Privacy policy

Paul Campbell's Karate Academy Limited is the data controller responsible for information used to manage student lessons, attendance, safeguarding, payments, and bookings.

Contact: Paul Campbell's Karate Academy Limited, PC Karate Academy, 14 Canal Street, Brierley Hill, DY5 1JJ, United Kingdom, or email paulcampbell12@hotmail.com.

When a family account is created or managed, the app may collect:

• Parent or account holder name, email address, and phone number.
• Student name, date of birth, age group, belt, and linked family account.
• Emergency contact details and relationship to the student.
• Medical notes, safeguarding notes, and photo/contact consent choices.
• Lesson bookings, waiting list entries, private lesson requests, attendance records, and belt progress.
• Payment status and payment reference information connected to Square checkout.
• Basic technical information needed to run the app, such as login session data and server logs.
• Pre-membership enquiries, including contact details, student age, preferred group, and the message sent to Paul.

The information is used to:

• Create and manage family accounts.
• Allow parents or guardians to book lessons for linked students.
• Help Paul manage attendance, class sizes, waiting lists, and lesson safety.
• Record medical, safeguarding, and emergency details needed for student welfare.
• Process lesson payments and confirm bookings after payment.
• Send account, password reset, booking, and club-related messages.
• Protect the app from misuse and keep the service working securely.
• Reply to people who ask about joining the club and track whether an enquiry has been handled.

We use account, booking, attendance, and payment information where it is necessary to provide club services and manage the agreement with a family. We also use information for the club's legitimate interests in safely organising classes, preventing misuse, maintaining accurate records, and communicating with families. Where the law requires particular records, we use them to meet that legal obligation.

Medical information is health information and receives additional protection. It is used only where the parent or guardian has chosen to provide it for student safety, or where its use is necessary to protect a student's vital interests. Safeguarding information is used where necessary to safeguard children and individuals at risk. A parent or guardian can ask us to stop using optional medical information, although this may affect how safely the club can provide a lesson.

Payments are handled through Square. The app does not store full card numbers. Square may process payment details according to its own privacy and security terms. The app stores payment status and references so bookings can be confirmed and managed.

Information is only shared where needed to run the app and club operations. Service providers may include Supabase for authentication and database storage, Vercel for hosting, Resend or Supabase for email delivery, and Square for payment processing.

The app does not sell personal information, does not use advertising tracking, and does not share student information with advertisers.

Some providers may process information outside the United Kingdom. Where this happens, the club relies on the provider's applicable UK adequacy arrangements or approved contractual safeguards. Contact the club to request more information about these safeguards.

The app is designed for parents or guardians to manage student bookings. Student information, medical notes, safeguarding notes, and emergency contacts are used only for club management, welfare, and safety.

Active account and student-management information is kept while the family uses the club. When an account is deleted, direct account details, student profiles, medical notes, safeguarding notes, messages, and lesson activity held only in the app are deleted unless the club has a documented legal or safeguarding reason to retain a separate record.

Payment records needed for accounting are anonymised when the family account is deleted and may be retained for up to six years after the end of the relevant financial year. Outstanding deletion requests are reviewed within one month. Security and hosting logs are normally retained according to the service provider's operational retention period and only for as long as reasonably necessary for security and reliability.

Joining enquiries marked as joined or closed are automatically deleted after 30 days. If they join, the necessary details are moved into their family account and managed under the account retention rules above.

Parents can request deletion inside the app from Details > Account deletion. Paul will review the request before deleting the family account and linked student records. Some information may need to be retained where required for safeguarding or legal reasons. Accounting records are retained without the student profile and are anonymised where possible.

Parents or guardians can:

• Update family and student details in the app.
• Request correction of inaccurate information.
• Request account deletion from the Details page.
• Contact Paul to ask what information is held about the family account.
• Ask us to restrict or object to certain uses, or request a portable copy where the right applies.
• Withdraw consent for optional information at any time, without affecting earlier lawful use.

You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.

The app uses authenticated accounts, role-based access, protected admin routes, database security policies, and trusted payment/email providers. No system can be guaranteed completely secure, but the app is built to limit access to the people who need it.

For privacy questions, account deletion, or corrections, contact Paul Campbell through the club or via the official club website: