Privacy Policy

Greenkeeper Crew (GKC) app · version 2 · last updated 23 September 2026

1. Who we are

The data controller is Work Less Group Ltd, a company registered in England and Wales (company number 17015163), registered office 29 Victoria Avenue, Rayleigh, England, SS6 9DH, trading as Greenkeeper Crew. We are registered with the UK Information Commissioner's Office under registration number ZC185365. This policy covers the GKC apps, app.greenkeepercrew.com and greenkeepercrew.com.

Contact us about anything in this policy at privacy@greenkeepercrew.com or by post to the address above.

2. What we collect, why, and our lawful basis

What	Why	Lawful basis (UK and EU)
Email address, or your Apple ID sign-in (which may be an Apple private relay address, plus a token from Apple)	To sign you in with a one-time code or Sign in with Apple, and to contact you about your account. When you delete your account we ask Apple to revoke the token, which removes GKC from your Apple ID.	Contract
Name, job title, course, years in the trade, bio, profile photo, whether you're open to work	To build your profile and show it to others. Your name and course appear on your posts.	Contract
Your confirmation that you are 18 or over, and that you accept the terms	To keep GKC for adults and record your agreement.	Legal obligation; contract
Posts: photos, videos, titles, captions, the time you took them, and the course they're from	To publish your work to the feed, your course page and your profile.	Contract
Comments, board threads and replies, kit reviews, questions and answers, reports about a course, job applications	To provide those features. A job application is shared with the employer that posted the job.	Contract
Verification requests: your course, role and, if you give it, a contact at the club	To confirm with your club that you work there, so the verified tick means something.	Legitimate interests (a trustworthy network); contract
Membership records: which membership, dates, status, the store's transaction identifier, and the country of the store account	To give you what you've paid for, handle renewals, cancellations and refunds, and for our accounts. We never receive your card details.	Contract; legal obligation (tax records)
Putts you give and receive	To run Putts and show the thank-yous a crew has been given.	Contract
Likes, follows, blocks, reports you make and reports made about you, and our moderation decisions	To run the feed, protect you from people you've blocked, keep the community safe, handle appeals, and meet our legal duties.	Contract; legitimate interests (safety); legal obligation
Messages you send us (support, privacy, safety or legal requests)	To answer you and keep a record of what was asked and done.	Legitimate interests; legal obligation
Device push token and notification settings	To send the notifications you've allowed.	Consent (given in your phone's settings)
Technical data: IP address, app version, device type, operating system, and server logs	To keep GKC secure, stop abuse and fraud, and fix faults.	Legitimate interests (security)

We collect this from you, from your use of GKC, from Apple or Google (sign-in and purchase records), from our payments service RevenueCat (the status of your membership), from your club (when it answers a verification request) and from other members (for example when they report or mention you).

Photos and location

When you post a photo we remove its hidden metadata, including any GPS location, before storing it. The app asks for your camera only when you tap Camera. We don't track your location. If a future version offers to tag the hole you're on, it will ask first and only use your location while you are posting.

What we don't do

• We don't sell your personal information, and we don't share it for cross-context behavioural advertising.
• We don't show third-party advertising or use advertising trackers, and the apps don't track you across other companies' apps or websites.
• We don't use your posts or data to train artificial intelligence models.
• We don't make decisions that have legal or similarly significant effects on you by automated means alone. Reports are reviewed by a person.
• We don't tell your employer or club you're on GKC unless you ask them to confirm you.
• We don't ask for, and ask you not to post, sensitive information such as health, religion, sexuality or political views.

3. What others can see

GKC is a public network. Your name, photo, job, course, verified status, posts, comments, board posts, kit reviews and answers are visible to other members, and a preview of GKC (a selection of posts, comments, profiles, course pages, board threads, kit reviews, jobs and questions, with the names shown on them) is visible to people using the app without an account. Supporters appear to others by first name and initial (for example "Hannah W.") on questions they ask. Your email address is never shown to other members. A job application shares your name, job, verified status, your note and your email with that employer, which then handles it as its own controller.

4. Sponsors

GKC may show sponsored content from a partner, clearly marked. If you tag a partner's kit in your post, the post shows their logo. We don't share your personal data with sponsors. If we ever report to a sponsor how their content performed, it will be as totals that don't identify anyone.

