Privacy Notice
Last updated 30 September 2026
This notice explains what personal data The Round Society collects, why, how long it is kept, and what you can do about it. It covers the The Round Society website and the early-access list. It is written to meet the UK GDPR and EU GDPR transparency requirements (Articles 13 and 14).
1. Who is responsible for your data
The data controller is Deep Quiver, which operates The Round Society.
For any question about this notice, or to exercise the rights described in section 7, contact [email protected]. We aim to respond within 30 days, which is the maximum period allowed under Article 12(3).
2. What we collect, and why
Early-access list
If you fill in the early-access form, we collect and store:
- your first and last name;
- your email address;
- your league's name and approximate size;
- what you currently use to run your league;
- whether you are interested in a hosted or self-hosted version;
- whether you want to take part in beta testing;
- anything you choose to write in the optional free-text question.
We use this to send you development updates and beta invitations, and to understand what kinds of leagues are interested so we build the right thing. We do not sell it, rent it, or share it for anyone else's marketing.
Abuse prevention
When the form is submitted we store a one-way cryptographic hash of the submitting IP address. It is used only to rate-limit automated submissions. We do not store the IP address itself, and the hash is not used to identify or profile you.
Analytics and cookies
This website uses Google Analytics 4 (property G-G5P6H94B9W) to
measure how people find and use the site: pages viewed, time on the page, device and browser type,
referring site, and approximate location at city or region level. Google Analytics sets cookies in
your browser and receives your IP address, which Google uses to derive that approximate location.
We do not use it for advertising, we have not enabled Google Signals or ad personalisation, and we
do not combine it with the early-access list.
Beyond Google Analytics, this site runs no advertising network, no pixel, and no other third-party embed. The The Round Society league app itself carries no analytics at all.
Nothing is set until you accept. Analytics storage starts denied through Google Consent Mode, so no analytics cookie is written and nothing is stored in your browser unless you choose Accept on the cookie banner. If you choose Reject, or ignore the banner, Google Analytics receives a cookieless page view — no identifier, nothing kept on your device. To change your mind later in either direction, use Cookie Choices in the footer of any page.
You can also block or delete cookies in your browser, or install Google's opt-out browser add-on. Blocking it has no effect on anything else on this site. To understand what Google does with the data, see How Google uses information from sites that use its services.
League accounts
The The Round Society application itself — used by golf leagues that have signed up — processes player names, scores and league records on behalf of each league. In that context the league is the controller and The Round Society is the processor. This notice covers the public website and the early-access list; league members should ask their commissioner for their league's own arrangements.
3. Our lawful basis
| Purpose | Lawful basis |
|---|---|
| Sending you development updates and beta invitations | Consent (Article 6(1)(a)) — given by ticking the opt-in box on the form. You can withdraw it at any time. |
| Keeping a record of who asked to be on the list | Legitimate interests (Article 6(1)(f)) — running a waiting list for a product people asked to hear about. |
| Storing analytics cookies in your browser (Google Analytics) | Consent (Article 6(1)(a), and PECR regulation 6) — given by choosing Accept on the cookie banner. Withdraw it at any time with Cookie Choices in the footer. |
| Counting cookieless page views when you reject or ignore the banner | Legitimate interests (Article 6(1)(f)) — knowing which pages are useful. Nothing is stored on your device and no identifier is kept, so no consent is required. |
| Rate-limiting form submissions | Legitimate interests (Article 6(1)(f)) — keeping the service available and free of automated abuse. |
Where we rely on consent, withdrawing it is as easy as giving it: use the unsubscribe link in any email, or email us. Withdrawal does not affect the lawfulness of anything done before it.
4. How long we keep it
Early-access records are kept for 24 months from the date you signed up, and then deleted. If you unsubscribe or ask for deletion before that, we act on it when you ask. Abuse-prevention hashes are kept only as long as the rate-limiting window needs them.
5. Who else processes your data
We keep the number of third parties deliberately small. Your data is processed by:
| Provider | What they do | Where |
|---|---|---|
| Resend | Delivers the emails we send you | United States |
| Cloudflare | Serves and protects this website; routes traffic to our server | Global network |
| Google (Google Analytics) | Measures how this website is used | United States |
Both act as processors under contract and may not use your data for their own purposes. The database itself is held on our own server, not on a third-party platform.
6. International transfers
Sending email through Resend involves a transfer of your name and email address to the United States, and Google Analytics involves a transfer of your IP address and usage data to the United States. That transfer relies on the European Commission's Standard Contractual Clauses together with the provider's own supplementary safeguards. You can ask us for details of the safeguards in place.
7. Your rights
Under the GDPR you have the right to:
- Access — get a copy of the personal data we hold about you;
- Rectification — have anything inaccurate corrected;
- Erasure — have your data deleted ("the right to be forgotten");
- Restriction — have us stop processing it while a dispute is resolved;
- Portability — receive your data in a machine-readable format;
- Object — object to processing based on legitimate interests;
- Withdraw consent — at any time, without giving a reason.
To exercise any of these, email [email protected]. We will not charge you, and we will not ask you to justify the request.
We make no automated decisions about you and carry out no profiling that produces legal or similarly significant effects.
8. Security
Data is held on a server we control and is encrypted in transit (HTTPS everywhere).
Administrative access is protected by individual accounts, with passwords stored using
scrypt hashing rather than kept in readable form. Backups are taken daily, stored
with file permissions that restrict them to the server's administrator, and are not shared with
any third party.
9. Complaints
If you think we have handled your data badly, please tell us first — most things are fixable quickly. You also have the right to complain to a supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk); in the EU it is the authority in the country where you live or work.
10. Changes to this notice
If we change how we use personal data, we will update this page and change the date at the top. If a change is significant and we hold your consent, we will tell you by email before it takes effect.