YOUNGS PARK
Privacy policy
What we do with the details you give us when you enquire about hiring a facility, make a booking, or hold an account with us.
Version 1.0 · Last updated 13 September 2026
1.Who we are
Aylsham Community Sports Ltd is the data controller for the information described in this policy. We are registered in England and Wales, company number 08858705, at Youngs Park, Woodgate Way, Aylsham, Norwich, Norfolk, NR11 6FJ.
For anything about this policy or about your own information, email bookings@youngspark.co.uk or telephone 01263 674008. Data protection enquiries are handled by the directors of Aylsham Community Sports Ltd.
2.What this policy covers
This policy covers the Youngs Park website, the facility hire enquiry form, hirer accounts, and the bookings, quotes and invoices that follow from them.
It does not cover Aylsham Football Club playing membership, which the club handles separately, or any other website we link to.
3.Information we collect
From the enquiry form, and from bookings made by email or telephone:
- Your name, email address and telephone number.
- Whether you are booking as an individual, a club or group, or a business — and the organisation’s name where it is not personal.
- What the booking is for, the facility and size you want, the dates, times and length, and any dates to skip.
- How many people you expect, where you are booking the function room.
- The extras you ask about, and the answers you give — the time you would like the bar open, the catering chosen, and so on.
- Anything you type into a free-text box, including the message at the end of the form.
- Your billing address, where an invoice is raised.
- Public liability insurance details and risk assessments, where the booking requires them.
Where you have an account, we also hold:
- Your email address and a hashed password. We never store the password itself.
- The bookings, quotes, invoices and messages on your record.
- When you last signed in.
Our web server keeps ordinary request logs, which include IP addresses. Payments are handled by Stripe; we hold the invoice and payment records, not your card details, which never reach us.
CCTV operates across the site, including the pitches, the pavilion and the car park.
4.How we collect it
- Directly from you — the enquiry form, email, telephone, or in person at the club.
- Automatically — server logs and the strictly necessary cookies described in section 12.
- From an organisation you belong to, where a club or company books on your behalf or is billed for your booking.
We do not use social sign-in, so no information reaches us from Google, Facebook, Apple or any similar provider.
5.Why we use it, and our lawful basis
| WHAT FOR | LAWFUL BASIS |
|---|---|
| Answering an enquiry and preparing a quote | Steps taken at your request before entering a contract |
| Managing a confirmed booking and taking payment | Performance of a contract |
| Invoices, VAT and accounting records | Legal obligation |
| Checking insurance and risk assessments before confirming | Legitimate interests — running the site safely |
| Safeguarding and accident records | Legal obligation, and vital interests |
| CCTV, and the security of the site | Legitimate interests — protecting people and property |
| Answering a complaint or defending a claim | Legitimate interests |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights, and you can object at any time — see section 11.
6.Marketing
We do not currently send marketing. The emails you receive from us are about your own enquiry or booking: an acknowledgement, a quote, a confirmation, an invoice, a reply to a message you sent, or a request for feedback after your booking.
If that changes we will ask for your consent first, and every marketing message will carry a way to stop receiving them. Unsubscribing never affects the emails about your bookings, which we have to send.
8.Transfers outside the UK
Our database is hosted in Ireland, within the European Economic Area, which the UK recognises as providing an adequate level of protection.
Some of our providers are based in the United States and may process information there. Where that happens the transfer is covered by the UK extension to the EU–US Data Privacy Framework, or by the International Data Transfer Addendum to the standard contractual clauses.
9.How long we keep it
| RECORD | KEPT FOR |
|---|---|
| An enquiry that did not become a booking | 12 months |
| Booking and hire records | 6 years after the last session |
| Invoices and accounting records | 6 years after the end of the accounting period |
| Account records after an account is closed | 12 months after the account is closed |
| Accident and safeguarding records | Longer than the records above. We are confirming the exact period with our insurer and county FA. |
| CCTV footage | 30 days |
| Server logs | 30 days |
The six years for accounting records is set by HMRC. Where a record is held under more than one of these headings, the longest period applies — a booking that was invoiced is kept for the six years, not the twelve months.
10.How we keep it safe
- Access to the booking system is limited to club staff and volunteers who need it, and each has their own account with permissions matched to their role.
- The site is served over HTTPS, so information is encrypted in transit.
- Passwords are stored hashed, never as text, and cannot be read by us.
- The database is backed up by our hosting provider.
If there is a breach that is likely to put your rights at risk, we will tell the Information Commissioner’s Office within 72 hours of becoming aware of it, and tell you where the risk to you is high.
11.Your rights
Under UK data protection law you can ask us to:
- Give you a copy of the information we hold about you.
- Correct anything that is wrong or incomplete.
- Delete information we no longer have a reason to keep.
- Restrict what we do with it while a question about it is resolved.
- Give you, or another provider, a portable copy of information you gave us.
- Stop processing based on legitimate interests, where your rights outweigh our reason.
- Withdraw consent, where we relied on it.
To exercise any of these, email bookings@youngspark.co.uk. We may ask you to confirm who you are before we act, so information is not disclosed to the wrong person. We will respond within one month, and there is no charge in ordinary circumstances.
13.Children and young people
Accounts and bookings are for adults. We do not knowingly collect information directly from children through this website.
Bookings frequently involve under-18s as players and guests. In those cases the hirer gives us numbers rather than names, and it is the hirer who is responsible for supervision and for any consents needed from parents or carers. Where we do hold information about a young person — usually because of an accident or a safeguarding concern — it is handled under the same rules as everything else in this policy, with access limited to those who need it.
14.CCTV
Cameras operate across the site, including the pitches, the pavilion and the car park. Footage is recorded to protect people and property and to help resolve incidents.
Requests for footage are handled in line with government guidance. Footage is released only where we are required to release it, or where doing so is necessary and proportionate — usually to the police or an insurer.
Footage is kept for 30 days and then overwritten, unless it has been retained for a specific incident. It can be viewed by the directors of Aylsham Community Sports Ltd and by staff they authorise. Signs on site tell visitors that cameras are in use.
15.Automated decisions
We do not make decisions about you by automated means alone, and we do not profile you. A quote is produced by our system from the rates that apply, but whether a booking is accepted is always decided by a person.
16.Changes to this policy
The version and date at the top of this page tell you which version you are reading. Where we make a significant change we will say so on this page, and tell hirers with a live booking directly.
17.Complaints
If you are unhappy with how we have handled your information, tell us first — email bookings@youngspark.co.uk and we will look into it.
You also have the right to complain to the Information Commissioner’s Office at any time. The ICO is at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; the helpline is 0303 123 1113, and ico.org.uk has an online form.