Privacy, rights and support

Club SOBO Privacy Policy

This policy explains how Club SOBO uses personal data for member use, staff use, business use, internal and external booking routes, calendar connections, legacy sales-representative access where enabled, public web routes, mobile-app features, legal/email notices, support, moderation, fraud prevention, analytics, and paid business-service workflows.

Version: 2026-08-30 · Effective date: 30 August 2026 · Last updated: 30 August 2026

1) Controller and contact

Controller: SPOTLIGHT VENTURES LTD (trading as Club SOBO).
Company number: 17076611.
Registered office: Flat 2, 34 Grand Avenue, Southbourne, Bournemouth, Dorset, United Kingdom, BH6 3SY.
Privacy and rights requests: hello@clubsobo.co.uk.
Club SOBO member accounts are available to people aged 13 and over. Business-owner, business-admin, sales-representative, and Club SOBO platform/admin/support authority is available only to people aged 18 and over. A business may give a declared under-18 staff member restricted ordinary staff access.

2) Member, staff, and business use

Member use covers member signup, sign-in, profile and membership-code records, offer browsing, internal booking requests, appointment changes and reminders, external booking-link clicks, QR display, scan verification, individual-offer redemptions, loyalty progress, rewards, What's On browsing and reporting, notification preferences, support, account deletion, and data-rights requests.
Staff use covers authorised business staff, business admins acting in scanner, booking, or staff-management workflows, Club SOBO platform/admin/support users, and legacy sales-representative access where enabled. Staff use includes sign-in, role checks, booking-only permissions and appointment decisions, scanner activity, permission requests, sales-representative attribution, moderation, support, fraud review, audit logs, and operational communications.
Temporary permission windows cover staff or admin approval records, start and end times, reviewer details, reasons, and related audit records where higher-risk staff or scanner capabilities need a current approval.
Business use covers business applications, approved business profiles, business locations and map pins, business owner/admin accounts, seven-day staff invitations and permissions, offer and loyalty-card management, internal booking setup, resources and availability, connected calendars, appointment decisions, Business and Event Highlights, What's On submissions, analytics, payment or entitlement records, and business support.
Legacy sales-representative access covers invite-only access, referral or attribution codes, status controls, historic conversion counts, commission-rate or commission-due reporting, invite emails, support, and related admin audit records. Sales representatives may receive their own aggregate referral and commission analytics, not identifiable member lists by default.
Where Club SOBO enables multi-role access, one identity may hold member, business, staff, or admin capabilities. Each capability is still processed according to its purpose and access scope.
Where a compatible client presents Club SOBO's 13+ signup flow, it asks whether the member is aged 13–17 or 18+. Club SOBO does not request a date of birth or identity document for this purpose. An explicit under-13 selection is rejected before an account is created. Older app versions may omit the band; Club SOBO treats a missing band as unknown and never as proof of adulthood.
Apple or Google may provide a privacy-preserving age-range result. Club SOBO uses the declared band and current platform result to provide the general experience or, where all required conditions are met, permit adult-only content. A declined, unavailable, expired, or unsuccessful result leaves the account in the general experience and does not prevent ordinary use.
After Club SOBO activates its separate minimum-age rollout control, a supported platform result confirming an age range below 13 automatically hard-blocks the account, stops promotional email and push, and revokes current sessions. Club SOBO does not automatically delete or unblock that account. The member can contact hello@clubsobo.co.uk for human review if the result is wrong. Existing accounts with no age result remain unknown and are not backfilled or blocked for that reason.
Existing member accounts created before the 13+ signup flow are not assigned an age band automatically. Businesses do not receive a member's age band or platform result; they receive only the minimum outcome needed for an action the member requests.

