Privacy Policy
This Privacy Policy explains how The GAROE Group Ltd (“we”, “us”, “our”) collects, uses, stores and shares personal data when you visit thegaroegroup.co.uk (the “Site”) or interact with our services. We are committed to handling your personal data responsibly and in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Please read this policy carefully. By using our Site, you acknowledge that you have read and understood how we handle personal data.
Who we are
The data controller responsible for your personal data is:
If you have any questions about how we handle your personal data, please contact us using the details above.
Data we collect
We collect personal data in the following ways:
Via the enquiry form (club and organisation contacts)
- Name, job title, and organisation name
- Email address and telephone number (if provided)
- The content of your enquiry message
Via the Academy Programme ordering page (parents and guardians)
- Name and contact email address
- Player name, age group and club
- Delivery address
- Payment information — processed directly by Stripe; we do not store card details
Automatically when you visit the Site
- IP address and general location data
- Browser type, operating system and device information
- Pages visited, time spent on the Site and referral source
- Cookie identifiers (see Section 05)
Via email marketing
- Email address and name, where you have opted in to receive communications from us
How we use your data
We use the personal data we collect for the following purposes:
- To respond to enquiries submitted via the contact form
- To process orders for Academy Programme plaques, including fulfilment and delivery
- To communicate with clubs, organisations and parents about their programme or order
- To send marketing emails where you have explicitly opted in to receive them
- To analyse Site usage and improve the performance and content of the Site
- To comply with our legal and regulatory obligations
We will not use your personal data for any purpose incompatible with those stated above without first obtaining your consent.
Legal basis for processing
We rely on the following lawful bases under UK GDPR for processing your personal data:
- Contract — processing is necessary to fulfil orders placed through the Academy Programme ordering page
- Legitimate interests — responding to enquiries, improving the Site, and managing our client relationships, where our interests are not overridden by your rights
- Consent — for marketing communications and for non-essential cookies, where we have obtained your explicit agreement
- Legal obligation — where processing is required by law, for example in connection with financial records
Where we rely on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
Cookies & analytics
Our Site uses cookies — small text files placed on your device — to help the Site function and to understand how it is used. When you first visit the Site, you will be presented with a cookie consent banner that allows you to accept or decline non-essential cookies.
Strictly necessary cookies
These are required for the Site to operate and cannot be disabled. They do not store any personally identifiable information.
Analytics cookies
With your consent, we use Google Analytics to collect anonymised data about how visitors use the Site (pages visited, time on site, traffic sources). This data is aggregated and does not identify you personally. You may opt out at any time via the cookie settings link in the Site footer, or by installing the Google Analytics opt-out browser add-on.
Google Analytics data is processed by Google LLC, which participates in the EU–US Data Privacy Framework. For more information, see Google’s Privacy Policy.
Managing cookies
You can update your cookie preferences at any time via the cookie settings link in our Site footer. You can also control cookies through your browser settings, though disabling certain cookies may affect the functionality of the Site.
Third parties we share data with
We do not sell your personal data. We share data only with the third-party service providers necessary to operate our business and deliver our services:
- Stripe — payment processing for Academy Programme orders. Stripe is the data controller for card payment information. See Stripe’s Privacy Policy
- Formspree — form submission handling for the enquiry form
- Resend — transactional email delivery
- Google Analytics — Site usage analytics (with your consent)
All third-party processors we engage are required to handle your personal data in accordance with applicable data protection law and only for the purposes we specify. Where these providers are based outside the UK, we ensure appropriate safeguards are in place as required by UK GDPR.
We may also disclose your personal data where required to do so by law or by a regulatory authority, or where necessary to protect our legal rights.
How long we keep your data
We retain personal data only for as long as is necessary for the purposes it was collected, or as required by law. Our general retention periods are:
- Enquiry form submissions — up to 24 months from the date of submission, or until the enquiry is closed and no ongoing relationship exists
- Order data (Academy Programme) — 6 years from the date of the transaction, in line with HMRC financial record-keeping requirements
- Marketing contact lists — until you unsubscribe or withdraw consent, after which your data will be removed within 30 days
- Analytics data — retained by Google Analytics in accordance with the data retention settings we have applied (14 months)
When personal data is no longer required, we securely delete or anonymise it.
Your rights
Under UK GDPR, you have the following rights in relation to your personal data:
- Right of access — to request a copy of the personal data we hold about you
- Right to rectification — to ask us to correct inaccurate or incomplete data
- Right to erasure — to request that we delete your personal data in certain circumstances
- Right to restriction — to ask us to restrict how we process your data in certain circumstances
- Right to data portability — to receive your data in a structured, commonly used format where processing is based on consent or contract
- Right to object — to object to processing based on legitimate interests, including for direct marketing
- Right to withdraw consent — where processing is based on consent, to withdraw it at any time
To exercise any of these rights, please contact us at the details in Section 01. We will respond within one calendar month. You will not ordinarily be charged for exercising your rights.
If you are unsatisfied with how we handle your request, you have the right to lodge a complaint with the UK supervisory authority:
Security
We take the security of your personal data seriously. The Site is served over HTTPS, and we use reputable third-party services with their own security certifications for payment processing (Stripe) and data handling. Access to personal data within our organisation is restricted to those who need it to carry out their responsibilities.
No method of transmission over the internet is completely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, affected individuals without undue delay.
Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. The “Last updated” date at the top of this page will always reflect the most recent version.
We encourage you to review this page periodically. Where changes are material, we will take reasonable steps to bring them to your attention.
Contact us
If you have any questions, concerns or requests relating to this Privacy Policy or how we handle your personal data, please get in touch: