Privacy Notice

Quick Menu:

Carnoustie Golf Heritage and Hospitality Group Limited Privacy Notice
The Official Carnoustie Photo Experience Privacy Notice
CGLMC Ltd Privacy Notice

Carnoustie Golf Heritage and Hospitality Group Limited Privacy Notice

Carnoustie Golf Heritage and Hospitality Group Limited (Company Number: 13138268), registered address: 22 Manchester Square, London, United Kingdom, W1U 3PT (“we”, “us”, “CGHH”, “Carnoustie Golf Links”) is the Data Controller over any personal data (defined below) we process about you for the purposes set out in this Privacy Notice. We ensure that all personal data collected and used by us is managed in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We recognise that, in order to maintain our reputation and integrity as an open and professional organisation, we must be fully compliant with this legislation. Carnoustie Golf Links is registered as a data controller with the Information Commissioner (number ZB870994).

This privacy notice is for:

1. - our guests/customers/visitors/members/coaching participants/ volunteers/those that participate in our community programmes such as school coaching. Season Ticket Holders have a separate privacy notice which can be accessed via the Season Ticket Holder portal;
  - those who visit our websites, including: carnoustie.com, proshop.carnoustie.com; therookerycarnoustie.com; and any other websites that we launch in the future, including mobile applications and/or purchase goods or services from such websites;
  - those that have signed up to receive marketing communication;
  - those that are on a waiting list for a tee time or Season Ticket;
  - those that have otherwise engaged with us either through this website, or directly by telephone, post, social media or email where you may have provided us with personal data;
  - Professional contacts at our Partners and Suppliers.
  - Trustees of CGLMC Ltd.

This Privacy Notice explains how we use the personal data which we collect about you, how we keep it secure, who we share it with and to explain the legal rights you have in relation to your personal data. If you have any questions about this notice, please contact us by telephone at 01241 802270 or by email [email protected].

Our Promise
In accordance with the Data Protection Law, we will ensure that your data is:

1. - used fairly and lawfully and in a transparent manner;
  - used only for specific, explicit and legitimate reasons;
  - adequate, relevant and not excessive having regard to the reason for which it is collected;
  - accurate and up to date where possible;
  - kept for no longer than necessary;
  - used in line with your rights;
  - kept secure; and
  - transferred internationally only where necessary steps have been taken to ensure the adequate protection and security of the data.

We reserve the right to make minor amends or modifications to this Privacy Notice from time to time, without notice to you, and if we do so, we will post the updated notice on our website. If we make an important change that we need to tell you about, we’ll email you to let you know wherever possible.

What is Personal Data?
Personal Data: means any information relating to an identified or identifiable living person (‘data subject’); an identifiable living person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to on or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identify of that natural person.

Special Category of Data: means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

When we use the term ‘personal data’ we mean both personal data and special category of data

Our Processing
Personal Data is collected in several different ways dependent on your interaction with us. We mostly receive the information from yourself but in some cases we may receive data from third parties such as a Golf Tour Operator. The table below sets out what personal data we process about you, where we get it from, why we use it, our legal basis and who we share it with. Otherwise we will only share your personal data:

1. 1. where we are required to share your personal data in accordance with law e.g. such as under a Court order, other authorities or any regulatory requirement to which we may be subject. We may also share information with the Police if we think it is necessary to assist in the apprehension of offenders or detection of crime;
  2. where we use third parties to undertake certain services on our behalf and in doing so they require to process personal data in order to do this. If so, we will ensure that adequate arrangements are in place to protect your personal data. These third parties include: our professional advisors, our website host provider, cloud storage suppliers, CRM suppliers, marketing platforms (including parties used for sending email marketing communications), IT infrastructure suppliers, tournament hosting and event management software, booking and scheduling software, online coaching software, restaurant booking platform, prize draw and competition hosting sites;
  3. within our corporate group to the extent this is necessary for the purpose for which it was collected;
  4. where we need to share your personal information as part of a sale of our assets, or corporate restructure;
  5. where we have your consent.

