01Who we are
TeeTimes (to be confirmed, registration number to be confirmed) runs the TeeTimes platform at teetimes.co.za. Golfers use it to find and book tee times; golf clubs use it to run their tee sheet, rates, members and bookings.
| Details | |
|---|---|
| Responsible party | to be confirmed |
| Physical address | to be confirmed |
| Postal address | to be confirmed |
| Information Officer | to be confirmed, privacy@teetimes.co.za |
| Deputy Information Officer | to be confirmed, privacy@teetimes.co.za |
| Privacy questions | privacy@teetimes.co.za |
This notice explains what personal information we process, why, who we share it with, how long we keep it and the rights you have under the Protection of Personal Information Act, 2013 (POPIA).
02Clubs and TeeTimes: who is responsible
Two kinds of organisation handle your information on TeeTimes, and it matters which one you deal with.
- Each golf club is the responsible party for its own member records and the bookings made at that club. The club decides who may book, its rates, its cancellation and no-show rules, and what member details it keeps. When we store and process that information for the club, we act as the club's operator under section 21 of POPIA, on the club's instructions and under a written agreement.
- TeeTimes is the responsible party for your platform account (sign-in details, your name, your notification choices) and for running and securing the platform itself.
If your question is about a membership, a rate, a charge or a strike at a club, contact that club first. We will help you reach it and will pass on requests we receive that belong to a club. For anything about your TeeTimes account, contact us.
03What we collect and where it comes from
| Category | What it includes | Source |
|---|---|---|
| Account | Name, email address, a password (stored only as a secure hash by our authentication provider), the date you accepted these terms | You, when you sign up |
| Profile and membership | Full name, email, cell number, GolfRSA number, member number, membership tier and status, rounds remaining, and any extra fields a club keeps about its members | You, and the club you belong to |
| Bookings and players | Club, date, tee time and starting tee, players in the group, guest names, guest cell numbers and emails, a contact name, phone and email, notes, the price calculated, the cancellation policy shown, check-in and cancellation details | You, the person who booked you, or club staff |
| Counter payments | Amount, payment method, reference, date, the staff member who recorded it, and any reversal | Club staff |
| Cancellations, charges, strikes and suspensions | Late cancellations, no-shows, charges and their status, strikes, booking suspensions, reasons and notes | Generated by the club's rules, and club staff |
| Notification preferences and delivery | Which messages you want and on which channel, WhatsApp number with opt-in and verification dates, the address each message was sent to, the message content, its delivery status, and addresses that bounced or complained | You, and our email and messaging providers |
| Club staff and audit | Staff roles and invitations, last active date, and a log of who changed what and when, with the before and after values | Club staff and the platform |
| Imported club data | Member lists, bookings, past bookings and payments a club brings from its previous system, with the original rows and any import messages | The club |
| Technical | Sign-in session cookies, and hosting logs that record IP address, browser details and time of requests | Your device |
Guests booked by someone else
When you add a guest to a booking, you give us their name and, if you choose, their cell number or email. Please only do this with their knowledge. We use those details only to manage that booking at that club.
Cookies and tracking
We use only the cookies needed to keep you signed in. We do not use advertising cookies, analytics trackers or social media pixels, and we do not build advertising profiles.
04Why we use it and our lawful basis
We only process personal information for a specific purpose and on a ground allowed by section 11 of POPIA.
| Purpose | Lawful basis (POPIA s11) |
|---|---|
| Create and run your account, sign you in, keep it secure | Performing our contract with you |
| Make, change and cancel bookings, and show them to the club | Performing the contract; the club's legitimate interest in running its tee sheet |
| Apply a club's rates, member access, cancellation and no-show rules | Performing the booking contract with the club |
| Send booking confirmations, changes and cancellations by email | Performing the contract |
| Send reminders and account emails you can switch off | Legitimate interest, with an unsubscribe link in every message |
| Send WhatsApp messages | Your consent, which you can withdraw at any time |
| Keep booking and payment records | Legal obligation (tax and accounting laws) |
| Keep an audit log of staff changes | Legitimate interest in accountability and preventing fraud or misuse |
| Investigate faults, abuse and security incidents | Legitimate interest; legal obligation where a breach must be reported |
| Import a club's existing member and booking data | The club's lawful basis, as responsible party; we act as its operator |
06Transfers outside South Africa
Our database is hosted in Australia, our email provider is in the United States, and WhatsApp messages pass through Meta's systems outside South Africa. Section 72 of POPIA allows these transfers when the recipient is bound by law, binding corporate rules or a binding agreement that gives protection substantially similar to POPIA, or when the transfer is needed to perform a contract with you.
