1. Accountability
Dirty Birdies Golf Club (Ontario, Canada) is responsible for the personal information under our control. A designated privacy contact is accountable for how we handle it and for responding to questions, access requests, and complaints.
Privacy contact: privacy@dirtybirdies.ca. Responsible entity: Dirty Birdies Golf Club, Ontario, Canada.
2. What information we collect
We collect only what we need to run tournament registration, the member community, and payments:
- Account and membership application: your name (display name), email address, reasons for joining, business-owner status and conditional business details, how you heard about Dirty Birdies, prior-event attendance, approval status, and a securely hashed password after activation. These fit answers are private to membership approvers. We store a password hash, never your actual password.
- Registration: for each participant you register — full name, email address, phone number (optional), self-reported handicap index, and the add-on selections you make (for example mullies and 50/50 draw tickets), plus an optional team name.
- Payment: card and payment details are entered directly with our payment processor, Stripe. The application does not receive or store card numbers. We retain a payment reference, provider name, status, and the amount and currency, so we can confirm and reconcile your registration.
- Player/member profile: a private baseline profile is created for a finalized tournament player or membership applicant. Membership applicants provide a home course, favourite course, play frequency, display handicap, club type, and handedness, using the explicit answer-outs where applicable. Approved members control public publication of these fields.
- Business profile (optional): if you list a business — company name, logo, industry, website, and the business contact name, email, and phone you choose to publish.
- Consent records: when you give consent, we record the purpose, the version of the consent text, the time, and the IP address the request came from, as evidence that consent was given.
- Technical data: your IP address is used for rate-limiting and consent evidence, and we use a session cookie to keep you signed in and to protect forms against cross-site request forgery (CSRF).
3. Why we collect it (purposes)
We identify the purpose before or at the time we collect information. We use personal information to:
- administer tournament registration and participation;
- receive and review free membership applications and administer membership status;
- send tournament and account communications (for example, registration confirmations and scoring-account activation links);
- populate the public and members-only directories according to the membership-directory visibility choices described below;
- operate the public Member Businesses listing, if you publish a business profile;
- process payments through our payment processor; and
- keep the service secure and prevent abuse (rate-limiting, session and CSRF protection).
4. Consent
We collect, use, and disclose personal information with your consent. You give consent at specific points, and we record it:
- At registration: you must check the privacy-consent box before we collect and use registration information. Registration cannot proceed without it.
- When you apply for membership: you must consent to the information being used both to assess the membership application and to populate the member directory according to your visibility choices. We store the consent-text version and time. When an administrator creates a member or member business on someone’s behalf, the administrator must record the consent basis.
- When you publish a member profile: a member profile starts private. Making it public requires a separate consent to publish the selected profile information.
- When you publish a business: a business is listed publicly only after an authorised member acknowledges that the business profile and the business contact details entered will be publicly visible, and consents to that publication.
Withdrawing consent. You can withdraw consent for optional publication at any time by hiding or deleting your member profile, or by removing your business from the public listing, from your account. You can also contact the privacy contact above to withdraw consent or ask us to stop a use, subject to legal and tournament record-keeping requirements described under Retention.
5. Limiting collection
We limit collection to what is necessary for the purposes above, and we collect it through the registration, membership, and profile forms. Membership questionnaire fields require definite answers, with explicit “none,” “unknown,” or Not-Applicable paths where relevant. Directory fields beyond the member’s name are published publicly only under the member’s visibility choices.
6. Limiting use, disclosure, and retention
We use and disclose personal information only for the purposes for which it was collected, except with your consent or as required by law. We share personal information with two categories of third-party service provider:
- Stripe — our payment processor, which handles card and payment details directly; and
- an email relay (SMTP) — used to deliver transactional tournament and account email.
What is public and what is not:
- Business contact information that a member chooses to publish in the Member Businesses listing is intentionally public.
- The public member directory names approved members. Other directory fields appear only when the member has enabled public publication and the matching field switch.
- The separate member-only directory is visible only to approved members and site administrators. It always shows each member’s name, home course, and display handicap, plus other fields the member has opted in.
- Your personal account email address is never shown publicly. A member may optionally opt in to display a contact email on their profile, and even then it is shown in a masked form.
Retention. Membership application answers and profiles are retained until deletion is requested; there is no automatic purge. A signed-in member can record a request to delete the private application answers and may also ask for the directory profile to be deleted. The request records who asked and when, and completion records the operator and completion time. Registration, payment, financial, and consent-evidence records are retained as long as needed for tournament administration, financial reconciliation, security, and to evidence consent, subject to operational backups.
7. Accuracy
We keep personal information as accurate, complete, and up to date as is necessary for the purposes it is used for. You can review and correct your own account and profile information at any time from your account, and let us know if other information needs correction.
8. Safeguards
We protect personal information with safeguards appropriate to its sensitivity:
- passwords are stored using Argon2id hashing, never in plain text;
- forms and state-changing actions require an authenticated session and CSRF validation;
- sensitive requests are rate-limited to deter abuse;
- traffic is served over TLS in production, with strict transport security and other browser security headers;
- uploaded images (headshots and logos) are size- and type-checked, re-encoded, and stripped of embedded metadata (including EXIF), then stored under opaque file names;
- private uploaded images are served only through an authorisation-gated route.
9. Openness
This policy is our openness statement about how we handle personal information. It is linked from the footer of every page and from the registration and profile-publication forms. When our practices change materially, we update this policy and its version and “last updated” date shown above.
10. Individual access and correction
You have the right to access the personal information we hold about you and to request corrections. For information you manage yourself, you can, from your account:
- view and edit your account and member-profile details;
- hide your member profile so it no longer appears in the directory;
- delete your member profile, which also removes the associated headshot image;
- request deletion of private membership-application answers, with the option to include the directory profile; and
- correct a business profile you administer and withdraw it from the public listing.
To request access to, or correction of, other personal information we hold, contact the privacy contact above. We will respond within a reasonable time and may need to verify your identity first.
11. Challenging compliance
If you have a question or concern about how we handle personal information, contact our privacy contact above and we will work to resolve it.