Purpose	Personal Data	Lawful Basis	Will we share it with anyone not covered above?
To respond to your enquiries made by email, post, phone and social media.	Name, email address, telephone number, social media handle, postal address, any other you provide.	Legitimate Interest – to respond to enquiries.	No
When you telephone us, we will record your calls.	Any personal data provided on the call.	Legitimate Interest – for training and quality purposes.	No
When you visit The Rookery.	Name, email, mobile, any dietary requirements, payment information.	Performance of a contract – to book a place at our restaurant or at one of our events. If you do not provide the requested personal data we may not be able to provide the services to you. Legitimate Interest – to manage the booking.	No
To provide you with our goods and services including allowing you to play at our golf courses and Performance Centre, booking a Caddie, entering a waiting list, booking tee-times, golf offers and packages, golf vouchers, custom fitting, lessons/tuition at our Golf Academy or other programme(s) (not including the Professional Shop) .	Name, email, telephone number, payment information (where applicable).	Performance of a contract. If you do not provide the request personal data we may not be able to provide the goods or services to you.	No
When you purchase goods from our online or on-site Professional Shop.	Name, email, telephone number, address for delivery, billing address, payment information as applicable.	Performance of a contract. If you do not provide the requested personal data we may not be able to provide the goods or services to you. Legitimate Interest – our processor Shopify uses limited automated decision making to prevent fraud (temporary blacklist of IP Addresses or credit cards). It is not considered to make a legal or significant decision/effect on you.	Shopify, Shopify Payments, UPS for delivery, Fashion Master to fulfil your order, Paypal to process payments, Globo Product Options App to enhance customer experience and Pandectes GDRP Compliance to ensure our practices are compliant. If you want to know more about how these companies process your personal data please visit our Professional Shop privacy notice at The Online Professional Shop - Privacy Notice
When you join our junior golf programmes such as The Carnoustie Craws, Girls.Lead.Golf Academy or participate in our school tuition programme or junior competitions.	Name, email, telephone number, address, age of child, name and contact details of parent or responsible adult, Photograph.	Performance of a contract. If you do not provide the request personal data we may not be able to provide the goods or services to you. Legitimate Interest – to provide golf tuition or tournament entry to children to support participation in golf. Consent – for photographs.	If we have your consent we may post some information on our website or social media channels.
When you register and/or participate to play in any of our tournaments.	Name, email, telephone number, address, photograph.	Legitimate Interest – to organise the tournament. Consent – for photographs.	If we have your consent we may post some information on our website or social media channels to raise awareness of the event
When you visit our premises, we may capture your image by CCTV, or via our webcams.	Your image	Legitimate Interest – for security purposes to protect our staff and premises.	No
When you enter any of our competitions and giveaways.	Name, email, telephone number, photograph.	Legitimate Interest – to manage the competition and notify you if you are the winner. Consent – to publish your details as the winner on our social media page or website.	If we have your consent we may post some information on our website or social media channels to raise awareness of our the competition or giveaway. Tournament Providers or Business Partners
To send you marketing information and provide special offers on your birthday.	Name, email, date of birth	Consent – for electronic marketing such as email or text. Please note you can unsubscribe at any time. It is in our legitimate interest to market our business.	Mailchimp
To use our App	Name, email	Legitimate Interest – to manage access to our app	No
To understand usage of our websites and behaviour advertising on our website.	Technical data, such as your IP address when you visit our website.	Legitimate Interest of understanding how our website is used so we can improve it. Legitimate Interest where we use essential cookies required to operate the website. Consent – for non essential cookies.	Google Analytics, Meta. Please see our Cookie Notice for more information. The Online Professional Shop - Privacy Notice Carnoustie Golf Links - Cookies Policy
When you complete a customer survey.	Name, email, gender, nationality, age	Legitimate Interest of understanding our customer needs.	Survey Monkey
If you unfortunately incur an injury or are involved in an accident while playing with us, we will record details of this in our accident log and share certain information if necessary.	Name, contact details, nature of accident, injury, etc.	Legitimate Interest of understanding accidents occurring on our premises to mitigate risk of recurrence. Compliance with Health and Safety Legislation. Vital Interest – to protect your vital interest in the event of an emergency.	Depending on nature of incident, potentially Police, Medical Professional or Health and Safety Executive.
To manage our relationship with Partners and Suppliers.	Name, email, telephone number,	Legitimate Interest – of managing relationship.	No
To represent CGLMC Ltd as a Trustee	Name, email, telephone, proof of ID, image	Performance of a contract. If you do not provide the request personal data, we may not be able to liaise with you as Trustee.	No
To contact you about important updates to the business	Your name, email, Season Ticket Number or reference number	Vital Interest – to keep you up to date with important updates to the business	Send Pulse
When you use our Photobooth	Your Name, Your image	Consent	No

Do we share your personal information outside of the UK?
Most of our suppliers are based in the UK, however some of our suppliers may host some of the data they process on our behalf outside the UK, including the EU and US. Where this is the case, we have ensured any sharing of your personal data with third parties is in accordance with Data Protection Law and appropriate transfer mechanism are in place to keep your personal data safe. Please contact us for further information if you have any questions on this point.

