Privacy notice
In short: we keep the handle you choose, your member number, when you paid and, if you used a member's invite link, which member invited you. Your handle and number are public, because that is the product. Stripe handles your payment. We use no advertising pixels and no tracking. The only cookies come from Stripe's payment script, which loads when you open the join box, to prevent fraud. You can ask us to take your handle down at any time.
1. Scope and definitions
1.1 This notice explains how personal data is processed in connection with The One Pound Club (the "Club"), the website at onepound.club (the "Site") and any purchase of a membership (a "Membership").
1.2 "We", "us" and "our" mean the operator of the Club, identified in the legal information at the end of this notice, acting as data controller under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018. "You" means any person who visits the Site, buys a Membership or contacts us.
1.3 This notice should be read with our Terms. If they conflict on how personal data is handled, this notice prevails.
2. Personal data we process
| Data | Where it comes from | Why we use it | Lawful basis (UK GDPR) | How long we keep it |
|---|---|---|---|---|
| Your handle (the name you choose for the wall) | You, when you join | To show it on the public wall, your member page and your certificate | Contract, Article 6(1)(b) | For as long as the Club exists, unless you ask us to remove it |
| Member number and time of payment | Created by the Site when Stripe confirms payment | To provide the Membership and keep a record of it | Contract, Article 6(1)(b) | For as long as the Club exists |
| Which member invited you (the member number in the invite link you used) | The address you clicked, passed to Stripe with your payment | To count the inviter's rank and to show "Invited by" on your certificate and member page | Legitimate interests, Article 6(1)(f) | For as long as the Club exists |
| Stripe payment reference (Checkout Session ID) | Stripe | To match payments to members, handle refunds and keep accounts | Contract, Article 6(1)(b); legal obligation, Article 6(1)(c) | For as long as the Club exists, and at least six years for tax purposes |
| A one-way hash of your IP address | Derived from your connection when you start a checkout | To limit repeated checkout attempts and prevent card-testing fraud | Legitimate interests, Article 6(1)(f) | 24 hours, then deleted automatically |
| Bot-check signals (Cloudflare Turnstile) | Your browser, processed by Cloudflare | To check a person, not a script, is joining | Legitimate interests, Article 6(1)(f) | Held by Cloudflare under its own policy; we receive only a pass or fail |
| Advertising tags in the link you arrived from (for example utm_source) | The address you clicked | To measure which adverts lead to memberships | Legitimate interests, Article 6(1)(f) | Stored with the payment record at Stripe, not in our database |
| Anonymous step counts (for example, how many people opened the join box or tapped share) | Your browser, when you use the Site | To see where visitors stop, so the Site can be improved | Legitimate interests, Article 6(1)(f) | Kept as daily totals. They contain no identifier and cannot be linked to you |
| Payment-script data: cookies and device signals set by Stripe's script | Your browser, when you open the join box | To prevent fraud and to make Apple Pay and Google Pay work | Legitimate interests, Article 6(1)(f). Needed to take payment securely | Held by Stripe under its own policy; we receive none of it |
| Anonymous page-visit statistics | Cloudflare Web Analytics | To count visits and see how the Site performs | Legitimate interests, Article 6(1)(f) | Aggregated by Cloudflare; no cookies and no identification of you |
| Emails you send us and our replies | You | To answer you, handle reports and complaints | Legitimate interests, Article 6(1)(f) | Up to two years after the conversation ends |
2.1 Payment data. Your card details, the name on the card, billing country, postcode and the email address for your receipt are collected and processed by Stripe on Stripe's own pages. We never receive or store your full card details. If you pay with Apple Pay or Google Pay on our page, your wallet shares your email address (for your receipt) and a payment token with Stripe, not with us. Stripe acts as our payment processor and, for its own fraud prevention and legal duties, as an independent controller under its own privacy policy at stripe.com/privacy.
2.2 Legitimate interests. Where we rely on legitimate interests, those interests are keeping the Site secure, preventing fraud and abuse, and understanding which adverts work. We have assessed that these do not override your rights, because the data involved is minimal, short-lived or anonymous.
2.3 If you don't provide data. A handle is needed to buy a Membership. Without it we cannot provide one.
3. What we do not do
- We set no cookies of our own, and we do not use advertising pixels, fingerprinting or cross-site tracking. The one exception is payment: when you open the join box, Stripe's payment script loads from Stripe and may set cookies and similar technologies that it uses to prevent fraud and to run Apple Pay and Google Pay. They are needed to take payment securely, and we do not see or use them.
- We do not create accounts or store passwords.
- We do not sell, rent or trade personal data.
- We do not send marketing emails.
- We do not make automated decisions that have legal or similarly significant effects on you (Article 22 UK GDPR).
- We do not knowingly collect data from children under 13. The Club is not aimed at children.
4. Public information
4.1 Your handle, member number and date of joining are published on the Site, on your member page (onepound.club/m/<number>) and on any certificate you download or share. They can be seen by anyone, copied, and indexed by search engines.
4.2 Please do not use your real name, or anyone else's, as a handle. Once information has been shared publicly, we cannot recall copies made by others.
4.3 Your title, your rank, the number of people who joined through your invite link and, if a member invited you, that member's handle ("Invited by") are published in the same places. If you invite people, you can see only what the wall shows: their public handle and member number once they have joined.
5. Who we share data with
We use the following service providers (processors), each bound by a written contract to process data only on our instructions and to keep it secure:
- Cloudflare, Inc.: hosting, database, bot check (Turnstile), email forwarding and anonymous analytics.
- Stripe Payments Europe, Ltd and Stripe, Inc.: payment processing and receipts.
- Google LLC: the inbox that receives email sent to hello@onepound.club.
We may also disclose data where the law requires it, to establish or defend legal claims, or to prevent fraud.
6. International transfers
Our providers may process data outside the United Kingdom, including in the United States. Where they do, transfers are protected by the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or another safeguard recognised under UK law.
7. Security
The Site is served only over encrypted connections (HTTPS with HSTS). The database can only be reached by the Site itself. Secret keys are held in Cloudflare's encrypted secret store and never in the Site's code. IP addresses are hashed with a secret salt before storage and deleted after 24 hours. Checkout attempts are rate-limited and checked for bots. Backup copies of the database are kept by the operator, limited to the most recent 30, and used only to restore the service.
8. Your rights
8.1 Under UK GDPR you have the right to:
- be informed about how your data is used (this notice);
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, including having your handle removed from the wall (your member number is then kept with the handle removed, so numbers are never reused);
- restrict or object to processing based on legitimate interests;
- data portability, where processing is based on contract and carried out by automated means.
8.2 To use any of these rights, email hello@onepound.club with your member number and handle. We may ask for reasonable proof that the membership is yours, such as the date and amount on your Stripe receipt. We will reply within one month. There is no charge.
9. Complaints
If you are unhappy with how we have handled your data, please contact us first. You also have the right to complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, website ico.org.uk.
10. Changes to this notice
We may update this notice, for example if we change providers. The version and effective date at the top will change, and significant changes will be shown on the Site.
Legal information. Data controller and operator of The One Pound Club: Nathan Minnis, sole trader trading as The One Pound Club, 47 Old Milton Road, New Milton, BH25 6DJ, United Kingdom. Email: hello@onepound.club. ICO registration reference: ZC271421.