Last updated: October 2026

1. Introduction

The JJ Club Group Ltd ("we", "our", or "us") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, share, and protect personal data when you use our website at thejjclub.co.uk (the "Site"), our mobile application (the "App"), and the services we provide through them (together, the "Services").

This Privacy Policy is issued in compliance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (together, “UK Data Protection Law”).

Our Site is an informational website only. All new membership sign-ups and in-app purchases take place exclusively within the App.

2. What This Policy Covers — Key Points at a Glance

• We collect information you provide directly, plus technical data gathered automatically.

• We do not process sensitive personal information (special category data).

• We do not sell your personal data to third parties.

• We process your data to provide services, manage memberships, and meet our legal obligations.

• You have a number of rights in relation to your data. See Sections 12 and 13 below.

3. Information We Collect About You

3.1 Information You Provide Directly

When you register for an account or use our Services, you may provide us with: your name; email address; telephone number; postal address; date of birth; passwords and login credentials; and communication preferences.

3.2 Payment Data

Membership payments and in-app purchases made through the App are processed by Apple (via Apple In-App Purchase) or Google (via Google Play Billing).

Some existing members who have not yet moved their membership into the App ("legacy members") currently pay by card through Stripe, our third-party payment provider. These payments will continue to be processed by Stripe until the member downloads the App and transfers their membership to it, after which payments will be taken through Apple or Google as described above.

We do not directly collect or store payment card details. These are handled by Apple, Google or Stripe (as applicable) under their own privacy policies. We receive only limited information from them, such as confirmation of payment and your subscription status, so that we can manage your membership.

3.3 Information Collected Automatically

When you visit our Site or use the App, we may automatically collect: your IP address; device information (type, operating system, unique device identifiers); browser type and version; activity timestamps; approximate location data derived from your IP address; push notification tokens; and usage and interaction logs.

4. How We Use Your Information

We use the personal data we collect to: create and manage your account; deliver and administer the Services; respond to your enquiries and support requests; send you service notifications and updates; send you marketing communications where you have consented or where we have a legitimate interest to do so; analyse usage patterns to improve the Services; ensure the security and integrity of the Services; and comply with applicable laws and regulations.

5. Our Legal Bases for Processing

We will only process your personal data where we have a lawful basis for doing so. The legal bases we rely on are:

• Consent: where you have given us clear, specific, and informed consent to process your data for a particular purpose (for example, to send you marketing emails).

• Contract: where processing is necessary to perform the contract we have entered into with you, or to take steps at your request before entering into a contract.

• Legitimate interests: where processing is necessary for our legitimate interests (for example, to prevent fraud, improve our services, or communicate with existing customers) and those interests are not overridden by your rights and freedoms.

• Legal obligation: where we need to process your data to comply with a legal or regulatory obligation to which we are subject.

• Vital interests: in rare circumstances, where processing is necessary to protect your vital interests or those of another person.

With effect from 19 June 2026, the Data (Use and Access) Act 2025 introduced a category of "recognised legitimate interests" in respect of which no case-by-case balancing test against the rights and freedoms of data subjects is required. Where we rely on this basis — for example, in connection with detecting or preventing crime, safeguarding vulnerable individuals, or responding to requests from a public body or authority exercising its functions — we will identify this in our records of processing activities and update this Privacy Policy accordingly.

6. Sharing Your Information

We may share your personal data with: technology and infrastructure providers who host or support the Services; marketing and email platforms; Apple, Google and Stripe (as described in Section 3.2 above); event or venue partners where relevant to your membership; and analytics providers.

We do not sell your personal data to third parties.

Where we share data with third-party processors, we ensure that appropriate contractual safeguards (including data processing agreements) are in place.

7. Third-Party Websites and Services

Our Site and App may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties and encourage you to read their own privacy policies. This Privacy Policy applies only to our Services.

8. Cookies and Tracking Technologies

Our Site uses cookies and similar technologies to enhance your browsing experience and to understand how the Site is used. "Cookies" are small text files placed on your device by your web browser.

