Privacy Policy

This policy explains what personal data ActivityRoster (“we”) processes, why, and your rights under the UK GDPR and the EU GDPR. It covers the ActivityRoster website and the rostering platform used by sailing & watersports centres.

Who is the data controller

ActivityRoster is a product of ActiveRoster Ltd, registered in England & Wales, 71-75 Shelton Street, London WC2H 9JQ, United Kingdom. For personal data you give us as a customer or visitor (your account, billing, enquiries), ActiveRoster Ltd is the data controller. For data a centre stores about its own staff and operations inside the platform, the centre is the controller and ActiveRoster Ltd is the processor acting on the centre's instructions (see our Data Processing terms).

What we collect

• Account details: name, email, and a hashed password / login PIN.
• Centre details: centre name, subdomain, region and jurisdiction.
• Staff records entered by a centre: instructor names, contact details, certs (qualifications), DBS/vetting and other compliance records, availability, hours and leave.
• Billing data: we store only Stripe identifiers and invoice metadata — never card numbers (Stripe handles card data).
• Usage & technical data: log data, IP address and cookies strictly needed to run the service.

Why we process it (lawful bases)

• To provide the service you signed up for (performance of a contract).
• To keep the platform secure and prevent abuse (legitimate interests).
• To take payment and meet tax/accounting duties (legal obligation).
• To send service and, where you have agreed, marketing emails (consent / legitimate interests).

Where your data lives

Platform data is stored in the EU (Cloudflare D1 and R2, EU jurisdiction). Payments are processed by Stripe and email by Resend, who may process limited data under their own safeguards. We pin data residency to the EU/UK for GDPR.

How long we keep it

We keep account and centre data for as long as the centre is active, and for a limited retention window afterwards so a centre can export its data before deletion. Billing records are kept as long as the law requires. You can request earlier deletion (see below).

Sharing

We do not sell personal data. We share it only with the sub-processors needed to run the service (hosting, payments, email) and where legally required. A current list of sub-processors is available on request.

Your rights

You have the right to access, correct, delete, restrict or object to processing, and to data portability. Centres can export their data at any time from Settings. To exercise a right, email privacy@activityroster.com. You may also complain to the UK Information Commissioner's Office (ICO) or your local supervisory authority.

Security

Passwords and PINs are stored only as salted hashes; documents are held in a private, per-centre file store; each centre's data is strictly isolated; and access is authorised on every request. We use TLS in transit and apply security headers and rate limiting.

Contact

Questions about this policy: privacy@activityroster.com. Or write to us at ActiveRoster Ltd, 71-75 Shelton Street, London WC2H 9JQ, United Kingdom.