Privacy Policy

This policy explains how Whoison (“we”, “us”, “our”), operated by WHOISON LTD, 39 Raynham Street, Hertford SG13 7DE, United Kingdom, collects, uses, and protects your personal data when you use whoison.app to book or organise paid pickleball sessions and events. We are the data controller for the personal data described here.

1. What information we collect

When you book a session or event, or join a waitlist, we collect the name and email address you provide. We do not require you to create an account or password.

Payment data. If your booking requires payment, card details are collected and processed directly by Stripe, our payment processor. We never receive or store your full card number.

Technical data. Our hosting and infrastructure providers automatically log standard technical information (such as IP address, browser type, and request timing) needed to operate and secure the Services. This is used for security and fault-finding only — not for analytics, advertising, or tracking. See our Cookie Notice for the one cookie we use.

We do not collect sensitive personal data (such as health, racial or ethnic origin, or religious belief), and we do not collect data from third parties about you.

2. Why we process your data

• To perform our contract with you: creating and managing your booking, sending confirmations, processing cancellations and refunds, and communicating with you about a session or event you have booked.
• For our legitimate interests: keeping the Services secure, preventing fraud and abuse, and diagnosing technical problems.
• With your consent: where you have explicitly agreed to something, such as this policy and our Terms & Conditions, at the point of booking.
• To comply with the law: for example, retaining financial records as required by UK tax and accounting rules.

3. Who we share your data with

We do not sell your personal data, and we do not share it for third-party marketing or advertising. We use the following third-party service providers to run Whoison, each of whom processes personal data only on our instructions:

• Stripe — payment processing and payouts to organisers.
• Vercel — application hosting.
• Neon — database hosting.
• Resend — sending transactional emails (booking confirmations and similar).
• Upstash — background job scheduling and rate limiting.
• Cloudflare — bot and spam protection on our event creation form.

The organiser of a session or event you book can see the booking details needed to run that session or event (your name, and whether you are confirmed, waitlisted, or cancelled). Organisers do not see your email address on any public page.

Some of these providers operate outside the UK and European Economic Area, principally in the United States. Where that is the case, they rely on the UK's international data transfer safeguards (such as the UK-US data bridge or standard contractual clauses) to protect your data.

4. How long we keep your data

We keep booking records, including your name, email, and financial details, for 7 years, in line with UK tax and accounting record-keeping requirements. We do not run an automated deletion process; if you ask us to erase your data before that period ends, see Section 5 below.

5. Your rights and how to exercise them

Under UK data protection law, you have the right to: access the personal data we hold about you; have inaccurate data corrected; ask us to erase your data; restrict or object to certain processing; and receive your data in a portable format.

To exercise any of these rights, email privacy@whoison.app. We aim to respond within 30 days. If you ask us to erase your data, we remove your name and email from the relevant booking record while retaining the anonymised financial record (amount, status, and payment references) that we are legally required to keep.

If you believe we have not handled your personal data properly, you can complain to the UK's data protection authority, the Information Commissioner's Office (ICO).

6. Children

Whoison is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will remove it.

7. Changes to this policy

We may update this policy from time to time, for example if we start using a new service provider. The “Last updated” date above will change when we do, and material changes will be reflected here before they take effect.

8. Contact us

Questions about this policy or your data? Email privacy@whoison.app, or write to us at WHOISON LTD, 39 Raynham Street, Hertford SG13 7DE, United Kingdom.