theKlub Privacy Policy

1. Who we are

theKlub is operated by The Klub Technologies Ltd., a company registered in England and Wales (company number 15597572), whose registered address is 11 Cabanel Pl., London, SE11 6BD, United Kingdom. The Klub Technologies Ltd. is the data controller for the personal data described in this policy, and processes it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where the EU GDPR applies to you, we process your data in line with it as well.

2. Information we collect

We collect the following information:

• Account information: your name, email address, and password (stored only as a secure hash) or the details your sign-in provider shares with us (see section 3).
• Profile and preferences: the sports and interests you choose, your sporting level, saved experiences and hotels, your display currency, and whether you want to receive marketing emails.
• Booking information: the experiences and stays you book, travel dates, the names of the guests on a booking, your phone number, and any information you give us that the host or hotel needs to deliver your booking (for example dietary or accessibility requirements).
• Payment information: payments are processed by Stripe. We receive the payment amount, its status and a payment reference; we never see or store your card number.
• Loyalty and referrals: your points balance, credit, discount codes you use, and the people you refer or who referred you.
• Communications: messages you send to us or to hosts through theKlub, enquiries and concierge requests, and the contact method you prefer (email, phone or WhatsApp).
• Usage and device data: your IP address, browser and device type, pages visited and actions taken on the site, collected through cookies and similar technologies (see section 10).

3. Signing in with Google

You can create an account or sign in with your Google account. When you do, and only with your permission on Google's consent screen, Google shares the following with us (the openid, email and profile scopes):

• your name;
• your email address and whether Google has verified it;
• your profile picture; and
• a unique Google account identifier, which links your Google account to your theKlub account.

How we use it: only to create your theKlub account, sign you in securely, show your name and picture on your profile, and send you the service emails about your account and bookings. We do not request access to your Gmail, contacts, calendar, Drive or any other Google data.

How we share it: this data is stored by our authentication and database provider, Supabase, which processes it on our behalf. We do not sell Google user data, do not use it for advertising, and do not transfer it to anyone else except where the law requires it.

How we keep and delete it: we keep it for as long as your account is open. You can disconnect theKlub from your Google account at any time at myaccount.google.com/connections, and you can ask us to delete your account and this data by emailing support@theklub.world.

theKlub's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use your information

We use your information for these purposes, on these legal bases:

• To provide your account and bookings (performance of our contract with you): creating and securing your account, taking payment, confirming bookings with hosts and hotels, issuing invoices, and supporting you before, during and after your trip.
• To run the loyalty and referral programmes (contract): awarding and redeeming points and credit, and preventing abuse.
• To send service messages (contract): booking confirmations, receipts, reminders and changes to your trip.
• To send marketing (consent): newsletters and offers, only if you opted in. You can unsubscribe at any time from the link in any email or in your profile.
• To improve and protect theKlub (our legitimate interests): understanding how the site is used, fixing errors, preventing fraud and keeping the service secure.
• To measure advertising (consent): only if you accept marketing cookies (see section 10).
• To meet legal obligations: keeping accounting and tax records and responding to lawful requests.

We do not sell your personal data, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Who we share it with

We share personal data only where it is needed for the purposes above:

• Hosts and hotels: the name, contact details and requirements needed to deliver the experience or stay you booked. Hotel reservations are placed through our booking partner LiteAPI.
• Service providers acting on our behalf, under contracts that require them to protect your data and use it only on our instructions: Supabase (database and authentication), Vercel (website hosting), Stripe (payments), Resend (service emails), Klaviyo (marketing emails, only if you opted in), Mixpanel (product analytics), Sentry (error monitoring) and Google Maps (maps and location search).
• Advertising partners: Google Ads and Meta receive browsing and conversion events from our site only if you accept marketing cookies.
• Legal and safety: authorities, courts or professional advisers where the law requires it, or to protect the rights and safety of our members and our company.
• Business transfers: a buyer or successor if theKlub is sold or reorganised, under the same protections described here.

6. International transfers

Some of our providers store or process data outside the UK and the European Economic Area, for example in the United States. Where they do, we rely on the UK's adequacy regulations or on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, so your data keeps an equivalent level of protection.

7. How long we keep it

• Account and profile data, including data received from Google: for as long as your account is open. When you ask us to delete your account, we delete or anonymise it within 30 days.
• Booking, payment and invoice records: six years after the end of the financial year they relate to, as UK tax law requires.
• Marketing preferences: until you unsubscribe; we then keep only your email address on a suppression list so we do not contact you again.
• Analytics and error logs: no longer than 24 months.

8. Security

All traffic to theKlub is encrypted in transit (HTTPS). Data is encrypted at rest by our hosting providers, passwords are stored only as salted hashes, card details are handled by Stripe and never touch our servers, and access to personal data inside our company is limited to the people who need it to do their job. No system is perfectly secure, but we will notify you and the regulator of a breach where the law requires it.

9. Your rights

You have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• have your data deleted;
• restrict or object to how we process it;
• receive your data in a portable format;
• withdraw your consent at any time, for marketing emails or cookies, without affecting processing that already happened.

To exercise any of these rights, email support@theklub.world. We will reply within one month. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office at ico.org.uk or to your local data protection authority.

10. Cookies and similar technologies

We use strictly necessary cookies to keep you signed in and to make the site work; these do not need consent. We use Mixpanel, hosted in the EU, to understand how the site is used and improve it, on the basis of our legitimate interests. Advertising technologies (Google Ads and the Meta Pixel) stay off until you accept marketing cookies in our cookie banner. You can change your choice at any time by clearing this site's cookies in your browser, which shows the banner again.

11. Children

theKlub is not directed at children under 16, and we do not knowingly create accounts for them. A child may be named as a guest on a booking made by a parent or guardian, who provides that information on their behalf. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy when our services or the law change. The date at the top shows when it last changed, and we will email account holders about significant changes before they take effect.

13. Contact us

For any question about this policy or your personal data, contact The Klub Technologies Ltd. at support@theklub.world, or write to us at 11 Cabanel Pl., London, SE11 6BD, United Kingdom.