Privacy, retention, and your rights
This application supports club trip safety administration in line with common Paddle UK expectations and British Canoeing Awarding Body leadership / safeguarding practice (session planning, participant sign-in, emergency contacts, safe return).
Policy version: 2026-10-14-v1 · Not legal advice. Your club or activity centre remains the data controller; configure retention and respond to requests using your own procedures and, where needed, professional advice.
How-to (tick, download, hide a name): Privacy and your data. Welfare and committee: Handling a data request (slides). Which system holds what: Club tools and member data (slides).
What we collect and why
- Session sign-in: name, contact, emergency contact, health and water-confidence information needed for on-water safety.
- Leader accounts: display name, award notes, structured leadership awards and remit, other training, optional first aid and safeguarding dates (declared), contact and emergency details for sessions you organise.
- Safe return: status (not safe / pending / safe) during and after the trip.
- Improvement suggestions: the text you send from Suggest an improvement, the priority you pick (Must, Should, Could, or Would), an optional role, and a name or email only if you ask for a reply. The page may ask for a shared word so junk posts can be blocked; that word is not an account. Signed-in suggestions are linked to your account and included when you download a copy of your information. Site administrators read them to decide what to build, and can download a CSV of the list. They are kept while the suggestion is being acted on, and a site administrator can remove one. They are not used for marketing.
Health and emergency data are treated as sensitive. Processing is for participant safety and safeguarding during organised paddle activities — not for marketing.
Role matrix (privileged)
Website accounts do not all see the same tools. Privileged access:
| Role | Organisation / Duty dashboard | Emergency Dashboard | User admin |
|---|---|---|---|
| Site administrator | Yes — all organisations | Yes | Global (Site menus) |
| Organisation admin | Yes — their Admin org | No | Their org (Members + password reset) |
| Organisation duty | Yes — their Duty org | No | No |
| Emergency services | No | Yes (operational fields only) | No |
Full guide: Account roles.
Who can see names and emergency contacts
Creating a website account does not unlock everyone’s personal details. Visibility follows role and relationship:
- Public / guests: session title, times, venue, route map, and safe-return counts — not other people’s names or ICE. You can still see your own row (and family you signed in) for safe return.
- Organisation members (approved for that club or activity centre): on sessions for their organisation, fellow adult members’ display names on the roster and on Who’s coming on the session overview (not phones or ICE). Under-18s stay generic (“Young person” on the roster; a count only on Who’s coming). Members may hide their name under Personal details → Hide my name from other organisation paddlers (you then cannot see Who’s coming). Date of birth is hidden from other paddlers by default; opt in under Show my age to other organisation paddlers to show age in years, never the full date, and never for under-18s.
- Organisation duty or organisation admin (for that club or activity centre): member names on that organisation’s live sessions; guests appear as “Guest paddler” / “Young person”. Shore contacts as needed for duty. First aid and safeguarding dates declared on Personal details appear on Members for that organisation (a glance, not a DBS register). Organisation admins may also receive a weekly email digest of members whose declared first aid or safeguarding dates are due soon or expired (the same list as Organisation home). Members are not emailed. Committee hats (chair, welfare officer, and similar) are labels on Members for that organisation. They are not shown on the live roster.
- Session leader: full roster and ICE for sessions they run.
- Site administrator / duty alert link: full detail where authorised for safeguarding or overdue response.
- Emergency services: operational session fields and leader/shore contacts — not participant names, ICE, or medical notes.
- Past (archived) sessions: named lists for the session leader, organisation duty/admin for the host, and site administrator. Organisation members may see fellow members’ names on trips for their org (same rules as live). Others see a summary only, or their own attendance if they joined that trip.
- Past planned end / overdue: leader and duty phone numbers may be shown so someone can raise the alarm — still not a full participant ICE list.
Lawful basis (summary)
Controllers typically rely on a combination of:
- Legitimate interests — running a safe organised activity (with a documented balancing test).
- Vital interests — emergency contact use when someone is at risk.
- Contract / membership — where sign-in is part of club participation.
- Explicit consent — special-category health data (medical notes, GP, medication) is collected only when you tick a separate health consent on join or Personal details (version 2026-10-14-health-v1). Optional photo/treatment consent is a different tick and defaults off. The sign-in form also records that you have read this notice (version 2026-10-14-v1).
Session & training log books
Leaders keep a log book (session snapshots when a trip is completed, plus optional training entries). Registered participants can see trips they joined via their account or personal safe-return link. Participants and leaders can also keep a personal skills / learning outcomes record (kayak skills catalogue) linked to completed sessions or training entries — see Skills and learning outcomes. This is separate from Past sessions (the operational archive of completed safety sessions, which may include names and contacts for authorised roles). See Log book and Past sessions.