3) Personal data we collect

Account and identity data: first name, last name, email address, account role, membership code, sales-representative referral or attribution code where enabled, profile image where enabled, login credentials metadata, session records, policy acceptance records, account status, and block or suspension status.
Age and suitability data: the member's coarse 13–17 or 18+ declaration, a minimal Apple or Google age-range result class and validity evidence where available, adult-access state, content classifications, correction decisions, and related security or audit records. Club SOBO does not request a date of birth or identity document for this age-band flow.
Member activity data: QR sessions, scan results, individual-offer redemptions, loyalty stamps, reward events, takeaway-claim records where enabled, offer views or clicks, What's On views and external-link clicks, content reports, notification preferences, and support history. Retired interaction records may be retained only for the retention purposes below.
Staff activity data: business staff role, staff email, invitation token fingerprint, invitation expiry, delivery and acceptance status, permission request details, scanner eligibility, scan counts, stamps distributed, staff-management actions, sales-representative invite/status/referral/commission records where retained or enabled, moderation actions, admin notes, audit logs, and support or enforcement records.
Business data: business name, category, profile details, contact details, website, address, postcode, adjusted map-pin data, logo or cover images, offer and event content, loyalty rules, booking or takeaway settings, Business or Event Highlight requests, review notes, and performance analytics.
Appointment and calendar data: booking reference, member and business identifiers, member first name and contact email held by Club SOBO, optional member private note, offer and booking-rule snapshots, selected resource, requested and confirmed times, approval deadline, status, member-visible business cancellation or no-show reason, reminder and delivery state, redemption linkage, calendar-connection status, selected calendar identifiers, free/busy ranges, Club SOBO provider-event identifiers, provider operation state, and related audit records. The private-note field is not designed for health, disability, allergy, religion or other sensitive information, and Club SOBO does not need that information for booking. Do not put it in the note. If you do, Club SOBO will receive it as part of the request; contact hello@clubsobo.co.uk to ask for correction or removal, subject to lawful retention.
Photos, uploads, and submitted content: optional profile images where enabled; business logos, covers and offer images; event images and descriptions; reports; support attachments; source and rights information; moderation state; and removal or takedown records. Published business, offer and event content can be visible in the app, on public Club SOBO web pages and in search results.
Social media and marketing-permission data: business social handles, source URLs, captions, images, videos, public tags, sent or submitted content, featured people, creator or rights information, publication labels, rights confirmations, takedown requests, removal notes, and permission or dispute evidence.
Device, security, and anti-fraud data: IP address, user agent, app version, platform/runtime, browser metadata, device identifier where provided, push-token data, rate-limit records, integrity or abuse-prevention signals, QR token fingerprints, and security logs.
Workflow and audit data: policy acceptance records, consent and preference records, idempotency keys, feature-flag decisions, live-offer and live-event checks, Highlight checkout, day and placement state, configured offer day/time validity-window checks, staff-permission-window checks, admin actions, audit logs, and support or dispute records.
Billing, checkout, and entitlement data: payment-provider transaction identifiers, product identifiers, purchase status, entitlement status, the Event Highlight event and exact slot, price and currency, applicable Terms and cancellation-information versions, early-performance request and acknowledgement timestamps, consent-wording version, contract reference, confirmation-delivery state, cancellation outcome, refund reference and amount, chargeback status, invoice or reconciliation records, and related audit records where a paid route is used. Club SOBO does not retain raw store receipts or signed purchase payloads in the user-facing checkout record.
Website and communications data: app-first join guidance interactions where visible to Club SOBO, public business signup records, contact requests, password reset requests, account-deletion requests, data-rights requests, email delivery records, push-notification delivery records, admin broadcast records, legal notice records, cookie or consent signals, and website security records.
Club SOBO does not ask for special-category personal data and users should not submit it in profile, community, offer, support, or business content unless Club SOBO has specifically asked for it and explained why.

