Privacy Policy
Stoke Park Limited
This Policy was last updated on 17th June 2026
Contents
- Introduction
- What is Personal Information?
- The Information We Collect on Our Website
- Lawful Bases (legal grounds) for Processing Personal Information
- How We Use Your Information
- Who We Might Share Your Information With
- Transfers of Your Personal Information Outside the UK
- How We Keep You Updated on Our Business, Products and Services
- Your Rights Over Your Information
- How Long We Keep Your Information For
- Security
- Social Media
- Artificial intelligence
- CCTV
- Wi-Fi
- Attending an Event of Ours
- Data Protection Complaints
1. Introduction
Stoke Park Limited is registered in England & Wales with company number 02732069. We are committed to protecting the privacy and security of your personal information. We take care to protect the privacy of our customers and users of our products and services that communicate with us.
We have therefore developed this privacy policy to inform you of the data we collect, what we do with your information, what we do to keep it secure as well as the rights and choices you have over your personal information.
We have appointed a Data Protection Officer (DPO). If you wish to contact our DPO you can do so via DPO@stokepark.com.
This Privacy Notice applies to all our data subjects (an individual about whom we hold personal information) except Job Applicants/Candidates and our employees.
2. What is Personal Information?
Personal information (or personal data) is anything that enables you to be identified or identifiable. We collectively refer to handling, collecting, protecting, storing or otherwise using your personal information as ‘processing’.
3. The Information We Collect on Our Website
We collect, process and store personal data in accordance with the UK and EU General Data Protection Regulations (UK and EU GDPRs) and all other applicable data protection laws and regulations.
Most of the personal information we process is provided to us directly by you, for example for one or more of the following reasons:
- You have made an enquiry or information request to us
- You have ordered a service from us
- You play golf at, stay at, or otherwise visit, Stoke Park
- You have applied for one of our Corinthian Packages
- You have requested to attend or have attended our events e.g. fireworks
- You have subscribed to our e-newsletter(s)
- You have visited our website and consented to our use of cookies or similar technologies
- You have provided a business card or other contact information
We may also obtain your personal information indirectly, such as from:
- Public registers/records
- Websites
- Social media
- Using CCTV or other monitoring devices
- When your contact details are given to us as a referee or for use in an emergency
If you contact us, we may keep a record of that correspondence, adding your information and enquiry details to our CRM system.
The data that we collect includes details of your journey through the Stoke Park Limited website, as well as device-specific information such as IP address, mobile device, browser version, operating system, mobile network, device settings and geographical data. The type of information that we will collect on you, and you voluntarily provide to us on this website includes:
- Your full name
- Your address
- The name of your company
- Your telephone number(s)
- Your Email address
- Your IP address at the time
- The time and date of when you submitted information
- A record of any consent you may have provided, e.g. to receive our marketing communications
We may, in further dealings with you, extend this information to include your purchases, services used, and subscriptions, records of conversations and agreements and payment transactions, as relevant.
You are under no statutory or contractual requirement or obligation to provide us with your personal information; however, we may require at least the information above in order for us to deal with you as a user in an efficient and effective manner.
4. Lawful Bases (legal grounds) for Processing Personal Information
Our legal basis for collecting and using your personal information will depend on the personal information concerned and the specific context in which we collect it.
We will normally collect personal data from you on one or more of the following lawful bases:
- Consent: We may process your personal information after you have consented (agreed) to us doing so. Your consent may have been obtained by us, or by third parties on our behalf. You have the right to withdraw your consent at any time.
- Contract: We may process your personal information when we need to deliver a contractual service to you or because you have asked us to do something before entering into a contract (e.g. provide a quote).
- Legal obligation: We may process your personal information when we need to comply with a legal obligation.
- Legitimate interest: We may process your personal information when we need to for our or another’s legitimate interests, where these interests are not overridden by your rights.
5. How We Use Your Information
We have set out below a description of all the ways we plan to use your personal information, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.
