Privacy Policy for TeeBox
This privacy policy explains how we handle personal data when you use TeeBox, in the app or at teebox.no.
1. Data controller
TeeBox is provided by two companies in the same group, and which of them is the data controller depends on what the data concerns.
LetsGolf AS, company registration number 937 863 586, is the data controller for the app and the website, meaning your account, bookings, payments and customer relationship.
TeeBox AS, company registration number 937 844 077, is the data controller for the operation of the centre, including video surveillance on the premises.
Both companies are located at Austfjordvegen 2706, N-5981 Masfjordnes, Norway, and can be reached at letsgolf@teebox.no or +47 922 61 688.
2. What personal data we process
Account details: your name, email address and phone number, which you provide when registering, and a user identifier that links the data to your account.
Bookings and purchases: which time slots you have booked, at which centre, amounts, the payment reference from Vipps or Stripe, the status of the booking, and any purchases you make of value cards, memberships and items from the kiosk.
Membership: type of membership, start date, validity, payment method and the agreement identifier held by the payment provider.
Name from the payment provider: when you pay by Vipps or card, we receive the name registered to the payment method. We use it to link the payment to the right customer.
Use of the centre: which centres you have checked in at, the time of your most recent visit, and a log of when the door has been opened using your account. The log is used for troubleshooting and to document incidents.
Help requests: if you ask for help through the app while at the centre, we store which booking it concerned, the reason you selected, and any text you wrote yourself. Your name and phone number are sent to us with the alert, but are not stored alongside it.
Settings: your language preference, whether you have opted out of marketing, and which terms you have accepted.
Notifications: a technical identifier for your device, so that we can send you notifications in the app, and whether you have allowed such notifications.
Exclusion: if you are banned from the centre, we record that it has happened, when, by whom, and the reason.
Video recordings from the centre, see section 8.
We do not use analytics tools or tracking technology.
3. Purposes and legal basis
To deliver the service, meaning creating your account, processing bookings and payments, giving you access to the centre and showing your bookings under "My sessions", we process your data in order to perform our contract with you, Article 6(1)(b) of the General Data Protection Regulation (GDPR).
To comply with legal obligations, in particular accounting and bookkeeping requirements, we process payment data, Article 6(1)(c).
To send you messages about your own bookings and purchases, such as confirmations, we process your data as part of delivering the service.
For marketing our own similar services to you as a customer, in the app or by email, we rely on section 15, third paragraph, of the Norwegian Marketing Control Act (markedsføringsloven). You may opt out at any time, see section 7.
For the security and operation of the service and the centre, including video surveillance and the door access log, we rely on our legitimate interest, Article 6(1)(f).
For displaying the longest drive on the information screen at the centre, we rely on your consent, Article 6(1)(a), see section 9.
4. Who we share data with
We share personal data only with those we need in order to deliver the service:
Google (Firebase), which provides sign-in, database and hosting on our behalf. Google is our data processor.
Vipps MobilePay, which processes payments made by Vipps. Vipps is itself a data controller for its part of the payment.
Stripe, which processes card payments. Stripe is itself a data controller for its part of the payment. We never store your card number, it is handled entirely by Stripe.
Twilio, which sends the one time code by SMS when you verify your phone number. Twilio is our data processor.
Some of these may process data outside the EU and the EEA. In those cases we ensure the transfer has a lawful basis, for example the EU Standard Contractual Clauses (SCC). We never sell personal data.
5. How long we keep your data
Your account details are stored for as long as you have an account with us. You may ask us to delete your account at any time, see section 6.
Accounting records, such as payment data relating to sales, are kept for as long as we are required to keep them under the Norwegian Bookkeeping Act (bokføringsloven). The current retention period for such records is five years after the end of the financial year. If you ask us to delete your account, we remove your name from these records, so that the amount and date remain without being linked to you.
The door access log is deleted after 90 days.
Video recordings are deleted after 12 days, see section 8.
Longest drive entries are deleted after 13 months, see section 9.
Help requests are deleted after 12 months.
6. Your rights
You have the right to access your own data, and to ask for it to be corrected or deleted. You may also request restriction of processing, request a copy of your data (data portability), and object to processing.
You can request deletion of your account directly in the app, under "Profile". We handle such requests within 30 days. If you have an ongoing membership, a future booking or a value card with a remaining balance, these must be ended or used up first, and we will contact you about it.
When your account is deleted, we remove your name from purchases and bookings that we are required to keep under the Norwegian Bookkeeping Act, so that the amount and date remain without being linked to you.
You may also contact us at letsgolf@teebox.no and we will assist you.
If you believe we are processing your data unlawfully, you may lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet). See datatilsynet.no.
7. Marketing and opting out
If you are a customer of ours, we may send you offers for our own services similar to those your customer relationship is based on. Such offers may arrive as a notification in the app or by email.
You may opt out of marketing at any time by turning on "No marketing" under "Profile" in the app. Opting out applies to both channels. If you have opted out, we will not send you marketing.
Opting out does not affect messages about your own bookings and purchases, such as confirmations and reminders. You will receive those regardless, because they are part of the service you have paid for.
8. Video surveillance at the centre
The centre is under video surveillance. The surveillance is operated by TeeBox AS.
The purpose is to safeguard those who use the centre, to prevent vandalism and theft, and to be able to document incidents. Because the centre is unstaffed, video recordings are the only way we can follow up on an incident afterwards.
The legal basis is legitimate interest, Article 6(1)(f) of the GDPR. We have assessed that the need for safety and documentation in an unstaffed facility outweighs the limited intrusion that surveillance of the common areas entails.
Recordings are kept for up to 12 days and are then deleted automatically. The retention period is set so that an incident occurring during a period without visitors still has time to be discovered and followed up. Recordings are stored locally on the centre's recording equipment, in a locked server room adjacent to the premises, and are not transferred to any cloud service.
Only the centre's management has access to recordings. Recordings are reviewed only when a specific incident has occurred, for example damage to equipment, theft or a safety situation. Recordings are not disclosed to others, with the exception of the police in the event of a criminal complaint.
You have the right to access recordings of yourself. Contact us at letsgolf@teebox.no and state the date and approximate time, so that we can locate the right material within the retention period.
The cameras have two way audio. This means we can hear what is said on the premises and speak to you through the loudspeaker, for example when you have asked for help through the app, or in a safety situation. Audio recording is normally switched off, and is enabled only in specific situations where it is necessary in order to handle an incident. If audio is recorded, it forms part of the recording and is deleted along with it after 12 days.
9. Longest drive
On the information screen at the centre we display the longest registered drive of the week and of the year, along with the name of the person who hit it. The yearly listing covers the last 365 days.
Entries are submitted by you, using the form at teebox.no/lengste. Submitting is entirely voluntary, and the legal basis is your consent.
You may withdraw your consent at any time and ask to be removed from the listing by contacting us at letsgolf@teebox.no. Entries are deleted 13 months after submission in any case.
10. Cookies
We do not use cookies for analytics or tracking. The website uses only such cookies as are necessary for sign-in and for the service to function.
11. Changes
We may update this privacy policy. The version that applies at any time is the one available in the app and at teebox.no.
12. Contact
If you have questions about how we handle personal data, contact us at letsgolf@teebox.no or +47 922 61 688.
This translation
This is a translation provided for convenience. In the event of any discrepancy, the Norwegian version prevails.