Keeping your personal data safe
We have put in place appropriate technical and organisational security measures to protect your personal information and prevent it from being lost, destroyed, damaged, used, altered or disclosed. These measures are in place to protect your personal data in all circumstances where we use it.

How long do we keep your data for?
We will only keep your data for as long as we need to for the reason we have collected it. Please contact us for details about our retention schedule.

Your legal rights
We aim to keep your personal data up to date and welcome any updates to your details or corrections to any inaccuracies. You have certain rights under Data Protection Law which are set out below. If you wish to exercise these rights, please email [email protected]. Your rights are:

1. - right to request access to your personal information – you can request a copy of the personal information we hold on you;
  - right to request correction of your personal information – if any personal information we hold on you is incorrect, you can request to have it corrected;
  - right to request erasure of your personal information – you can ask us to delete your personal information in certain circumstances;
  - right to object to processing or restrict processing of your personal information – you may object to our processing of your personal data in certain circumstances;
  - right to request the transfer of your personal information – to provide you, or a third party you have chosen, with your personal information;
  - right not to be subject to automated decision-making and profiling; and
  - right to withdraw consent – where we process your data on the basis of consent, you can notify us that you want to withdraw consent any time. Please note that this would not affect the lawfulness of the processing prior to your withdrawal.

Please note these rights are not always absolute and there may be some instances where we cannot fully comply. Where this the case we will explain this to you at the time.

If you have any data protection complaints or concerns, you may contact the Information Commissioner’s Office (ICO) by post at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Make a complaint about how an organisation has used your personal information | ICO.

We’d like to try and help with any concerns you may have before you contact the ICO, so please get in touch with [email protected] in the first instance.

Last Updated: February 2025

[END OF CGHH PRIVACY NOTICE]

Return to quick menu

———-

Privacy Notice – The Official Carnoustie Experience

By taking part in the Official Carnoustie Photograph Experience, you consent to the collection, processing, and storage of your personal information, including but not limited to your name, photograph, and email address, for the purpose of sending reminder emails. Your personal information will be used solely for the purpose of sending reminder emails related to this photograph experience. We are committed to ensuring the security of your personal information. We will take reasonable precautions to protect your data from loss, misuse, unauthorised access, disclosure, alteration, or destruction. We will not sell, trade, or otherwise transfer your personal information to third parties without your consent, except as required by law or as necessary to fulfil the purpose for which the information was provided.

Opt-Out:
You have the right to opt-out of receiving reminder emails at any time by contacting us directly at [email protected].

Retention Period:
We will retain your personal information for a maximum of three years unless a longer retention period is required or permitted by law.

Changes to Notice:
We reserve the right to update or change this disclaimer at any time. Any changes will be effective immediately upon publishing the updated disclaimer. By agreeing, you acknowledge that you have read, understood, and agree to be bound by the terms of this disclaimer.

Return to quick menu

———-

CGLMC Ltd Privacy Notice

CGLMC Ltd (SC 389638) Whitehall House, 33 Yeaman Shore, Dundee, DD1 4BJ (“we”, “us” “Carnoustie Golf Links Management Committee”) is the Data Controller over any personal data (defined below) we process about you for the purposes set out in this Privacy Notice. We ensure that all personal data collected and used by us is managed in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We recognise that, in order to maintain our reputation and integrity as an open and professional organisation, we must be fully compliant with this legislation. CGLMC Ltd is registered as a data controller with the Information Commissioner (number Z5167695).

