Privacy & Cookie Policy

Runnymede Rockets BMX Club ("we", "us", "our") is a British Cycling affiliated voluntary sports club based at Brackendene Open Space, Addlestone Moor, Addlestone, Surrey, KT15 2QL.

For data protection enquiries, contact us at runnymederockets@gmail.com.

We may collect the following information when you use our website or book a session:

• Account information — name, email address and password when you register
• Booking information — event bookings, session history and payment records
• Contact form submissions — name, email address and message content
• Usage data — pages visited, browser type and approximate location (via CloudFront access logs)

We do not collect sensitive personal data beyond what is necessary for running club sessions and processing bookings.

• To process session bookings and payments via Stripe
• To manage your club account and booking history
• To send booking confirmations and session-related communications
• To respond to enquiries submitted via the contact form
• To improve the website and services we offer

We will never sell your personal data to third parties or use it for unsolicited marketing without your consent.

We process your personal data under the following lawful bases:

• Contract — to fulfil a booking or membership you have made with us
• Legitimate interests — to operate the club safely and communicate with members
• Consent — where you have explicitly opted in to receive communications

This website is a statically generated site hosted on AWS CloudFront. We use the following cookies and storage technologies:

• Session storage — used to manage your login session and shopping cart. These are cleared when you close your browser tab.
• CloudFront cookies — AWS CloudFront may set cookies for performance and security purposes. These are functional and cannot be disabled without affecting site performance.

We do not currently use advertising cookies, third-party tracking cookies or analytics platforms (such as Google Analytics). If this changes, this policy will be updated and a consent banner displayed.

We use the following third-party services that may process your data:

• Stripe — payment processing for session bookings and shop orders. Stripe's privacy policy applies to payment data. See stripe.com/gb/privacy.
• AWS (Amazon Web Services) — website hosting, database storage and email delivery. Data is stored in the EU (eu-west-2 London region).
• Amazon Cognito — secure user account management for the club admin and member portal.

We retain your personal data for as long as your account is active or as required to fulfil our legal obligations:

• Booking records — retained for 7 years for financial and legal compliance
• Account data — retained for the duration of your active account, then deleted upon request
• Contact form submissions — retained for up to 12 months

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your personal data where legally permissible
• Restriction — request that we limit how we use your data
• Portability — request your data in a machine-readable format
• Objection — object to processing based on legitimate interests

To exercise any of these rights, email us at runnymederockets@gmail.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

We may update this policy from time to time. Any significant changes will be notified via the website. The date at the top of this page indicates when the policy was last updated.