact: <privacy contact email> / <phone number, optional>
Data Protection Officer (if appointed): <name and contact, or "not applicable">

2. What we collect and why

Data	Why we use it
Name and email address	To create and identify your account, send verification, password reset and booking emails, and let administrators approve members.
Password (stored only as a one-way hash) and two-factor authentication details (stored encrypted)	To keep your account secure.
Booking history (facility, date, time, booking code and, for group bookings, the group name). Other signed-in members who view schedules or select sessions for club facilities may see your name on booked sessions, so they know who is using or sharing the facility.	To run the booking system, enforce limits, manage capacity and produce usage reports.
ACT ID mobile credential number	To give your phone access to the correct door for your booked session.
Door PIN for each booking	The door system requires one for each booking. We email it to you.
Door entry events (only if the door system's webhook is switched on)	To record when doors are used, for security and safety, and so administrators can see bookings where no entry was recorded. Kept for about 13 months. <delete this row if the webhook is not used>
Acceptance of this privacy notice and the facility rules (date, time, email address, IP address, and the version number and SHA-256 text fingerprint of the facility rules agreed to)	To ensure you have read and agreed to the current facility rules before using the app, and to keep a verifiable record of what was agreed and when.
Audit log: sign-ins, failed attempts, account changes, bookings, cancellations, with IP address and time	To protect the security of the facility and the app, investigate incidents and hold administrators accountable.

We do not collect payment details, location data, or any information through advertising or analytics tools.

3. Legal basis

4. Who we share it with

Other registered club members: When facility schedules or session cards are viewed, other signed-in members may see your name on booked sessions so members know who is using or sharing the facility.
Hosting and database provider: <provider name and region, for example "Microsoft Azure, Ireland">.
Email provider: <provider name>, which delivers the emails we send you.
Door access system (ACT365 / Vanderbilt): receives your credential number, the door and the time window of your booking. It does not receive your name or email from this app.
Installer / support contractor: <name, or delete if not applicable>.
Club administrators can see members' names, emails, booking and usage information as needed to run the system.

We do not sell your data. <State whether any data is transferred outside the EEA, and the safeguards used, or "No data is transferred outside the EEA".>

5. How long we keep it

Data	Kept for
Account details	While you are a member, then <period, for example 12 months> after your account is closed or last used.
Booking history	<period, for example 24 months>
Audit log (security and activity record)	13 months, then deleted automatically.
Record that you accepted this privacy notice and each version of the facility rules (date, time, email address, IP address, and the version and SHA-256 fingerprint of the rules text)	Kept permanently as proof of acceptance. <confirm with your adviser>
Door entry events and the raw messages received from the door system	13 months, then deleted automatically.

6. Your rights

You have the right to ask us for a copy of your data, to correct it, to have it deleted, to restrict or object to its use, and to receive it in a portable format, in each case where the law allows. To make a request, email <privacy contact email>. We will reply within one month.

You can delete your own account at any time from the My account page (Delete my account), or ask an administrator to do it. When we delete your account we erase your name, email address, password, two-factor details, door credential and door PINs and cancel any upcoming sessions. Past sessions are kept without your identity, for usage statistics. The security audit log is a tamper-proof record that we keep for 13 months for security reasons (and permanently for privacy notice and facility rules acceptances), so entries in it that already contain your email address are not edited until they expire.

If you are unhappy with how we handle your data you can complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, www.dataprotection.ie.

7. Cookies

This app uses only strictly necessary cookies to keep you signed in securely. If you choose to trust a device when you sign in, a further cookie is stored on that device for the number of days the club has set, so that you are not asked for the two-factor code each time. They are not used for tracking or advertising, and you are signed out after a period of inactivity.

8. Security

Passwords are hashed, two-factor authentication is required, sensitive settings are encrypted, and access by administrators is logged. No system is perfectly secure. Booking PINs are sent by email, so please keep them private. Tell us straight away if you think your account has been misused.

9. Changes

We may update this notice. The date at the top shows when it last changed. <Describe how members will be told about important changes.>