Privacy Policy
Club Coders — Privacy Policy
Last updated: 14 July 2026
Club Coders ("we", "us", "our") is a STE(A)M education business based in Bromsgrove, Worcestershire, running the clubs RobotCoders, DroneCoders, GameCoders, CarCoders and Make and Take. We deliver coding, robotics, drone and RC-car classes for children, and a smaller number of classes for adults.
This policy explains what personal data we collect, why, how we use it, and what rights you have under the UK GDPR and the Data Protection Act 2018.
1. Who we are (the data controller)
Data controller
Club Coders Ltd
Registered in
England and Wales, company number 17156327
Registered office
128 Birmingham Road, Bromsgrove, England, B61 0DQ
info@clubcoders.co.uk
Phone
07984 653 910
ICO registration number
Application C1982931 (registration pending)
We are the data controller for the personal data described below. Contact us using the details above with any questions.
2. What personal data we collect
From parents and carers (children's classes)
Name, email address, postal address and telephone number
Emergency contact name and telephone number
Booking history, attendance records and correspondence with us
Payment confirmation records (we do not store card details — see section 5)
Marketing preferences and photo/video consent preferences
About children
Name, date of birth and/or age; school year or age group where relevant to session grouping
Medical conditions, allergies, dietary requirements, additional needs and support requirements you tell us about
Attendance records
Photographs and video, only where consent has been given (section 7)
Incident, accident and safeguarding records, where an incident occurs
From adult participants
Name, email address, postal address and telephone number
Emergency contact name and telephone number
Any medical, accessibility or additional-needs information you choose to share with us
Booking history, attendance records and correspondence
Marketing preferences and photo/video consent preferences
Automatically, when you use our websites
IP address, browser and device type, pages visited, referring page
Cookie data (section 10)
We do not knowingly collect data directly from children. All booking data for a child is provided by a parent or carer with parental responsibility.
3. Why we use your data, and our lawful basis
What we do
Why
Lawful basis
Take and manage bookings; take payment; send confirmations and session information
To deliver the sessions you have booked
Contract
Hold emergency contact details and contact you during a session
Participant welfare and safety
Legitimate interests (safety) / Vital interests in an emergency
Hold medical, allergy and additional-needs information
So we can keep you or your child safe and support you properly
Explicit consent (special category data) — section 4
Keep registers, incident, accident and safeguarding records
Legal and regulatory obligations; child protection
Legal obligation / Substantial public interest (safeguarding of children)
Take and use photographs and video
Promotion of the club, and sharing session photos
Consent — withdrawable at any time
Send marketing emails or newsletters
To tell you about upcoming sessions and holiday clubs
Consent — unsubscribe at any time
Keep accounting and tax records
Legal requirement
Legal obligation
Improve our websites, prevent fraud, secure our systems
Running the business properly
Legitimate interests
Establish, exercise or defend legal claims; deal with insurance matters
Protecting our legal position
Legitimate interests / Legal obligation
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and concluded they are not. You may object at any time (section 9).
4. Special category data
Information about health, medical conditions, allergies, disability or additional needs — whether about a child or an adult participant — is special category data and gets extra protection.
We collect it only where necessary to keep participants safe.
We rely on your explicit consent and, where safeguarding is engaged, on the "safeguarding of children" condition in Schedule 1 of the Data Protection Act 2018.
It is shared only with the staff who need it to run the session safely, and with emergency services if required.
You may withdraw consent at any time, but if you do we may not be able to accept a booking where we cannot safely provide support.
5. Who we share your data with
We do not sell your personal data and we never share it for third-party marketing.
Class4Kids — our booking and registration platform, storing booking, attendance and registration data on our behalf.
Stripe — processes card payments on behalf of Class4Kids. We never see or store your full card details.
Our staff, who see only what they need to deliver a session safely. All staff working with children are DBS-checked.
Venues, where a venue requires an attendee register for fire safety or access.
Our insurers and legal advisers, where an incident or claim arises.
Emergency services and healthcare professionals, where urgent medical attention is needed.
Local authority safeguarding teams, the police or other statutory agencies, where we have a safeguarding concern or a legal duty to disclose. In these circumstances we may share information without your consent and may not be able to tell you we have done so.
Our website host, email provider and IT suppliers, acting as processors under contract.
All processors are bound by written contracts requiring them to protect your data and use it only on our instructions.
6. International transfers
Some suppliers may store data outside the UK. Where they do, we rely on appropriate safeguards — UK adequacy regulations, or the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses. Ask us for details of the safeguards used.
7. Photographs and video
Photo and video consent is asked separately at registration. It is optional, and refusing never affects a place on a session.
You can change your decision at any time by emailing info@clubcoders.co.uk.
If you withdraw consent, we will remove the images from our website and our own social media channels as soon as reasonably possible. Once material has been published, we cannot control content that has been downloaded, shared or reposted by others, and cannot guarantee its removal from those sources.
We do not tag or publish children's names alongside their photographs.
If we send you photographs or video that include other participants, they are for your personal use only and must not be posted or shared online.
8. How long we keep your data
Data
Retention period
Booking, contact and attendance records
5 years after your last session with us
Medical, allergy and additional-needs information
Deleted 5 years after the last session, or sooner on request
Accident and incident records involving a child
Until the child reaches age 25
Accident and incident records involving an adult
3 years from the date of the incident
Safeguarding records
In line with statutory safeguarding guidance, which may require long-term retention
Accounting and payment records
6 years plus the current financial year (HMRC requirement)
Photographs and video (with consent)
Until consent is withdrawn, or 5 years, whichever is sooner
Marketing contacts
Until you unsubscribe, or after 2 years of no engagement
Website analytics / cookie data
26 months
When a retention period ends, data is securely deleted or anonymised.
9. Your rights
You have the right to: be informed; access your data; have inaccurate data rectified; request erasure (where no legal or safeguarding duty requires us to keep it); restrict processing; data portability; object to processing based on legitimate interests, and to direct marketing at any time; and withdraw consent where we rely on it (this does not affect processing carried out before withdrawal).
A parent or carer with parental responsibility may exercise these rights on behalf of a child. Older children may exercise their own rights where they can understand them.
Adult participants exercise their own rights directly.
To exercise any right, email info@clubcoders.co.uk. We respond within one calendar month, normally free of charge.
10. Cookies
Our websites (clubcoders.co.uk, robotcoders.co.uk, dronecoders.co.uk, carcoders.co.uk) use:
Strictly necessary cookies, which make the site work and do not require consent.
Analytics cookies and embedded booking widgets (Class4Kids), set only where you have given consent via our cookie banner.
You can change or withdraw your cookie preferences at any time via the cookie settings link in our footer, or by clearing cookies in your browser.
11. How we keep your data safe
Access to booking and registration data is restricted to staff who need it, protected by strong unique passwords and two-factor authentication where available.
Registers and medical information taken to sessions are kept securely and not left unattended.
Paper records are destroyed securely once no longer needed.
We do not store payment card details.
We review our security measures periodically, and will notify you and the ICO of any data breach where required to do so.
12. ICO registration
We are registered with the Information Commissioner's Office as a data controller. Our application number is C1982931. Our public register reference will be published here once our register entry goes live. You can check the register at ico.org.uk.
13. Complaints
Please contact us first at info@clubcoders.co.uk so we can try to put things right.
You also have the right to complain to the Information Commissioner's Office:
Website: ico.org.uk/make-a-complaint
Helpline: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
14. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed. Where a change is significant, we will tell you by email.
Club Coders Ltd, registered in England and Wales, company number 17156327. Registered office: 128 Birmingham Road, Bromsgrove, England, B61 0DQ.