Privacy Policy
Last updated: 23 September 2026
This policy explains what DRGCC CONNECT — the mobile app of Defence Raya Golf & Country Club — collects from you, why it is collected, who else handles it, how long it is kept, and how you can have your app account deleted.
DRGCC CONNECT is for existing members of the club. The app does not sell memberships and does not create them: your membership is opened at the club, and the app only gives you a way to reach your own record on your phone.
Who we are
Defence Raya Golf & Country Club, Defence Raya Golf Resort, DHA Phase VI, Lahore, Pakistan. The club is the data controller for everything described here.
- info@drgcc.com
- Telephone
- 042-111-800-100
- Website
- www.drgcc.com
What we collect, and why
Signing in
You sign in with your CNIC (national identity number) and a password. The CNIC is how the club already identifies you in its own records, so it is what the app uses to match your sign-in to your membership. We hold your name, CNIC, membership number, email address and phone number, which the club holds for you already.
Details the bank requires before a card payment
The first time you pay by card, our payment bank requires a few details that the club does not otherwise need: your date of birth, a mobile number, an optional landline number, your residential address and your billing address. You are asked for these once, they are stored so you do not have to type them again, and they are used only to complete card payments.
Messages you send the club
The app lets you message club departments and attach photos. Those messages and attachments are stored on the club's servers so that staff can answer you and so the conversation is still there when you come back. Photos are stored with Cloudflare R2 on the club's account. Please do not send documents or images in chat that you would not want club staff to read.
Recognising your device
Because the app shows your financial account, it needs to know which handsets are yours. For that we record an install identifier and a device key issued by our server, your device model, the app version, and the IP address of each sign-in. This is used to recognise a handset you have used before and to warn you and the club when your account is signed in on a new one. It is not used to profile you and not used for advertising.
Notifications
If you allow notifications, your device gives us a push token — an address for that one installation. It is used to send you club announcements, booking confirmations, billing reminders and replies to your messages.
Card payments
The app never sees your card number. When you pay, the app opens United Bank Limited's own secure payment page inside a browser window. Your card number, expiry and CVV are typed into that bank page and go straight to the bank.
What the club's server is given back and does keep:
- a masked card number — the first six and last four digits only, so you can recognise which card you used;
- the bank's approval code and the outcome of the payment;
- a gateway token held by the bank's system, which is never returned by our app or by our API to anyone.
One-time codes
To confirm it is you — when you sign in on a new device, or reset a password — the system sends a one-time code to your registered email address and WhatsApp number.
What we do not do
- The app contains no analytics, advertising or crash-reporting software of any kind. No third party receives a record of your use of the app.
- We do not sell your data, and we do not share it with anyone for advertising.
- We do not track you across other apps or websites, and the app carries no advertising identifier.
- The app is not intended for anyone under 18.
Who else handles your information
The club uses a small number of service providers, each for one job and each only with the information that job needs:
- United Bank Limited and Comtrust — card payment processing. They receive your card details directly on the bank's own page and the billing details the bank requires.
- Expo, and through it Apple and Google — delivery of push notifications to your handset.
- Resend — delivery of email, including one-time codes.
- Whatchimp — delivery of WhatsApp messages, including one-time codes.
- Cloudflare — storage of files such as chat photos, and hosting of the club's web services.
Some of these providers operate servers outside Pakistan, so your information may be processed abroad. We may also disclose information when the law requires it.
How long we keep it
- Sign-in (refresh) tokens — deleted 30 days after they expire.
- One-time codes — deleted after 30 days.
- Diagnostic request traces (the technical log used to investigate errors) — deleted after 5 days.
- Your membership record and financial ledger — kept as the club's books, for as long as the club is required to keep its accounts and its membership register. This is club business and is not removed when your app account is deleted.
How it is protected
All traffic between the app and the club's servers is encrypted in transit. Passwords are stored only as irreversible hashes. Access to member data inside the club is limited to staff who need it for their work, and administrative actions are logged.
Your rights
- See your information. Most of it is on the screen in the app; for anything else, write to info@drgcc.com.
- Correct it. Ask the club to correct your name, contact details or address if they are wrong.
- Turn off notifications at any time, in your phone's settings or in the app.
- Delete your app account — see below.
- Complain. Write to info@drgcc.com or call 042-111-800-100 and the club will respond.
Deleting your account
You can delete your DRGCC CONNECT account in the app, under Profile → Delete Account, or by request if you cannot open the app. Deleting it removes your sign-in, your registered devices, your notification tokens and your chat history and attachments.
Your membership record and any outstanding balance remain with the club: deleting the app account closes your access to the app, it does not cancel your membership and it does not clear money you owe.
Full details, and how to request deletion without the app: Account deletion.
Changes to this policy
If this policy changes, the new version will be published at this address and the date at the top will change. Significant changes will also be announced in the app.
Contact
Questions about this policy, or about your information: info@drgcc.com · 042-111-800-100 · www.drgcc.com