Log book rows store operational data only: date, location, aims/outcomes, headcount, safe-return summary, and pseudonyms (e.g. “Participant 1”, “Extra leader 2”) — not names, addresses, phones, GP, or medical information. Skill outcomes store your own practice notes and competency ratings; session leaders may endorse outcomes only for people on sessions they led. You can create a share link from Profile so another coach can see a live glance (letters, dates, host, endorsement rings). Reflections are off unless you opt in. The link expires or you revoke it — it is not an export into another club’s records. You can also tick Clubs that can see this for an organisation you are an approved member of; that club’s duty may open the same skills profile from Members, and the session leader of a trip you book there may open it from that session, until you untick or leave. Training entries may snapshot a club programme (title and local procedures) onto your personal CPD pack; that stays on your log, not as a shared award record. The Coach pack and CPD evidence pack are printable views of your own log — they are not sent to Paddle UK / BCAB unless you print or upload them yourself. Log also shows your claimed points still counting (each training entry has its own valid-for, default 3 years) and when the next chunk drops out. You may set an optional Update Scheme target on Personal details. Due-soon for that target appears only on your Log, Personal details, and account home — not on the roster, not in the weekly digest, and not as a JustGo balance.
- When you redact sign-in PII: the live participant row is cleared; the log book entry stays with a redacted label.
- When archived sessions are purged: sign-in rows are deleted; log book entries are detached and kept for the leader (and participant link where applicable).
- Erasure: leaders can erase a log book entry in one step; participants can remove a trip from their log book view (your link only).
- Lawful basis (typical): legitimate interests in leadership CPD, safeguarding audit, and demonstrating safe practice — separate from live emergency-contact processing.
Retention
Archived (completed) sessions are kept for 24 months by default, then permanently deleted (participant sign-in rows included). Log book entries are detached, not deleted, unless log book retention is enabled. Override session retention with GDPR_RETENTION_COMPLETED_MONTHS.
Log book auto-purge: disabled (default). Set GDPR_RETENTION_LOGBOOK_MONTHS to a positive number to delete old log book entries during scheduled purges.
Active sessions are not auto-deleted. Leaders may redact PII on individual sign-ins or erase log book entries. Organisation admins can purge this club’s archived sessions from Club profile; site administrators can run a host-wide purge (all clubs, plus optional log book). Backups must follow the same retention rules as the live database.
No retention purge has been logged yet at host level. Organisation admins can purge their archived sessions under Organisation → Club profile. Site administrators can run a host-wide purge from Site: leaders; schedule python -m psl.purge_retention via cron if desired.
Your rights (UK GDPR)
You may have the right to access, rectify, erase, restrict, or object to processing, and to complain to the ICO. Contact your club / session organiser first.
Export your data (subject access)
- Participants: on your personal safe-return page, use Download a copy of my information (JSON file).
- Leaders: sign in, then use Download a copy of my information on Personal details (JSON — your own data only).
Step-by-step: Privacy and your data. Club procedure: Handling a data request.
Security and access
Data is stored in a local safety_log.db SQLite file on the machine that runs the server. You are responsible for HTTPS, backups, and access control.
Session cookies keep you signed in (HttpOnly, SameSite=Lax; Secure when the public URL is HTTPS). There is no advertising or analytics cookie. Pages that show personal data are marked so shared caches should not keep them. Links are not sent to other sites as a Referer, so a personal trip link is not attached when someone follows an external link.
Optional processors if the host turns them on: geocoding via OpenStreetMap Nominatim (place names only); email (SMTP) for duty alerts and the weekly first-aid / safeguarding digest to organisation admins; SMS via Twilio for duty alerts. Those providers see only what the alert or geocode request contains — not a full medical roster.
Sign-in and sign-up limits. Repeated wrong passwords lock that sign-in for 15 minutes. Those failure records are deleted as they age out of that window. Sign-up and session join are limited per network so a script cannot flood the database with personal details.
Access log. Password resets, duty-pack downloads, and sign-in lockouts are recorded with the name of the person who did them. Host-wide retention deletes those rows on the same timetable as completed sessions. A reset is a one-time link. The link is not stored in the log. The person chooses the new password.
Duty pack. Organisation duty can download a PDF of upcoming and live sessions, including the SAR summary and roster medical notes, for use if the site is unreachable. That file is a copy of special-category data. Delete it when those sessions are over. The download is on the access log.
Leader emergency summary. While a session is still active, the leader can download a PDF of that session’s emergency summary (names, emergency contacts, and medical notes) for use on the water if the site is unreachable. Delete that file when the session is over. The leader may also open WhatsApp to the duty officer’s UK mobile, and to the escalation contact when that number is a different UK mobile. Each message is the confidential share link to that one person. The link stays in the chat until they delete it.
Leader URL secrecy: anyone with the leader link can view and edit participant details for that session — treat it like a password.
Participant “mark safe” links: anyone with the link can mark that row safe; do not share publicly.
Redaction and minimisation
Full PII redaction (leader): clears names, contacts, address, GP, medical, and notes for that row; a minimal audit row may remain. Your log book entry for that trip is kept with a redacted pseudonym.
Archive name privacy (participant): hide your name on the public past-sessions list; leaders retain full records unless redacted.
Leader name on public pages: leaders may redact their name on public session views; site administrators and leader tools still show the real name.