Please note that we may process your personal information for more than one lawful basis depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal basis we are relying on to process your personal information where more than one has been set out in the table below.
| Purpose/Activity | Type of data | Lawful basis for processing |
| To register a new client/customer | Contact Identity | Contract |
| To process and deliver an order or request | Contact Identity Financial Transaction Marketing and Communications | Contract Legitimate interest (to recover debts due to us and to protect our business and your account from fraud and other illegal activities) |
| To manage our customer and business relationships | Contact Identity Marketing and Communications | Contract Legal obligation Legitimate interest (to keep our records updated and to study how customers and business contacts and partners use our products/goods/services) |
| To provide marketing materials | Contact Identity Usage Marketing and Communications | Consent Legitimate interest (to provide customers and contacts with information about our products/goods/services) |
| To administer and manage our website | Contact Identity Technical | Legitimate interest (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise) |
| To ensure you are able to attend an event. | Contact Identity Marketing and Communications | Consent Contract Legitimate interest (to promote and develop our products/goods/services and grow our business) |
| To develop our businesses and services | Contact Data Identity Data Financial Data Marketing and Communications Data Transaction Data Technical Data Usage Data | Legitimate interests (to develop our products/goods/services and grow our business) |
| For the safety and security of our staff, visitors and others. | Contact Data Identity Data | Legitimate interests (to protect and keep safe develop our staff, visitors and other individuals that we have a responsibility for) |
| For the safety of visitors utilising the gym | Health data | Explicit consent |
| To comply with our legal obligations | Contact Data Identity Data Financial Data Marketing and Communications Data Transaction Data Technical Data Usage Data | Legal obligation |
6. Who We Might Share Your Information With
We may share your personal data with other organisations in the following circumstances:
- If the law or a public authority says we must share the personal data;
- If we need to share personal data in order to establish, exercise or defend our legal rights (this includes providing personal data to others for the purposes of preventing fraud and reducing credit risk); or
- From time to time, employ the services of other parties for dealing with certain processes necessary for the operation of the Website.
It is our policy to share your personal information with third parties that are legally or contractually bound to protect your personal information to the same standards as we are, and that will flow those same standards to their subcontractors.
In any scenario, we’ll satisfy ourselves that we have a lawful basis on which to share your personal information.
We will not sell your personal information to any third party.
Third-Party Data Processors
We use the following third-party services to operate our website and marketing communications. Each acts as a data processor on our behalf and is bound by appropriate data processing agreements:
- Reliance Industries Limited (RIL) – RIL host and manage our website.
- GoHighLevel / LeadConnectorHQ — our CRM and email marketing platform. Personal data submitted via our website forms is securely transmitted to GoHighLevel servers. GoHighLevel is certified under the EU-US Data Privacy Framework. See gohighlevel.com/privacy-policy for details.
- GolfManager — our online tee time booking platform. When you book a round online, your booking details and payment information are handled by GolfManager. See golfmanager.com/en/privacy for details.
- Google Tag Manager, Google Analytics & Google Ads — we use Google Tag Manager to deploy tracking tags on our website, including Google Analytics (anonymised website analytics) and Google Ads conversion tracking (to measure the effectiveness of our advertising campaigns). These services are provided by Google LLC. Data collected may be transferred to Google servers in the United States. Google is certified under the UK-US Data Bridge and participates in the EU-US Data Privacy Framework. See policies.google.com/privacy for details. Tracking tags only activate where you have given your consent via our cookie consent banner.
- Meta Pixel (Facebook Pixel) — we use the Meta Pixel to measure the effectiveness of our advertising on Facebook and Instagram, and to build audiences for retargeting campaigns. The pixel may collect information about your visit, including pages viewed and actions taken. This data is shared with Meta Platforms, Inc., which operates servers in the United States. Meta is certified under the UK-US Data Bridge and the EU-US Data Privacy Framework. See facebook.com/privacy/policy for details. The Meta Pixel only activates where you have given your consent via our cookie consent banner.
- Cloudflare — DNS management, content delivery and DDoS mitigation.
- Albatross – we use Albatross to enable our direct marketing activities and communications where you may have opted in to receive these (for more information about this please see 8. How We Keep You Updated on Our Business, Products and Services)
All personal information shared with third-party processors is subject to appropriate contractual protections and is only used for the purposes stated in this policy.
