Privacy notice

Trip Caddie is operated by LuxVibeWeb Limited, trading as Trip Caddie. Private company limited by shares, registered in England and Wales.

We are the data controller for everything described here. That includes data about people on a trip, not only account holders, because we decide what the service records, we send reminder emails on our own schedule, and we run our own referral programme. Those are decisions we make, not instructions we follow.

If you organise trips for a club, society or business rather than for friends, you are likely to be a controller for your own group's data as well. That means the organiser answers to their members for how they use the trip, and we answer for the platform. See organisers.

We do not collect your IP address, device type, browser or screen size, and we run no advertising or third-party tracking scripts. There are none in the code.

A trip has an optional dietary notes field. Free text about food is capable of revealing health information, such as an allergy or coeliac disease, and religious belief, such as halal or kosher. UK GDPR treats both as special category data, which needs a specific condition on top of an ordinary lawful basis.

You never have to fill the dietary field in. If you have already, clear it from your private trip link and it is gone. If you would rather the organiser knew by another route entirely, tell them directly and leave the field empty.

Organisers: the notes field in your address book is not the place for somebody's allergies. Ask them to enter it themselves on the trip, where they are the one deciding to share it.

We do not sell personal data and we do not share it for advertising. These are the services that process it for us, and precisely what each one sees.

Other people on your trip also see your data. The organiser sees everything on your record. Other players see your name, team, handicap and scores. Your email, mobile and dietary notes are shown to organisers, not to the rest of the group.

We will disclose data if we are legally required to, and we will tell you unless we are prohibited from doing so.

Some of the services above operate outside the UK, so your data is transferred there. The safeguard we rely on is the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Addendum where the provider offers it.

[TO CONFIRM: confirm the transfer mechanism actually in place with each provider named above]

Write to privacy@luxvibeweb.co.uk and we will respond within one month. There is no charge. We may ask you to confirm who you are, but only enough to be sure we are not handing your data to somebody else.

What is held about you

Your name, and whichever of these the organiser filled in: email, mobile, handicap, which team you are on, where you travel from, room preference, dietary notes, whether you have said yes, and what you have paid. Plus your scores if the trip is being scored.

What the organiser can see

All of it, including your email, mobile and dietary notes. They can also see when you last opened your private link. They cannot see anything about your device, your location, or any other trip you are on.

What other players can see

Your name, team, handicap, scores and whether you are coming. Not your email, mobile or dietary notes.

What you can do

• Correct your own details. Open your private link and edit them. You do not need an account and you do not need to ask the organiser.
• Say no to the trip. Decline from your link and the reminders stop.
• Get your details removed. Email privacy@luxvibeweb.co.uk with the trip name. We will remove your record and we will not tell the organiser it was you who asked, unless removing you from a trip they run makes that obvious, which it usually will. If you would rather they did not know, say so and we will tell you what we can do.
• Object to us emailing you. Tell us and we will stop, for that trip or for good.
• Ask what we hold. Same address, and we will send it.

Removing your record from a trip deletes your details. It does not delete the payment history the organiser recorded against you, because that is their financial record of money they handled, and deleting it would leave their books wrong. Tell us if that is a problem for you and we will look at it case by case.

When you type somebody else's details in, you are responsible for having a reason to hold them. In practice that means telling your group that you use Trip Caddie, and not entering things they have not agreed to share, particularly anything about their health.

If you organise as a private individual for friends, UK GDPR mostly does not apply to you, because of the exemption for purely personal or household activity.

If you organise for a club, society, employer or as a business, that exemption almost certainly does not cover you. You would be a controller in your own right, with your own obligations to your members, and you would need your own privacy notice. We cannot give you legal advice on this and you should take your own.

Everything we send relates to a trip you are on: your invite, a reminder if you have not replied, a reminder if a payment is due, and the results once the trip finishes. Organisers also get a summary of who has paid and occasional prompts about a trip they have not finished setting up.

We send no newsletters, no product marketing and no promotional email to anybody.

Your invite link contains a long random token. Anybody holding that link can see the trip and edit your record, which is what makes it work without a password. Treat it like a key:

• Do not post it in a public group, on social media or anywhere it could be indexed.
• It is fine to keep it in your own messages, which is where it arrived.
• If you think it has gone astray, ask the organiser to reset your link. The old one stops working straight away.
• The token is never written into our usage records and is never sent to any third party.

A trip can also have a group password on top of the links. Organisers should share that separately from the link, not in the same message.

Two pages show a trip without anybody signing in. This is deliberate, because the whole point is that players do not need an account, but it is worth understanding exactly how open it is.

The link is the control. Anyone who has it can look, and anyone can pass it on. That is how a link works, and it is why we ask organisers not to post one publicly.

What is actually in place:

• Sign-in is handled by the platform, not by us. We never see or store your password.
• Trip data is readable only by people on that trip: an account with access, or somebody holding a valid private link.
• Private links use a random 32-character token that is checked on the server every time, never in the browser.
• A trip can have a group password on top of the private links. It is stored as a salted hash, never in plain text.
• Withdrawing somebody from a trip clears their token, so their old link stops working.
• Anything that can hand out access, change money records or send email runs on the server, where the browser cannot reach it.
• Traffic to the site uses HTTPS.

What we do not claim

Plenty of privacy notices imply more than is true. To be straight with you:

• We hold no security certification. We are not ISO 27001 certified and have not completed a SOC 2 audit.
• We have not had an independent penetration test.
• We do not encrypt individual database fields beyond what the platform provides at rest and in transit.
• Images you upload are served from public URLs. Anyone given the URL can open the image without signing in.

Trip Caddie is for people aged 16 and over. We do not ask your age and we have no way to check it, so this is a condition of use rather than something the site enforces. We do not knowingly hold data about children.

An organiser can add anyone to a trip, including someone under 16. If you are a parent or guardian and your child's details are on a trip, email privacy@luxvibeweb.co.uk and we will remove them.

We store a small number of things in your browser, and one of them needs your permission. The cookies and storage page lists every key by name and is also where you change your choice.

Please raise it with us first at privacy@luxvibeweb.co.uk. If we do not sort it out, you can complain to the Information Commissioner's Office, who regulate this in the UK.

Complaining to the ICO does not cost anything and you do not need to go through us first, though it usually gets sorted faster if you do.

If we start doing something this notice does not cover, we will update it and change the date at the top. If the change affects something you consented to, we will ask you again rather than assume the old answer still applies.