We rely on written data processing agreements with each provider that require them to keep the information confidential and secure and to use it only to provide their service to us, and on the transfer being needed to deliver the service you asked for. You can ask us for more detail on these safeguards.
07How long we keep it
We keep personal information only as long as we need it for the purpose it was collected for, or as long as a law requires. Clubs set their own retention for member records they control.
| Information | How long |
|---|---|
| Message content of emails and WhatsApp messages | 30 days after the message is finally sent or abandoned |
| Bookings, prices and counter payments | 5 years from the end of the financial year in which the booking was played or paid |
| Message delivery records | to be confirmed |
| Cancellation charges, strikes and suspensions | to be confirmed |
| Audit log | to be confirmed |
| Club import files and rows | to be confirmed |
| Your account, after you ask us to close it | to be confirmed |
| Unsubscribe and bounce records | As long as needed to honour your choice not to receive email |
When the period ends we delete the information or de-identify it so it can no longer be linked to you.
08How we protect it
We take reasonable technical and organisational measures, as section 19 of POPIA requires. They include:
- Encryption in transit: the site and our providers are reached over HTTPS.
- Row-level security in the database, so each club's staff can reach only their own club's records and golfers only their own.
- Role-based access for club staff, with permissions set by each club.
- An audit log of changes made by staff, recording who made each change and when.
- Passwords stored only as hashes by our authentication provider; we never see them.
- Message content cleared automatically 30 days after a message is finished.
No system is perfectly secure. If a security compromise affects your personal information, we will notify the Information Regulator and you, or the club that is responsible, as section 22 of POPIA requires.
09Your rights and how to use them
You have the right to:
- ask whether we hold personal information about you and receive a copy of it;
- ask us to correct information that is inaccurate, out of date or incomplete;
- ask us to delete information we no longer have a lawful reason to keep;
- object to processing based on legitimate interest, including direct marketing;
- withdraw consent you gave, such as for WhatsApp messages, at any time;
- complain to the Information Regulator.
How to make a request
Email privacy@teetimes.co.za from the address on your account, or write to us at to be confirmed. You can correct your name and GolfRSA number and change your message choices yourself on your profile. We may ask you to confirm your identity before we act. We will respond within 30 days, and tell you if we need longer and why. Requests for a copy of records can also be made under PAIA; see our PAIA manual.
Some information cannot be deleted straight away, for example booking and payment records we must keep for tax purposes. If so, we will tell you what we keep and why. Requests about a club's member records are passed to that club, which decides them as responsible party.
10Direct marketing
We do not send direct marketing by email, SMS or WhatsApp without your prior consent, as section 69 of POPIA requires. Booking confirmations, reminders and account notices are service messages, not marketing. If we ever ask for marketing consent, we will do so separately and every message will let you opt out.
11Children
TeeTimes accounts are for adults. A junior golfer may be booked as a player by a parent or guardian, who gives the junior's details with their consent and is responsible for the booking. We do not knowingly let children open accounts.
12Automated decisions
Some outcomes are applied automatically according to rules a club sets: a late cancellation or no-show can add a charge or a strike, and enough strikes can suspend booking at that club for a period. These follow the club's published cancellation policy, which is shown before you book.
Club staff can review, waive or lift any charge, strike or suspension. You can ask the club to review a decision, and you may object to it and make representations, as section 71 of POPIA allows. If you cannot resolve it with the club, contact us.
13Complaints to the Information Regulator
Please contact us first so we can try to put things right. You may also complain to the Information Regulator at any time:
| Information Regulator | |
|---|---|
| Website | inforegulator.org.za |
| POPIA complaints | POPIAComplaints@inforegulator.org.za |
| General enquiries | enquiries@inforegulator.org.za |
| Address | JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 |
14Changes to this notice
We will update this notice when our processing changes. The version and dates at the top always show the current one. If a change materially affects how we use your information, we will tell you by email or on the site before it takes effect. Earlier versions are available on request from privacy@teetimes.co.za.