Privacy

Privacy Notice

Central Scotland Bodyboarding Club C.I.C. is committed to protecting your personal information and being transparent about how it is used.

This notice explains what personal information we collect, why we use it, how it may be shared and the rights you have under UK data protection law.

It applies to personal information processed by CSBC in connection with our website, club activities, event bookings and other services that we operate.

1. Who we are

Central Scotland Bodyboarding Club C.I.C. (company number SC895930) is a Community Interest Company that operates Central Scotland Bodyboarding Club, a bodyboarding club in Scotland.

For the personal information described in this notice, CSBC is the data controller. That means we decide how and why that information is used.

For privacy requests, email [email protected].

We have not named a Data Protection Officer in this notice.

2. What personal information we collect

We only collect the information this website and booking system actually use.

Membership records held by the committee may include:

• membership ID
• name
• email address
• mobile number
• membership end date
• whether the record is active

When you book a paid meet, the form asks for your membership ID, name, wave side and agreement to the booking terms. We then copy the email address and mobile number already on your membership record.

When you register interest in a meet, the form asks for your name, email address and mobile number.

For payments we keep booking status, amount, and Stripe session, payment and refund identifiers. We do not collect or store card numbers on this website.

Get Involved messages include your name, email address, area of interest and message. Those are emailed to the club. They are not stored in the booking database.

We also process limited technical information used to keep the site secure, including an IP address used for short-lived rate limits, and a committee login cookie for people who administer the site.

Committee, event and partner images may be uploaded by the committee for the public pages.

This website does not collect health information, emergency contacts, dates of birth, addresses or children's membership details.

3. How we obtain information

We obtain personal information:

• directly from you, when you book a meet, register interest or send a Get Involved message
• from the committee, who add or import membership records by hand or CSV after you have joined through Scottish Surfing
• from Stripe, which tells us whether a payment succeeded, failed, expired or was refunded
• from your browser, for security rate limits and, if you are a committee user, for the admin session

We do not receive membership records automatically from Scottish Surfing or JustGo. There is no data feed from those systems into this website.

4. Why we use personal information

We use personal information to:

• verify that a booking is for an eligible club member
• administer meet bookings, holds, transfers and cancellations
• take, confirm and refund payments
• send booking and membership messages when email is configured
• reply to Get Involved enquiries
• keep club financial and booking records
• protect the website against abuse
• publish committee, event and partner material the committee has chosen to show

5. Lawful bases for processing

Under UK GDPR we rely on the following bases for the activities this site actually performs. This is the club's current assessment, not a guarantee of legal compliance.

• Contract — to take a paid booking, hold a place, take or refund payment, and send the related booking message.
• Legal obligation — to keep payment and accounting records the club is required to retain.
• Legitimate interests — to keep a membership list so the club can run booked sessions; to answer Get Involved messages; to keep the site secure; and to operate the committee login. Those interests are running a community sports club and protecting members and the club.
• Consent — for interest-only meets, where you tick to agree that we may use your details to contact you about that meet.

We do not treat ticking the booking terms, or reading this notice, as consent for unrelated marketing.

Where we rely on consent, you can withdraw it by emailing [email protected]. That will not affect processing that has already taken place.

We do not process special-category information through this website.

6. Membership information and Scottish Surfing

Club membership is administered through Scottish Surfing, using its membership infrastructure, including JustGo at https://ssf.justgo.com/.

Scottish Surfing is the controller for the information you give them when you join or renew. Their privacy notice is published at scottishsurfing.scot. That notice covers their processing, not CSBC's independent booking system.

After you have joined, you email [email protected] so the committee can add your membership ID, name and contact details to this booking list. Until that is done, this website cannot recognise you.

7. Event bookings and payments

Paid bookings are completed through Stripe Checkout. Stripe processes the card payment on its own pages. This website stores the booking, the side you chose, the amount, the status, and Stripe identifiers needed to confirm or refund the payment.

A place is held for 31 minutes while you pay. If payment is not completed, the hold expires.

A booking may be transferred to another current member if the members arrange that between themselves and the committee amends the record. The old and new details are kept in a transfer record.

We do not share booking information with venues or other clubs through this website.

8. Sharing information

We share personal information only where it is needed to run the club or required by law. Recipients include:

• authorised committee members
• Stripe, for payments and refunds
• Resend, when the club sends email
• Cloudflare, which delivers the public website, protects the committee area, and stores encrypted backups
• the hosting and database used to run this site

The committee can export a meet booking or interest list as a CSV for club administration. We do not sell personal information.

9. International data transfers

Some of the organisations above may process information outside the United Kingdom, including Stripe, Resend and Cloudflare. Where that happens, they use the transfer tools they publish for UK and EU data protection law. We do not claim that all personal information stays in the UK.

10. How long we retain information

The club currently applies these operational periods:

• membership records: while you are on the booking list, and afterwards where the club still needs the record for legal or financial reasons
• expired or failed booking holds: 30 days
• interest registrations: 90 days after the meet
• Stripe event identifiers used to prevent duplicate processing: 180 days
• paid or refunded booking records: six years, after which names and contact details on those records are anonymised

Get Involved messages are sent by email. This website does not keep a separate copy or apply an automatic deletion period to that inbox.

If you ask us to delete information, we will do so where the law allows. We may have to keep records the club is legally required to retain.

11. Keeping information secure

We restrict the booking and membership records to authorised committee members. The committee area is protected by a login and, in the live setup, Cloudflare Access. Secrets used by the site are stored separately from the public pages.

No website can promise absolute security. If we become aware of a breach that must be reported, we will follow the law that applies at the time.

12. Individual rights

Under UK data protection law you may have the right to:

• access the personal information we hold about you
• have inaccurate information corrected
• ask for information to be erased
• ask us to restrict how we use it
• object to processing based on legitimate interests
• receive information you provided in a portable form, where that right applies
• withdraw consent where we are relying on consent

This website does not make solely automated decisions that produce legal or similarly significant effects.

Some rights are subject to legal conditions and exemptions. To use them, email [email protected].

You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint.

13. Cookies and similar technologies

This public website does not use analytics, advertising or social-media tracking cookies.

The only first-party cookie set by the application is a committee session cookie, used so authorised people can stay signed in to the admin area. That cookie is essential for that service.

If you pay for a meet, Stripe may set cookies on checkout.stripe.com. Those cookies are controlled by Stripe on Stripe's site.

The payment confirmation page may use session storage in your browser to refresh the booking status. That is not used for advertising.

Because this site does not use non-essential tracking cookies, there is no cookie consent banner.

14. Children's information

This website does not have a junior membership form and does not collect a date of birth or parental contact details.

If a young person joins Scottish Surfing through JustGo, that information is processed by Scottish Surfing under their notice, not by this booking system.

15. Photographs and video

Committee photographs on this site were supplied for that purpose by the people shown.

The website does not collect consent for photographs taken at club meets. Attendance at a meet is not treated as permission to publish identifiable photographs. The club does not currently operate a recorded media-permission process on this site.

16. Changes to this notice

We may update this notice when the club's activities or processing arrangements change. This version was last updated on 25 October 2026.

17. Contact us

For privacy requests, email [email protected].

Do not use committee members' personal addresses for privacy requests unless they have asked you to.