01 Who Controls Your Personal Data

Chris Brook is the data controller for personal information used by Chris Brook Golf. This means Chris decides why and how that information is processed.

Email: chris@chrisbrook.co.uk

Privacy questions and personal-data requests should be sent directly to the email address above.

02 Scope of This Notice

This notice covers personal data controlled by Chris in connection with:

• the website at www.chrisbrook.co.uk;
• studio, live online and on-location international coaching;
• recorded swing or putting analysis, assessments, packages and longer programmes;
• enquiries, bookings, payments, complaints and service administration; and
• digital courses and learning materials supplied directly by Chris.

Another organisation may be a separate controller when you use its own service. Examples include an independent retailer from which you buy a book, Apple when you use FaceTime under your Apple account, or Google when you use a Google service under your account. Its own privacy notice explains that independent use.

03 Information Chris May Collect

04 Why Information Is Used and the Lawful Basis

Different activities require different lawful bases. Chris does not rely on consent where a contract or legal obligation is the more appropriate basis.

Legitimate interests are used only where the processing is necessary and Chris’s business or legal interest is not overridden by your rights and reasonable expectations.

05 Health and Other Special-Category Information

Information about physical or mental health can be special-category personal data under the UK GDPR. Chris may need limited health information where it materially affects safe participation or the interpretation of a physical-performance assessment.

• Chris asks only for information relevant to the agreed coaching purpose.
• The normal Article 6 basis is your consent, and the additional Article 9 condition is your explicit consent.
• You may withdraw consent for future processing at any time. This does not make earlier lawful processing unlawful.
• If relevant information is not provided, Chris may be unable to carry out or adapt a physical element safely. You will not be required to disclose unrelated medical details.
• Golf coaching and physical screening are not medical diagnosis, physiotherapy or treatment.

06 Where the Information Comes From

Most personal data comes directly from you when you email, book, pay, complete a form, join a session or submit coaching material. Information may also come from:

• the booking, payment or course platform used for your transaction;
• golf measurement systems and connected equipment used during your assessment;
• a person who makes a booking for you or introduces you, where they are entitled to do so;
• a coach, club, clinician or other professional where you know about and authorise the disclosure; or
• website, hosting, security and consent systems that generate technical logs or preference records.

If information is obtained from another source and you have not already received the relevant privacy information, Chris will provide it where the law requires.

07 Who May Receive Personal Data

Chris does not sell or rent personal data. Limited information is shared only where needed to operate the website, deliver the service, process a transaction or comply with the law.

Information may also be disclosed to professional advisers, insurers, courts, regulators, law-enforcement bodies, tax authorities or another recipient where disclosure is reasonably necessary or legally required. A venue, club or collaborating professional receives only the information necessary for an agreed coaching arrangement.

Amazon and other independent retailers control information about purchases made on their own websites. Chris does not routinely receive the buyer’s identity or payment details merely because a book is sold by that retailer.

08 Processing Outside the United Kingdom

Some technology providers are based outside the UK or use international infrastructure. This can make personal data accessible from, or store it in, another country.

Where a restricted transfer occurs, Chris will rely on a lawful transfer mechanism appropriate to the destination and provider. This may include UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework where applicable, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another mechanism permitted by UK data-protection law. Additional contractual, organisational or technical safeguards are used where required.

You may ask Chris for more information about the safeguard relevant to your data by emailing chris@chrisbrook.co.uk.

09 Cookies, Embedded Services and Analytics

Cookies and similar technologies can store or access information on your device. Strictly necessary technologies may be used without consent where they are essential to provide a service you request. Non-essential analytics technologies should not be activated until you make an affirmative choice.

You can accept or reject optional analytics through the website’s consent controls. You can also delete or block cookies through your browser, although blocking strictly necessary or booking-platform technologies may prevent parts of the website from working. Withdrawing consent does not affect processing that was lawful before withdrawal.

10 How Long Information Is Kept

Personal data is not kept indefinitely. Chris considers the purpose, the sensitivity of the information, legal and accounting duties, the time in which a claim could arise, and whether an ongoing coaching relationship requires continuity.

• Unsuccessful or one-off enquiries: normally up to two years after the last meaningful contact.
• Booking, payment and tax records: for the period required by tax and accounting law, normally about six years.
• Core client and coaching records: normally up to six years after the last service, where needed for continuity, complaints, insurance or legal claims.
• Raw swing, putting and assessment media: reviewed regularly and normally deleted within two years after the last relevant session unless an active programme, agreed review or legal reason requires longer retention.
• Health information: retained only while it remains relevant to safe or effective delivery, or while a legal or insurance reason requires the related record.
• Analytics and technical information: retained according to the configured analytics, hosting, security and consent-system periods; cookie maxima are described above.
• Legal disputes or safeguarding concerns: relevant records may be kept longer while the issue, claim or legal duty remains active.

When information is no longer needed, it is securely deleted or anonymised so that it is no longer personal data.

11 Security, Confidentiality and Remote Access

Chris uses proportionate technical and organisational measures designed to protect personal data against unauthorised access, alteration, loss or disclosure. Measures include limiting access, using secured accounts and devices, selecting established service providers, applying updates, and avoiding collection that is not needed.

• Live FaceTime sessions are not routinely recorded. Any recording requires a clear purpose and separate agreement.
• When Chrome Remote Desktop is used with your launch monitor and connected camera system, access should be authorised only for the agreed session and ended when it finishes.
• Do not send passwords by email, messaging service or questionnaire. Chrome Remote Desktop access should use its own session or access controls.
• Submitted videos, measurements and reports are treated as client material and are not used publicly for marketing, teaching or case studies without separate permission.

No internet or storage system can be guaranteed completely secure. If a personal-data breach creates a risk requiring notification, Chris will follow the applicable assessment, recording and notification duties.

12 Your Data-Protection Rights

Your rights depend partly on the lawful basis and the circumstances. They can include:

To exercise a right, email chris@chrisbrook.co.uk and describe what you need. Chris may ask for proportionate evidence of identity before releasing or changing information. There is normally no fee, and a response will normally be provided within one month, subject to any lawful extension or exemption.

13 Automated Decisions and Profiling

Chris does not make decisions about clients based solely on automated processing where the decision produces legal or similarly significant effects. Golf measurements, questionnaires and analytics may organise information or support coaching judgement, but they do not replace Chris’s individual assessment of the golfer.

14 Children’s Information

Chris Brook Golf’s coaching services and standard online booking process are intended for adults aged 18 or over. The website’s general articles may be read by a wider audience, but the website is not designed to collect children’s personal data.

If personal data about a child is received unexpectedly, a parent or guardian may contact Chris so that the circumstances can be reviewed and the information deleted where appropriate.

15 Questions and Complaints

Please contact Chris first if you have a question or concern about how your personal information has been handled. This gives him an opportunity to investigate and correct the issue.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority. Visit the ICO complaints page or telephone 0303 123 1113. If you live outside the UK, you may also have the right to complain to the relevant supervisory authority in your country.

16 Changes to This Notice

This notice may be updated when the website, services, providers or legal requirements change. The date at the top shows when it was last revised. A material change affecting information already collected will be communicated directly where that is required and reasonably practicable.