Following the commencement of relevant provisions of the Data (Use and Access) Act 2025, certain categories of cookie no longer require your prior consent, including cookies used strictly for statistical purposes (such as measuring web traffic, provided the data is not used to build individual profiles), cookies that preserve your user-interface appearance choices, and cookies required for emergency assistance. We will update our cookie practices in line with any guidance issued by the Information Commissioner’s Office and will keep the Cookie Policy section of this document current.

The App may use third-party analytics tools (such as Firebase or equivalent) to collect anonymised usage data. You can opt out of personalised analytics by adjusting the tracking settings in your device’s operating-system preferences.

For full details of the cookies we use, see the Cookie Policy section below.

9. Data Retention

We retain your personal data only for as long as is necessary for the purposes for which it was collected, and in accordance with our legal obligations. We will not retain personal data for longer than twelve (12) months after the termination of your account, except where we are required by law or regulation to retain it for a longer period.

10. Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. However, no electronic transmission over the internet or information storage system can be guaranteed to be 100% secure. You transmit information to us at your own risk.

11. Children and Minors

We do not knowingly collect, solicit, or market to children under the age of 18. By using our Services, you confirm that you are 18 or older, or that you have obtained the consent of a parent or legal guardian. If we become aware that we have inadvertently collected personal data from a child without appropriate consent, we will take steps to delete that information promptly.

12. Your Rights

Under UK Data Protection Law, you have the following rights in relation to your personal data:

• Right of access: to obtain a copy of the personal data we hold about you.

• Right to rectification: to have inaccurate or incomplete personal data corrected.

• Right to erasure: to request deletion of your personal data in certain circumstances.

• Right to restriction: to request that we restrict our processing of your data.

• Right to data portability: to receive your data in a structured, commonly used, and machine-readable format.

• Right to object: to object to processing based on legitimate interests or for direct marketing purposes.

• Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please email us at hello@thejj.club with the relevant request. We will respond within one calendar month. Data Subject Access Requests should include “Data Subject Access Request” in the subject line.

If you are not satisfied with how we have handled your request, you have the right to make a complaint — both to us directly (see Section 13 below) and to the Information Commissioner’s Office (ICO). Please see Section 13 below for our full complaints procedure, including how to escalate unresolved complaints to the ICO.

13. Data Protection Complaints

The Data (Use and Access) Act 2025 gives you the right to make a data protection complaint directly to us as controller. You do not need to contact the Information Commissioner’s Office first.

How to make a complaint

Please submit your complaint in writing, providing your name and contact details, a description of your concern, the personal data or processing activity to which your complaint relates, and any relevant dates or reference numbers, to:

Email: hello@thejj.club (subject line: “Data Protection Complaint”)

Post: Data Protection Officer, The JJ Club Group Ltd, 1 Canada Square, 37th Floor, Canary Wharf, London, E14 5AA

What happens next

We will acknowledge your complaint within 30 calendar days of receipt. We will investigate your complaint promptly and without undue delay, and will keep you informed of progress and the outcome. We aim to resolve all complaints within three months of receipt. If a complaint is complex and is likely to take longer, we will write to explain the reasons for the delay and give you an estimated timescale for resolution.

Escalation to the ICO

If you are not satisfied with our response, or if you have not received a response within the timeframes set out above, you have the right to escalate your complaint to the Information Commissioner’s Office (ICO), the UK’s independent data protection supervisory authority:

Website: www.ico.org.uk

Telephone: 0303 123 1113

Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Online complaint form: ico.org.uk/make-a-complaint

14. Do-Not-Track Signals

Our Site does not currently respond to Do-Not-Track browser signals as there is no uniform industry standard for such signals. We will keep this position under review.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to you via the App or by email. Continued use of the Services after any changes take effect constitutes your acceptance of the updated policy.

16. How to Contact Us

If you have any questions about this Privacy Policy or the way we handle your personal data, please contact us at:

The JJ Club Group Ltd

1 Canada Square, 37th Floor

Canary Wharf, London, E14 5AA

Email: hello@thejj.club