5. Who we share data with

Only the suppliers who run GKC for us (our processors or service providers), under contracts that bind them to our instructions and to protect your data:

• Amazon Web Services (Lightsail): our server and database, in the London region (UK).
• Bunny.net (BunnyWay d.o.o., Slovenia, EU): storage and delivery of photos and videos, with copies cached on servers around the world so they load quickly.
• Twilio SendGrid (USA): sign-in codes and account emails.
• RevenueCat (USA): processes membership purchases and renewals from Apple and Google and tells us the status. It receives an account identifier (not your name or email) and the store's purchase records.
• Apple and Google: sign-in, app store purchases and push notifications, under their own terms and privacy policies.
• Google Fonts: our website pages load fonts from Google, which receives your IP address when you view them.
• Google Cloud Translation: when you read GKC in another language, the text of posts, comments, questions, answers, reviews and jobs is sent to Google to be translated. It doesn't include who wrote it. You can turn translation off in the app (You, Settings).

We may also disclose data where the law requires it (including to regulators, courts and the police), to report child sexual abuse material to the authorities, to protect someone's safety or our rights, or as part of a sale or reorganisation of our business (in which case this policy continues to apply).

6. International transfers

We are based in the UK and our main server is in London. Some suppliers (SendGrid, RevenueCat, Apple and Google) process data in the United States. Where data leaves the UK or EU, the transfer is protected by an adequacy decision (including the UK Extension to the EU-US Data Privacy Framework where the supplier is certified), or by the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.

7. How long we keep it

• Your account and content: while you have an account. Delete it and your personal details are removed straight away and your content is taken down.
• Membership and transaction records: 6 years, for tax law.
• Moderation and report records: up to 12 months after the matter is closed, or longer where the law requires or a claim is likely.
• Records of content reported to the authorities: as long as the law requires.
• Messages you send us: up to 2 years after the matter is closed.
• Server logs: 30 days. Database backups: roll off within 35 days.
• Sign-in codes: 15 minutes, then useless; the records are cleared regularly.

8. Your rights (UK and EU)

You can ask for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. You can delete your account yourself in the app (You, Settings, Delete account) or at app.greenkeepercrew.com/delete-account. For anything else email privacy@greenkeepercrew.com. We will reply within one month and there's nothing to pay. You can complain to the UK Information Commissioner's Office at ico.org.uk or on 0303 123 1113, or, in the EU, to the data protection authority in your country. We would like the chance to put things right first.

9. If you live in the United States

This section adds to the rest of this policy for residents of US states with consumer privacy laws, including California (the CCPA as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others.

• Categories we collect (in the last 12 months and going forward): identifiers (name, email, account and device identifiers, IP address); commercial information (membership records); internet or other electronic network activity (how you use GKC, server logs); audio and visual information (the photos and videos you post); professional or employment-related information (your job, course, years in the trade, job applications); and the content of what you post and send. We collect "sensitive personal information" only in the sense of your account sign-in, and we use it only to provide GKC. We don't collect precise geolocation.
• Sources, purposes and retention are set out in sections 2 and 7.
• Disclosure. We disclose each category to the service providers in section 5 for the business purposes described there. We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the last 12 months. We don't knowingly sell or share the personal information of anyone under 16. Because we don't sell or share, there is nothing to opt out of, but we treat a Global Privacy Control signal as a valid opt-out request.
• Your rights. You can ask to know what personal information we hold about you and how we use and disclose it, to get a copy in a portable format, to correct it, and to delete it. We won't treat you differently for using these rights.
• How to ask. Email privacy@greenkeepercrew.com from the email address on your account, or use the in-app deletion. We verify requests by confirming you control the account. You can use an authorised agent, who must show us your signed permission, and we may still ask you to verify your identity. We respond within 45 days, and may extend that once by 45 days if we tell you why.
• Appeals. If we decline your request, you can appeal by replying to our decision or emailing privacy@greenkeepercrew.com with "Appeal" in the subject. We'll tell you the outcome and our reasons within 45 days. If you're not satisfied, you can contact your state Attorney General.
• Do Not Track. Browsers' Do Not Track signals have no agreed meaning, so we don't respond to them; we don't track you across other sites anyway. California residents may also ask, once a year, about any disclosure of personal information to third parties for their direct marketing: we make none.

10. Children

GKC is for adults aged 18 and over. We don't knowingly collect personal information from anyone under 18, and never from children under 13. If we learn that we have, we'll delete it and close the account. If you think we hold data about a child, tell us at privacy@greenkeepercrew.com.

11. Security

Everything travels over encrypted connections. Sign-in uses one-time codes or Apple, so there is no password for anyone to steal. Access to our systems is limited to the people who need it, and our suppliers are chosen for their security. No system is perfectly secure: if a breach puts your data at risk, we'll tell you and the regulators as the law requires.

12. Changes

If we change this policy in a way that matters, we'll tell you in the app or by email before it takes effect. The version and date at the top show the latest version.