Privacy notice
Clear choices. Careful records.
How Old Penarthians RFC Limited uses personal information through the Business Club website.
Last updated: 23 September 2026
Who is responsible for your information?
Old Penarthians RFC Limited is the data controller. We are a company limited by guarantee, registered in England and Wales under company number 11879102. Our registered office is The Clubhouse, St Marks Road, Penarth, Vale of Glamorgan, CF64 3PF.
For privacy questions or to exercise your rights, email business@oldpens.wales or write to us at the registered office above.
Information we collect
- contact and business details submitted through enquiries, sponsor registration and member accounts;
- directory information, logos and support details approved for publication;
- event booking details, attendee names and email addresses, ticket and check-in records;
- optional food choices and dietary or allergy information supplied for an event;
- payment status, transaction references and refund records—card details are handled by Stripe and are not stored by us;
- marketing and directory-publication choices;
- account, security, device and service logs needed to operate and protect the website; and
- questions sent to the Business Club AI assistant when that service is enabled. We do not intentionally store the raw question in assistant feedback records.
We usually collect information directly from you. Business-directory information may also come from the business concerned, club records or public business sources. If you provide another attendee's details, you must have their permission and should direct them to this notice.
Why we use it and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and administering the Business Club, sponsorship and member services | Legitimate interests in running the club and responding to people who contact us; contract where we provide an agreed membership or service |
| Publishing an approved business profile | Consent for personal information included in the profile; legitimate interests for business-only information |
| Taking and managing event bookings, tickets, payments and refunds | Contract and steps requested before entering a contract; legal obligation for financial records |
| Managing dietary or allergy information for catering | Explicit consent. Supplying this information is optional and consent may be withdrawn, although this may limit our ability to meet the request |
| Sending optional Business Club news | Consent. Transactional messages about a booking or account are not marketing |
| Preventing abuse, protecting accounts and keeping an audit trail | Legitimate interests in operating a secure, accountable service and, where relevant, legal obligations |
| Answering questions through the optional AI assistant | Legitimate interests in providing a helpful public-information service when requested |
Your right to object: you may object to processing based on legitimate interests. We will stop unless we have compelling legitimate grounds to continue or need the information for legal claims.
Who we share information with
Authorised club officers, administrators and event staff receive only the information needed for their role. We may use service providers including Vercel for hosting, Supabase for authentication and data storage, Resend for transactional email, Stripe for payments, and Apple or Google when you request a wallet pass. If enabled, the AI provider receives the current question and approved public source extracts—not private member, booking or sponsor records.
We may also disclose information where the law requires it, to protect people or the club, or in connection with professional advice or legal claims. We do not sell personal information.
International transfers
Some providers may process information outside the UK. Where this happens, we require an appropriate UK transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with appropriate security measures. Contact us if you would like information about the safeguard used for a particular provider.
How long we keep information
- enquiries and unsuccessful registration enquiries are normally reviewed for deletion after 24 months without meaningful contact;
- marketing consent records are kept while consent remains active and afterwards as needed to demonstrate or respect the withdrawal;
- membership and sponsorship administration records are kept while active and normally for up to six years afterwards where needed for agreements, accounting or legal claims;
- event booking, payment and refund records may be kept for up to six years after the relevant financial year;
- dietary information is kept only until the event's stated catering-retention date and is then cleared from the attendee record;
- ticket and check-in records are kept only as long as needed for event operation, safety, disputes and the club's audit requirements; and
- AI feedback records contain no raw question and expire after no more than 90 days.
We may keep a record longer where required by law, for a live dispute, safeguarding matter, fraud prevention or security investigation. We review retention when a service or relationship ends.
Your rights
Depending on the circumstances, you may ask for access to your information, correction, deletion, restriction, portability or withdrawal of consent. You may object to direct marketing at any time. Rights can differ according to the lawful basis and are not always absolute.
Email business@oldpens.wales. We may need to verify your identity and normally respond within one month. You may also complain to the Information Commissioner's Office, although we would appreciate the opportunity to address your concern first.
Cookies, security and changes
See our cookie policy for the essential cookies and device storage used by this site. We use access controls, restricted administrator roles, encrypted connections and service audit records to protect information, but no online service can guarantee absolute security.
We will update this notice when our processing changes and will bring material changes to people's attention where required.