Golf Envy Privacy Notice

Last updated: 15 May 2026

1. Who We Are

1.1 Golf Envy Franchising Limited ("Golf Envy", "we", "us" or "our") is the data controller responsible for the personal data collected through the website at www.golfenvy.co.uk (the "Site"). We are registered in England and Wales with company number 17113882 and our registered office is at The Dt Group, Swatton Barn, Swindon, Wiltshire, England, SN4 0EU.

1.2 Golf Envy Franchising Limited operates in the indoor golf simulation and franchise sector in the United Kingdom.

1.3 We have considered whether we are required to appoint a Data Protection Officer (DPO) under Article 37 of the UK GDPR. Based on the nature and scale of our current data processing activities, we are not required to do so at this time. This position will be reviewed as our business grows.

1.4 For any data protection queries, please contact: [email protected] or write to us at the registered office address above.

2. What This Notice Covers

2.1 This Privacy Notice explains how we collect, use, store, share and protect your personal data when you visit the Site or submit an enquiry through our franchise enquiry form.

2.2 This Notice is provided in accordance with Article 13 of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (DUAA), which introduced further amendments to UK data protection law with effect from 5 February 2026 and 19 June 2026 respectively.

2.3 This Notice should be read alongside our Cookie Policy, which explains in detail how we use cookies and similar technologies on the Site.

3. Personal Data We Collect

3.1 We may collect and process the following categories of personal data:

3.2 We do not collect any special category data, such as data about your health, race, religious beliefs or political opinions, through the Site.

3.3 We do not carry out any automated decision-making or profiling using the personal data collected through the Site. No decisions are made about you solely by automated means that produce legal or similarly significant effects.

3.4 SMS Data Sharing: No mobile information, including SMS opt-in data and phone numbers collected for SMS purposes, will be shared with any third parties or affiliates for marketing or promotional purposes. Sharing with sub-contractors who provide support services (such as SMS delivery platforms) is permitted solely for the purpose of delivering the messages you have consented to receive.

4. How We Use Your Data

4.1 We use your personal data for the following purposes:

• To respond to your franchise enquiry and evaluate your interest in the Golf Envy franchise opportunity.
• To communicate with you about the franchise opportunity and provide you with information you have requested.
• To manage our relationship with prospective franchisees.
• To send you marketing communications about Golf Envy franchise opportunities, but only where you have given your prior, freely given, specific and informed consent to receive these. We will ask for your consent separately and clearly at the point of collection. You may withdraw that consent at any time; see Section 9 for details.
• To administer and protect the Site, including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting.
• To analyse how the Site is used so that we can improve its content, layout and functionality. Under the Data (Use and Access) Act 2025, analytics cookies used solely for this purpose and only by us may no longer require your prior consent, provided we give you clear information and a free right to opt out. Where analytics are also used for advertising or profiling, consent will be obtained before those cookies are set.
• To comply with legal and regulatory obligations.

5. Who We Share Your Data With

5.1 We may share your personal data with the following categories of recipients:

• Third-party service providers: We use third-party processors to support our business operations, including website hosting providers, CRM and email marketing platforms, analytics providers (including Google Analytics), IT support and professional advisors such as accountants, lawyers and auditors. All processors are bound by written data processing agreements and are required to process your data only on our instructions.
• Legal and regulatory bodies: We may disclose your data where required by law, regulation, legal process or enforceable governmental request.

5.2 We do not sell or share your personal data with any third party for their own independent purposes.

6. International Transfers

6.1 We primarily process your personal data within the United Kingdom. However, some third-party service providers, including Google Analytics, may process data outside the UK, including in the United States and other countries.

6.2 Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place in accordance with Chapter V of the UK GDPR. These safeguards may include:

• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
• Transfers to countries that the UK Government has determined provide an adequate level of data protection.
• Other lawful transfer mechanisms recognised under the UK GDPR.

6.3 You may request further details of the specific safeguards we have in place, including copies of relevant transfer agreements, by contacting us using the details in Section 13.

7. How Long We Keep Your Data

7.1 We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our standard retention periods are:

• Franchise enquiry data: 24 months from the date of your last interaction with us, unless a franchise relationship is established, in which case our contractual retention periods will apply.
• Website analytics data: Retained in anonymised or aggregated form wherever possible. Where data remains identifiable, it is retained for no more than 26 months.
• Correspondence data: Retained for 24 months from the date of last correspondence, unless related to a contractual or legal matter requiring longer retention.