4) Data we collect and why

Account, identity, role, and policy-acceptance data is used to create accounts, authenticate users, resolve member/business/staff/admin access, keep legal acceptance records, support users, and protect accounts.
Age and suitability data is used for child safety, access control, content filtering, security, complaints, fraud prevention, and legal compliance. A self-declared 18+ answer alone does not unlock adult-only content.
Member QR, scan, offer, redemption, takeaway, loyalty, reward, What's On, report, preference, and support data is used to show eligible features, verify redemptions, prevent duplicate or fake use, operate current event and reporting features, honour notification choices, investigate support issues, and improve the service.
Business profile, content, staff, scanner, offer, loyalty, Business and Event Highlights, What's On, analytics, and review data is used to assess and manage business access, publish accurate local content, operate business tools, verify staff permissions, provide business reporting, moderate content, and deliver paid Highlight services.
Appointment, private-note, resource, availability, calendar-connection, provider-operation, reminder, cancellation-reason, and booking audit data is used to calculate available slots, place and manage private Club SOBO calendar events, route approval decisions, prevent double booking, support cancellation and rescheduling, show the member why a business cancelled, attribute a later QR redemption to the correct offer, investigate disputes, and report booking performance without treating external-link clicks as bookings. A member private note is shown only to authorised booking users for that business and is excluded from email, push, calendar-provider and analytics payloads.
Business social media and marketing-permission data is used to check rights, format or repost business content, market businesses and Club SOBO, label promoted or commercially connected content, handle takedown requests, preserve evidence, and resolve rights, privacy, advertising, brand, moderation, or legal concerns.
Staff, platform-admin, support, moderation, temporary-permission-window, audit, and legacy sales-representative data where enabled is used to enforce role scope, investigate misuse, support businesses and members, record authorised actions, and reconcile historic referral or commission reporting.
Device, IP, app/browser, push-token, integrity, idempotency, rate-limit, QR fingerprint, and security data is used to keep the platform reliable, detect abuse, throttle high-risk activity, prevent replay or duplicate actions, deliver push messages, and maintain audit evidence.
Email, push, website, legal notice, cookie/consent, data-rights, account-deletion, and support data is used to send service messages, manage preferences, evidence consent or opt-out choices, respond to requests, and keep app and website legal pages aligned.
Payment, app-store, checkout-consent, contract-confirmation, entitlement, refund, chargeback, invoice, and reconciliation data where a paid route is used is used to verify purchases, evidence the contract and any request to begin within the cancellation period, deliver Business or Event Highlights, send the durable transactional confirmation, handle statutory cancellation, refunds or disputes, keep accounting records, and prevent payment fraud.
Weather and map-related data is limited to fixed Southbourne weather requests through WeatherKit and business-supplied or admin-adjusted business map pins. Club SOBO does not require precise device location for the weather feature or business-discovery map.
Some of this data is needed to provide Club SOBO. If you do not provide required account, role, business, redemption, payment, support, security, or legal-acceptance information, Club SOBO may be unable to provide the relevant service or feature.
The coarse age declaration is required where a compatible client presents the 13+ signup flow. A platform age-range result may be declined or unavailable without preventing the general 13+ experience.

5) How we collect data and what we do not collect

We collect data directly from you when you create an account, use the app or website, submit content, manage settings, contact support, or make a rights request.
We collect data from your device or browser when you use Club SOBO, including security and reliability metadata needed to run the service.
We may receive data from participating businesses and authorised business admins, including a proposed staff member's email address for a one-time invitation; from legacy sales representatives where retained or enabled; and from Club SOBO admins, payment or entitlement providers, app stores, email or push providers, website or hosting systems, public business websites, public social media pages, social media tags, or business-submitted marketing material. The invitation identifies the inviting business, links to this policy, expires after seven days, and grants no staff access until the recipient accepts and completes the required account and policy steps.
If a business connects Google Calendar, Club SOBO receives and processes the selected calendar identifiers, free/busy time ranges, access-token metadata, and identifiers and times for Club SOBO-created events. Club SOBO does not show unrelated event titles to members and does not retain unrelated appointment titles for booking availability.
Google Calendar OAuth access and refresh tokens are encrypted at rest in Supabase Vault and are available only to trusted server-side booking services. They are not placed in the mobile app, public website, analytics, or member-visible booking records.
In the first internal-booking release, members are not added as Google event attendees. Club SOBO sends its own transactional confirmations and may provide an ICS or add-to-calendar action instead.
Club SOBO does not store full payment card numbers.
Club SOBO does not require precise device location to show the weather feature or the business-discovery map. Weather requests use a fixed Southbourne location, and business map pins are based on business-supplied or admin-adjusted business location data.
Some app or website features may ask for optional device permissions, such as camera access for scanning or notification permission for push messages.
If you open an external booking, ordering, map, website, social, email, phone, or payment link from Club SOBO, the destination provider may process your data under its own terms and privacy notice. Club SOBO records the external-link click but does not describe it as a completed Club SOBO booking.