This privacy notice is for:

our guests/volunteers/those that participate in our community programmes/those who take part in our Community Benefits Programme.
those who visit our websites
those that have signed up to receive marketing communication;
those that have otherwise engaged with us either through our website, or directly by telephone, post, social media or email where you may have provided us with personal data;
Professional contacts such as Partners and Suppliers.
Trustees of CGLMC Ltd

Our Promise
In accordance with the Data Protection Law, we will ensure that your data is:

used fairly and lawfully and in a transparent manner;
used only for specific, explicit and legitimate reasons;
adequate, relevant and not excessive having regard to the reason for which it is collected;
accurate and up to date where possible;
kept for no longer than necessary;
used in line with your rights;
kept secure; and
transferred internationally only where necessary steps have been taken to ensure the adequate protection and security of the data.

What is Personal Data?
Personal Data: means any information relating to an identified or identifiable living person (‘data subject’); an identifiable living person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identify of that natural person.

When we use the term ‘personal data’ we mean both personal data and special category of data

Our Processing
Personal Data is collected in several different ways dependent on your interaction with us. We mostly receive the information from yourself but in some cases we may receive data from third parties. The table below sets out what personal data we process about you, where we get it from, why we use it, our legal basis and who we share it with. Otherwise we will only share your personal data:

1. where we are required to share your personal data in accordance with law e.g. such as under a Court order, other authorities or any regulatory requirement to which we may be subject. We may also share information with the Police if we think it is necessary to assist in the apprehension of offenders or detection of crime;
2. where we use third parties to undertake certain services on our behalf and in doing so they require to process personal data in order to do this. If so, we will ensure that adequate arrangements are in place to protect your personal data. These third parties include: our professional advisors, our website host provider, cloud storage suppliers, CRM suppliers, marketing platforms (including parties used for sending email marketing communications), IT infrastructure suppliers;
3. within our corporate group to the extent this is necessary for the purpose for which it was collected;
4. where we need to share your personal information as part of a sale of our assets, or corporate restructure;
5. where we have your consent.

Purpose	Personal Data	Lawful Basis	Will we share it with anyone not covered above?
To consider your application to our Community Benefits Programme and to issue awards	Name, email, address, telephone number, date of birth, gender, details of your bank account, your bank account statements, in conjunction with your application	Legitimate Interest of assessing applications and providing grants.	No Community Benefits Privacy Notice
To represent CGLMC Ltd as a Trustee	Name, email, telephone, proof of ID, image	Performance of a contract. If you do not provide the requested personal data, you may not be able to represent CGLMC Ltd as a trustee.	No
To respond to your enquiries made by email, post, phone and social media.	Name, email address, telephone number, social media handle, postal address, any other you provide.	Legitimate Interest – to respond to enquiries.	No
When you telephone us, we will record your calls.	Any personal data provided on the call.	Legitimate Interest – for training and quality purposes.	No
To understand usage of our websites and behaviour advertising on our website.	Technical data, such as your IP address when you visit our website.	Legitimate Interest of understanding how our website is used so we can improve it. Legitimate Interest where we use essential cookies required to operate the website. Consent – for non essential cookies.	Google Analytics, Meta. Please see our Cookie Notice for more information. The Online Professional Shop - Privacy Notice Carnoustie Golf Links - Cookies Policy
To contact you about important updates to the business	Your name, email, Season Ticket Number or reference number	Vital Interest – to keep you up to date with important updates to the business	Send Pulse
To manage our relationship with Partners and Suppliers.	Name, email, telephone number,	Legitimate Interest – of managing relationship.	No

How long do we keep your data for?
We will only keep your data for as long as we need to for the reason we have collected it. Please contact us for details about our retention schedule.

1. - right to request access to your personal information – you can request a copy of the personal information we hold on you;
  - right to request correction of your personal information – if any personal information we hold on you is incorrect, you can request to have it corrected;
  - right to request erasure of your personal information – you can ask us to delete your personal information in certain circumstances;
  - right to object to processing or restrict processing of your personal information – you may object to our processing of your personal data in certain circumstances;
  - right to request the transfer of your personal information – to provide you, or a third party you have chosen, with your personal information;
  - right not to be subject to automated decision-making and profiling; and
  - right to withdraw consent – where we process your data on the basis of consent, you can notify us that you want to withdraw consent any time. Please note that this would not affect the lawfulness of the processing prior to your withdrawal.

Please note these rights are not always absolute and there may be some instances where we cannot fully comply. Where this the case we will explain this to you at the time.

We’d like to try and help with any concerns you may have before you contact the ICO, so please get in touch with [email protected] in the first instance.

Last Updated: February 2025

[END OF CGLMC LTD PRIVACY NOTICE]

Return to quick menu