7.2 When your data is no longer required, it will be securely deleted or irreversibly anonymised.

8. Your Data Protection Rights

8.1 Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

• Right of access (Subject Access Request): You may request a copy of the personal data we hold about you.
• Right to rectification: You may ask us to correct inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten"): You may ask us to delete your personal data in certain circumstances, for example where the data is no longer necessary for the purpose it was collected.
• Right to restriction of processing: You may ask us to restrict the processing of your personal data in certain circumstances, for example while a dispute about accuracy is resolved.
• Right to data portability: Where processing is based on consent or contract and is carried out by automated means, you may request that we transfer your personal data to you or to a third party in a structured, commonly used, machine-readable format.
• Right to object: You may object at any time to processing based on legitimate interest or to processing for direct marketing purposes. Where you object to direct marketing, we will stop processing for that purpose immediately.
• Right not to be subject to automated decision-making: You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. We do not currently carry out such processing.
• Right to withdraw consent: Where we rely on your consent as the lawful basis for processing, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

8.2 To exercise any of these rights, please contact us using the details in Section 13. We will respond to your request within one calendar month of receipt. In complex cases or where a large number of requests are received, we may extend this period by a further two months, and will notify you accordingly. Under the Data (Use and Access) Act 2025, where your request is broad and we hold a large amount of information about you, we may ask you for clarification before proceeding. The one-month response period is paused while we await your clarification.

8.3 We will not charge a fee for handling your request unless it is manifestly unfounded or excessive. In such cases, we may charge a reasonable administrative fee or decline to act on the request.

8.4 You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been infringed. We would, however, appreciate the opportunity to address your concerns before you approach the ICO and ask that you contact us in the first instance. The ICO can be contacted at ico.org.uk or by telephone on 0303 123 1113.

9. Marketing

9.1 We will only send you electronic marketing communications about the Golf Envy franchise opportunity if you have given your prior, freely given, specific and informed consent. This is in accordance with the Privacy and Electronic Communications Regulations 2003 (PECR).

9.2 Where you have consented to receive marketing, you may withdraw that consent and opt out at any time by:

• Clicking the unsubscribe link included in any marketing email; or
• Contacting us directly using the details in Section 13.

9.3 We will process your opt-out request promptly and without charge. Withdrawal of consent does not affect the lawfulness of any marketing communications sent before withdrawal.

9.4 Submitting a franchise enquiry does not automatically subscribe you to marketing communications.

9.5 Even if you opt out of marketing, we may still contact you with communications directly related to your franchise enquiry or any ongoing business relationship, where we have a legitimate interest or legal basis to do so.

10. Cookies

10.1 The Site uses cookies and similar tracking technologies. Strictly necessary cookies, which are essential for the Site to function, do not require your consent.

10.2 Under the Data (Use and Access) Act 2025 (DUAA), which came into force on 5 February 2026, certain analytics cookies used solely to collect aggregate statistics to improve the Site — and used only by us, not for advertising or profiling — are now exempt from the prior consent requirement under PECR. Where we rely on this exemption, we provide clear information about the cookies being used and you have a free right to opt out at any time, without detriment.

10.3 Where any cookies are used for purposes beyond the DUAA exemptions — including third-party analytics, advertising, or profiling — we will obtain your prior, specific consent before those cookies are placed on your device. Consent is always requested before such cookies are set, never after.

10.4 You may manage your cookie preferences at any time through the "Cookie Settings" link in the footer of the Site. You may also opt out of analytics cookies at any time, free of charge, using the same link.

10.5 For full details of the cookies we use, the purposes for which we use them, the third parties involved, and how to manage your preferences, please refer to our Cookie Policy.

11. Security

11.1 We have implemented appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures are reviewed and updated on a regular basis.

11.2 Where we have provided you with account credentials, or where you have chosen credentials, you are responsible for keeping them confidential.

11.3 No transmission of data over the internet is completely secure. While we take all reasonable steps to protect your personal data, we cannot guarantee the security of data transmitted to the Site.

12. Data Protection Complaints

12.1 Under the Data (Use and Access) Act 2025, you have a statutory right to raise a data protection complaint directly with us before escalating to the ICO. We are required to have a formal complaints procedure in place from 19 June 2026.

12.2 If you believe we have not handled your personal data in accordance with data protection law, or if you have any concern about how we are using your information, please raise your complaint with us in the first instance using any of the following channels:

• Email: [email protected]
• Post: Golf Envy Franchising Limited, The Dt Group, Swatton Barn, Swindon, Wiltshire, England, SN4 0EU

12.3 We will acknowledge your complaint within 30 days of receipt and aim to resolve it without undue delay. We will keep you informed of progress and provide a written outcome.

12.4 If you are not satisfied with our response, or if we have not resolved your complaint within a reasonable timeframe, you have the right to escalate your complaint to the Information Commissioner's Office (ICO) at ico.org.uk or by telephone on 0303 123 1113.

13. Contact Us

13.1 If you have any questions about this Privacy Notice, wish to exercise your data protection rights, or have concerns about how your data is being processed, please contact us:

Golf Envy Franchising Limited
The Dt Group, Swatton Barn,
Swindon, Wiltshire, England, SN4 0EU
Email: [email protected]

14. Changes to This Notice

13.1 We may update this Privacy Notice from time to time to reflect changes in our practices, legal obligations or regulatory requirements. Any changes will be posted on this page with an updated revision date.

13.2 Where changes are material, we will take reasonable steps to bring them to your attention, which may include a prominent notice on the Site or direct communication where we hold your contact details.

13.3 We encourage you to review this page periodically to stay informed about how we protect your personal data.

This Privacy Notice was last updated on 15 May 2026.