6) Purposes and lawful bases

Contract: creating and running accounts, authenticating users, showing member offers, operating internal booking requests and appointment communications, operating QR and loyalty features, processing redemptions, enabling business tools, managing staff permissions, recording legal acceptance, operating legacy sales-representative access where enabled, providing support, and forming, confirming and delivering paid Highlight services.
Legitimate interests: applying high-privacy age-appropriate access controls, protecting younger users, meeting app-platform safety rules, preventing false adult access, platform security, fraud prevention, double-booking and duplicate-redemption prevention, calendar and provider reconciliation, live-offer and validity-window checks, staff invitations and permission-window checks, moderation, audit logging, service reliability, first-party analytics needed to operate and improve Club SOBO, business performance reporting, historic referral or commission reconciliation, social-content rights and takedown evidence, dispute handling, and controlled operational communications. Club SOBO considers these interests against user rights, with particular care for children.
Legal obligation: tax, accounting, financial record keeping, rights requests, regulatory requests, court orders, law-enforcement requests, and compliance records.
Consent where required: non-essential cookies or similar storage, optional direct marketing, and other processing where UK law requires consent. Promotional email uses channel-specific consent unless every PECR soft-opt-in condition is met; free account registration alone is not treated as a sale for that exception. Promotional push requires an explicit in-app opt-in and an in-app opt-out. Camera and operating-system notification permissions are technical device controls, not automatically UK GDPR or marketing consent; the underlying scanning, security, delivery, or marketing purpose uses the lawful basis described here. Known 13–17 accounts are excluded from promotional email and push as a Club SOBO product safeguard.
Some personal data is required to create and run an account, manage a business or staff role, process a paid route, or handle a support or rights request. If you do not provide it, Club SOBO may be unable to provide the relevant service.

7) Sharing, processors, and participating businesses

Club SOBO shares personal data only where needed with hosting, database, authentication, website, email, push, payment, entitlement, app-store, analytics, mapping, weather, security, and support providers.
The current service uses Supabase for database, authentication, storage and Vault; WordPress and Club SOBO's website host; Brevo for configured email delivery; Expo, Apple Push Notification service and Firebase Cloud Messaging for push delivery; Google Calendar; Apple WeatherKit; and Apple and Google Play for app distribution, platform age results and in-app purchases. Stripe is used only if a stated eligible payment route is shown. Mapping or geocoding helpers may process business-supplied locations where that feature is enabled. Club SOBO uses its own operational analytics rather than disclosing identifiable activity to an advertising analytics provider.
When a business chooses to connect Google Calendar, Google processes the OAuth connection and calendar requests under Google's own terms and privacy notice. The approved scopes can technically allow Club SOBO to list calendars, read free/busy information, and view and edit events on the connected account's calendars. Club SOBO's actual use is narrower: selected-calendar availability and creating, updating, reconciling, or deleting Club SOBO booking events.
Club SOBO applies the Google Workspace API User Data and Developer Policy, including its Limited Use requirements, to its use and transfer of Google data. Club SOBO does not use Google Calendar data for advertising, sell it, or allow routine human reading. It transfers that data only where necessary to provide or improve the visible Calendar feature with the user's affirmative consent, for security, to comply with law, or as part of an acquisition, merger or asset sale after obtaining the explicit prior consent Google requires.
For connected calendars, Club SOBO sends Google only the data needed to check free/busy state and create, update, reconcile, or delete the private Club SOBO event. A Club SOBO event may include the offer title, member first name, opaque booking reference, appointment time, and a secure booking link.
Apple WeatherKit weather data is used for the fixed Southbourne weather summary and must be shown with Apple Weather attribution where required.
Participating businesses receive only the minimum operational data needed for booking approval, appointment fulfilment, individual-offer redemption, scanner use, loyalty support, fraud review, moderation, or dispute handling. For an internal booking, authorised booking users receive the member first name, optional private note, booking reference, offer, resource, appointment time and status. The business booking projection does not include the member's email address or Club SOBO user identifier.
Business admins may see staff account, permission, scan, loyalty, and performance information for their own business where needed to manage the business relationship with Club SOBO.
Business social media content, business profiles, offers, events, logos, images, captions, and related marketing content may be published on Club SOBO's public website, app, emails, social channels, or promotional materials where allowed by the terms, the business's permission, platform rules, and applicable law.
Legacy sales representatives may see their own referral or attribution code, account status, aggregate referred-member counts, and commission or attribution figures where enabled. They do not receive identifiable member lists by default.
Club SOBO may share data with professional advisers, regulators, courts, law-enforcement bodies, payment providers, or other authorities where legally required or where needed to establish, exercise, or defend legal rights.
Club SOBO does not share identifiable member, staff, or business contact data for third-party marketing.