7. Transfers of Your Personal Information Outside the UK
Your personal information may be transferred (sent to or accessed from) outside the UK. Specifically via our use of data processors, RIL (website hosting and management), GoHighLevel (CRM and email marketing), Google (Analytics, Ads and Tag Manager) and Meta (Facebook Pixel). Any such transfer will be only:
- To a recipient located in a country which provides an adequate level of protection for your personal information (i.e. a country where the data protection standards are the same as or better than in the UK), for example a country in the European Union (EU), or European Economic Area (EEA); or
- To a recipient under a contractual agreement which satisfies UK legal requirements for the transfer of personal information, to ensure that appropriate safeguards are in place to protect your personal information in accordance with UK levels of data protection; or
- To a recipient under the UK-US Data Bridge to the EU-US Data Privacy Framework; or
- When your personal information has first been anonymised
The countries/areas to which we routinely transfer personal information are:
- USA: To recipients certified under the UK-US Data Bridge, which provides an adequate level of protection for your personal information
- India: To a recipient using appropriate safeguards (International Data Transfer Agreement or UK Addendum to EU Standard Contractual Clauses) and having carried out a Transfer Risk Assessment
8. How We Keep You Updated on Our Business, Products and Services
Email Marketing
From time to time we may send you relevant offers and news about our business, products and services by email, but only if you have consented to receive these marketing communications.
When interacting with our website, you may be asked if you'd like to sign-up to receive our email marketing communications and you will be asked explicitly to opt-in to receiving these.
You can change your Email Marketing subscription anytime by editing your preferences or unsubscribing altogether via the link at the bottom of any of our email marketing communications or by contacting us via the details at the end of this policy.
9. Your Rights Over Your Information
Right to Access Your Personal Information
You have the right to access the personal information that we hold about you by making a request. This is sometimes termed 'Subject Access Request'. This right always applies, though there are some exemptions which means you may not always receive all the information we process.
We may ask for proof of identity and sufficient information about your interactions with us that we can locate your personal information.
Right to Correction of Your Personal Data
If any of the personal information we hold about you is inaccurate or out of date, you may ask us to correct it. This right always applies.
Right to Restrict Processing
You have the right to ask us to restrict the processing of your information in certain circumstances.
Right to Erasure
You have the right to ask us to erase your personal information in certain circumstances.
Right to Object to Processing
You have the right to object to processing if we are able to process your information because the process is in our legitimate interests.
Right to Data Portability
This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated.
You are not required to pay any charge for exercising your rights. If you wish to exercise any of your rights please contact us, we have one month to respond to your request.
10. How Long We Keep Your Information For
We will retain your personal information only for as long as we need it for the purpose(s) for which it was collected, or as required to do so by law.
To determine the appropriate retention period for your personal information, we consider the amount, nature and sensitivity of it, the potential risk of harm from unauthorized disclosure of it, the purposes for which we process it and whether we can achieve those purposes through other means, as well as applicable legal requirements. Unless otherwise required by law, your data will be stored for a period of 3 years after our last significant interaction or any identifiable action, at which point it will be permanently deleted or anonymised.
Examples of the periods for which personal information will be stored
| Personal data | Retention period |
| Client/customer records | As required by any applicable statutory retention period, or where no statutory retention period applies, seven years after contractual relationship ends, or seven years from our last date of contact, whichever is the latest. |
| Business contacts records | As required by any applicable statutory retention period, or where no statutory retention period applies, three years after business relationship ends. |
The above list, which gives examples and does not identify each and every, period for which individuals' personal data will be stored. Further information about our retention of Personal Information is set out in our Retention Policy. If you would like a copy of our Retention Policy, please contact us.
11. Security
Data security is of great importance to Stoke Park Limited and to protect your data we have put in place suitable physical, electronic and managerial procedures to safeguard and secure your collected data. We conduct regular penetration testing and have an incident response plan to quickly handle potential breaches.
