Privacy notice

NORTHING is the public-facing name of this website. The website operator is Whitstable Yacht Club, using the operator details shown in this notice.

1. Who is responsible for your information

Whitstable Yacht Club is the controller for personal information described in this notice. Our address is Sea Wall Whitstable Kent CT5 1BX. You can contact us about privacy matters using [email protected] or +44 148 1734967. We have not stated a data protection officer because no DPO contact has been provided for this website.

2. Information we collect

When you submit an enquiry, we may collect your name, email address, optional telephone number, group size, preferred trip format and any information you choose to include in later correspondence. We also receive technical information needed to deliver and protect the website, such as IP address, browser and device information, approximate request time, requested pages and security or error records.

Where optional measurement or marketing technologies are enabled, information may also be generated about interactions with the website. The precise technologies, purposes and controls are described in our Cookie Policy.

3. Why we use personal information and our lawful bases

We use enquiry information to respond to you, clarify your requested route or format, and take steps you ask us to take before any potential booking. Where this activity is genuinely connected with entering into a contract, we rely on the UK GDPR lawful basis for taking steps at your request before contract. We may also rely on our legitimate interests to manage ordinary correspondence, improve our service, prevent misuse, keep the website secure and maintain appropriate business records, provided those interests are not overridden by your rights and interests.

We may process information where necessary to comply with a legal obligation, including accounting, tax, regulatory or lawful disclosure requirements. Where consent is the appropriate basis — for example for certain optional storage/access technologies or direct marketing — you may withdraw that consent at any time for future processing.

4. Enquiry handling and recipients

Access to personal information is limited to people and service providers who need it for website operation, communications, security, professional support or enquiry handling. If an enquiry needs to be considered by a separate vessel or service provider, we will only pass on information where there is an appropriate lawful basis and where the disclosure is relevant to the request. A separate operator may act as its own controller for information it receives and should provide its own privacy information where required.

Website resources may be delivered through external font, script or content-delivery services. Those providers may receive normal technical request data when your browser retrieves a resource. We keep the number of external services limited and do not treat the presence of a third-party resource as permission for unrelated advertising or profiling.

5. Retention

We keep personal information only for as long as necessary for the purpose for which it was collected and for any related legal, accounting, dispute or regulatory needs. Enquiry correspondence is reviewed against whether the enquiry is still active, whether a booking or other relationship followed, whether either party could reasonably need the record to resolve a dispute, and whether another law requires retention. Technical security records are kept only for the period reasonably needed to investigate reliability, security or misuse.

6. International transfers

Some technology or professional service providers may process information outside the United Kingdom. Where UK data protection law requires a transfer safeguard, we use an applicable UK adequacy regulation, approved contractual safeguards or another lawful transfer mechanism, and apply additional measures where appropriate. You may contact us for further information about safeguards relevant to your information.

7. Your rights

Depending on the circumstances and lawful basis, you may have rights to be informed, access your personal information, correct inaccurate information, request erasure, restrict processing, object to certain processing and receive certain information in a portable format. Where processing is based on consent, you can withdraw consent. These rights are not absolute and an exemption or another legal requirement may apply.

You can raise a privacy request with us using the contact details above. You also have the right to complain to the UK Information Commissioner if you are concerned about how personal information has been handled. We encourage you to contact us first so we can address the issue directly, but doing so does not remove your right to approach the regulator.

8. Cookies and storage/access technologies

Our Cookie Policy explains the categories of technologies used or contemplated on the website, their purposes, duration and how you can change your choices. Essential technologies may operate without optional consent where the law permits. Other technologies are handled in accordance with PECR and UK data protection law, including the changes introduced by the Data (Use and Access) Act 2025.

9. Security

We use proportionate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. No internet service can promise absolute security, so we also limit the amount of information collected and retain it only while there is a justified need.

10. Changes to this notice

We may update this notice when our services, technology or legal obligations change. The date shown on this page indicates the latest revision. Material changes will be presented in a way that is reasonably likely to bring them to the attention of affected users.