8) Analytics and reporting

Club SOBO may create first-party analytics about local activity, booking opened, availability viewed, booking requested, accepted, declined, cancelled, no-show and redeemed events, individual-offer redemption performance, offer performance, redemption trends, category demand, visit patterns, advertising performance, loyalty activity, fraud signals, event views, and external-link clicks.
A business may receive aggregate views and external-link clicks for its own business-authored events. Club SOBO does not expose the viewing member's identity in those event statistics.
Club SOBO uses analytics for service operation, fraud prevention, internal reporting, participating-business dashboards, support, service improvement, content reporting, and role-scoped sales-representative reporting where retained or enabled.
Business dashboards and sales-representative analytics are access-controlled and should use aggregate, anonymised, or minimum-necessary data where practical.
Aggregated or anonymised statistics may be published or shared in community or service-reporting contexts only where individuals are not identifiable.
Pseudonymised data can still be personal data. Club SOBO will not treat data as anonymous unless re-identification risk has been assessed and reduced to a level where individuals are not reasonably identifiable.

9) International transfers and retention

The providers above and their subprocessors may process data in the UK, European Economic Area, United States, and other countries in which they operate. For a restricted transfer outside the UK, Club SOBO relies as applicable on UK adequacy regulations, including an applicable UK extension or data bridge, or an approved UK International Data Transfer Agreement/Addendum supported by the required transfer assessment. Contact hello@clubsobo.co.uk to ask about the safeguard used for a particular transfer or for an available copy.
Club SOBO's current retention targets are set out below. They may be shortened when data is no longer needed or extended only for a documented legal hold, accounting duty, complaint, safety matter, dispute, fraud investigation, or legal claim. The operational retention schedule and deletion evidence remain under review.
Account, access, security, and support records are kept during the life of the account and targeted for deletion or anonymisation within 24 months after closure where needed for fraud prevention, disputes, service integrity, or support history.
Mobile sign-in session tokens may be stored in the device secure store for up to 60 days unless the user logs out, deletes the account, or the session is revoked earlier.
Loyalty, redemption, scanner, moderation, staff-permission, and anti-fraud records are typically kept for up to 24 months, or longer where an investigation, dispute, legal hold, or audit need applies.
Internal booking identity, status, immutable offer/configuration snapshots, reminder, provider-operation, redemption-linkage, and dispute records are targeted for deletion or anonymisation within 24 months after the appointment or account closure where needed for fulfilment, fraud prevention, audit, support, analytics, or legal claims. The optional private note is excluded from analytics and is cleared 30 days after the earlier of the appointment end or cancellation. A documented legal hold pauses that clearing; the booking and audit history remain under the applicable periods above. Minimum non-note booking and redemption evidence may be preserved where necessary.
Google OAuth credentials are encrypted at rest in Supabase Vault while the calendar remains connected. On disconnect, Club SOBO first finishes cleanup of Club SOBO-created events. It revokes the Google grant only when this is the last active Club SOBO connection for that Google account; where another active connection shares the grant, it deletes only the disconnecting connection's local encrypted credential. A transient revocation failure leaves the encrypted credential in place for a restricted retry rather than deleting it prematurely. Once revocation is completed, safely skipped for a shared grant, or confirmed unnecessary, Club SOBO deletes the local credential and clears the connection fields. The owner can also revoke Club SOBO access in Google Account settings.
Existing booking, provider-operation, audit, and event-linkage records may remain after Calendar disconnection for appointment fulfilment, disputes, security, analytics, legal claims, and the retention periods described above.
Legacy sales-representative invite, referral, attribution, commission, status, and audit records are kept while needed for access management, reconciliation, disputes, legal claims, accounting, or audit. Operational records are typically kept for up to 24 months after closure, while financial or contract records may be kept for up to 6 years where required.
Social-content permission, source, publication, label, takedown, removal, and dispute records are typically kept for up to 24 months after the relevant campaign, removal, or account closure, or longer where needed for legal claims, rights disputes, takedown evidence, audit, or compliance.
Financial, billing, Event Highlight checkout consent and confirmation, cancellation, refund, tax, placement, and accounting records may be kept for up to 6 years where required. Event interaction aggregates and the underlying security audit evidence follow the applicable analytics, fraud, support, and audit retention periods above.
Audit logs, legal acceptance records, rights-request records, and security records may be kept for as long as needed to evidence compliance, enforce terms, investigate abuse, or meet legal duties.
Cookie and consent records are kept for as long as needed to evidence preferences and compliance.