We take security measures to protect your information including:
Physical & Managerial Security Procedures
- Limiting access to our buildings to those that we believe are entitled to be there (by use of passes, key card access and other related technologies);
- Implementing access controls to our information technology;
- We use appropriate procedures and technical security measures (including strict encryption, anonymisation and archiving techniques) to safeguard your information across all our computer systems, networks, offices and stores;
- Never asking you to disclose your own passwords;
- Advising you never to enter your account number or password into an email or after following a link from an email.
Website Application and Hosting Security Procedures
- HTTPS — This website is secured via Hyper Text Transfer Protocol Secure (HTTPS). All communications between your browser and this website are securely encrypted.
- Secure Booking via GolfManager — All tee time bookings made through this website are handled by GolfManager, an independent platform. Payment and booking data is processed securely by GolfManager and is not stored on our web servers.
- Secure Update Process — This website's code-base is administered and updated via a password and FTP-free process. All code changes are deployed via a secure process that does not rely on the storage and visible access of passwords.
- Two-Factor Authentication — Where possible, the administration interface to this website application and any personally identifiable information is secured behind two-factor authentication for all staff who have access to it.
- Web Application Maintenance — Our organisation regularly monitors the security of this website and consistently updates the core platform and supporting extensions and plugins.
- PCI-DSS Compliant Server — Our website application is hosted on a PCI-DSS compliant server independently certified by Security Metrics.
- Cloudflare — Our website's DNS is managed through Cloudflare who provide our content delivery network (CDN), DDoS attack mitigation, Internet security and distributed domain name server services.
12. Social Media
We use the following social media platform(s):
- Linked In
We may use these social media platform(s) to process your personal data for some of the purposes set out elsewhere in this Privacy Notice.
13. Artificial Intelligence (AI)
We may use Artificial Intelligence (AI), which means that AI may be used to process your personal data. When we use AI, we do so in compliance with applicable data protection legislation; and regulatory guidance. Some examples of AI tools we may use are:
- ChatGPT
- Microsoft Co-Pilot
We will not use your personal information for automated decision making or profiling.
14. CCTV
Closed-circuit television (CCTV) operates at Stoke Park for security and safety reasons. The lawful basis we rely on to process your personal data is article 6(1)(f) of the UK GDPR, which allows us to process personal data when its necessary for the purposes of our legitimate interests.
15. Wi-Fi
We provide Wi-Fi on site for the use of visitors. We’ll provide you with the address and password. We record the device address and will automatically allocate you an IP address whilst on site. We also log traffic information in the form of sites visited duration and date sent/received. The purpose for processing this information is to provide you with access to the internet whilst visiting our site. The lawful basis we rely on to process your personal data is article 6(1)(f) of the UK GDPR, which allows us to process personal data when its necessary for the purposes of our legitimate interests.
16. Attending an Event of Ours
If you wish to attend one of our events, you will be asked to provide your contact information including where applicable your organisation’s name. If you attend an event at Stoke Park you may be asked about the need for any special access arrangements you may need. If you attend an event at Stoke Park where catering is provided by us, you will be asked about any dietary requirements
We use this information to facilitate the event and provide you with an acceptable service.
Our purpose for collecting this information is so we can facilitate the event and provide you with an acceptable service. The lawful basis we rely on for processing your personal data is your consent under article 6(1)(a) of the UK GDPR. When we collect any information about dietary or access requirements, we also need your consent (under article 9(2)(a)) as this type of information is classed as special category data.
17. Data Protection Complaints
We work to high standards when it comes to processing your personal information. If you have any queries or concerns about our handling of your personal information please contact us directly via DPO@stokepark.com.
We will confirm receipt and our next steps within 30 days and all queries will be investigated without undue delay. In all cases we will provide you with an outcome that explains what steps we have taken following your concern.
Should you remain dissatisfied following our response, you can make a complaint about the way we process your personal information to the Information Commissioner’s Office (ICO), the UK data protection regulator. Please follow this link to see how to do that.
Assigned Data Protection Officer: Norm Cyber Limited
By email: DPO@stokepark.com
By post: Stoke Park Club, Park Road, Stoke Poges, Bucks, SL2 4PG
Thank you for taking the time to read our Privacy Policy.
Stoke Park Limited
This Policy was last updated on 17th June 2026