10) Your rights and choices

You may request access, rectification, erasure, restriction, portability, and objection where applicable.
Right to object: you can object to processing based on legitimate interests, including certain analytics, profiling, operational communications, or fraud-prevention processing. Club SOBO will stop unless it has compelling legitimate grounds or needs the data for legal claims. Direct marketing objections will be honoured.
Members can ask Club SOBO to correct an age declaration. A teen-to-adult change requires a supported platform recheck confirming 18+ or a controlled support decision with appropriate evidence.
Where Club SOBO relies on consent, you may withdraw consent at any time for future processing, including non-essential cookies, optional marketing, or optional device permissions.
You can manage in-app notification preferences where available. Marketing preferences, business-to-business objections, and unsubscribe requests apply to optional marketing or non-essential promotional messages. Transactional, security, moderation, fraud, account-status, legal, payment, staff-permission, or service messages may still be sent where needed to run the service or comply with the law.
Member account deletion is initiated in the Club SOBO app from Settings. If you cannot access the app, use Privacy choices for the current guidance and support route. Deleting the app alone does not delete the account.
Business account closure, calendar disconnection, staff-access removal, and legacy sales-representative access changes can be requested through business support, the relevant business admin flow, or Club SOBO support as applicable, subject to appointment fulfilment, legal, audit, fraud-prevention, and accounting retention.
A business owner can disconnect Google Calendar in Club SOBO booking setup and can separately revoke Club SOBO access in Google Account settings. Either route stops future Club SOBO access until the business reconnects.
General UK GDPR rights requests can be submitted at Data Rights Request or by email to hello@clubsobo.co.uk.
You can make a data-protection complaint through Data Rights Request or hello@clubsobo.co.uk. Club SOBO will acknowledge it within 30 days, investigate it without undue delay, keep you appropriately informed, and tell you the outcome. You can also complain to the ICO: ico.org.uk/make-a-complaint.

11) Automated checks, cookies, and security

Club SOBO uses automated anti-abuse and risk checks to detect suspicious sign-in, booking, calendar-provider, scanning, redemption, loyalty, account, staff, sales-representative, offer, highlight, payment, and business activity.
Known 13–17 members are excluded from promotional email and push before messages are queued. Necessary account, security, booking, loyalty, report, moderation, and legal messages remain available. Club SOBO does not provide teen audience labels to businesses.
These checks may automatically refuse an individual request, disable a QR session, apply a temporary feature restriction, or send activity to a review queue. When the separately controlled minimum-age enforcement is active, a supported platform result confirming an age range below 13 also automatically hard-blocks the account and revokes sessions because Club SOBO accounts are 13+. You can ask hello@clubsobo.co.uk for human review and correction of that result or another restriction. Apart from this disclosed minimum-age rule, Club SOBO does not currently make solely automated decisions that produce legal or similarly significant effects.
Club SOBO websites and app features may use cookies, local storage, secure device storage, or similar technologies for essential functions, security, preferences, analytics, legal acceptance, and service improvement. Non-essential cookies, SDK identifiers, scripts, pixels, or similar technologies are not activated before consent unless a specific PECR exception applies.
See the Club SOBO Cookie Policy for more detail on website cookies.
Security measures include access controls, role checks, encryption in transit, session controls, audit logging, rate limiting, outbound-service budget guards, fraud monitoring, and restricted admin access.

12) Contact and related pages

Email: hello@clubsobo.co.uk

Terms & Conditions | Cookie Policy | Data Rights Request | Privacy choices

This policy is versioned so the app, website, email links, store disclosures, Google OAuth disclosures, and legal-acceptance records can stay aligned to the same current Club SOBO privacy notice.