UKOPRA ("we", "us", "our") is committed to protecting and respecting your privacy. This notice explains what personal data we collect, why we collect it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

The data controller is UKOPRA. For data protection enquiries, please contact us via our Contact page.

2. What We Collect

We collect the following categories of personal data:

• Identity data: full name, date of birth
• Contact data: email address, mobile phone number, postal address
• Emergency contact data: name, phone number, and relationship of your nominated emergency contact
• Health data: medical conditions relevant to racing safety (collected via your licence application)
• Safety data: EPIRB HEX codes, safety equipment details
• Financial data: payment information is processed by Stripe and is never stored on our servers

3. Why We Collect It

We process your data for the following purposes:

• To manage your racing licence and boat registrations (contractual necessity)
• To ensure safety at events and enable emergency response (vital interests / legitimate interest)
• To process payments for registrations and event entries
• To communicate with you about your applications and events (legitimate interest)

4. Who We Share It With

Your data may be shared with race officials, safety officers, and emergency services where necessary for safety purposes. We use Supabase for data storage and Stripe for payment processing, both of which act as data processors on our behalf.

5. How Long We Keep It

We retain your data for as long as you hold an active account. After account closure, data is retained for up to 6 years for legal and safety record-keeping purposes.

6. Paddock Fan Features

UKOPRA Paddock is our public fan-facing surface — team link pages, race-number lookup, and QR codes at events. Fans can interact with Paddock without creating an account. The following data processing applies only to fans using these public features.

6.1 Team email updates (fan subscribers)

When you submit your email address (and, optionally, your WhatsApp number) through a team's "Follow This Team" form, we store it so the team can send you race results and team updates.

• Data collected: email address, optional WhatsApp number, the team you subscribed to, the date and source of your subscription, and a record of the consent wording shown to you at the time.
• Lawful basis: your explicit consent (UK GDPR Article 6(1)(a)). You actively tick the consent box and submit the form; we do not add fans through any other route.
• Double opt-in: we send a confirmation email to verify that the address belongs to you before any further messages are sent.
• Who sees it: the team you subscribed to, UKOPRA as platform operator, and our email and messaging processors (Resend for email; WhatsApp Business if you provided a WhatsApp number). We do not sell or share fan email addresses with sponsors or third parties.
• Retention: we keep your subscription record for as long as you remain subscribed. Once you unsubscribe, we retain a minimal suppression record (your email address and the unsubscribe date) so we do not contact you again, and purge the rest of the record within 24 months.

6.2 Unsubscribing

Every email and WhatsApp message we send on behalf of a team includes a one-click unsubscribe link. Clicking the link is enough — you do not need to log in, confirm, or reply.

• The link contains a unique token tied to your subscription. Opening it records your unsubscribe request immediately and stops any further messages from that team.
• Unsubscribing is idempotent — visiting the link more than once has no additional effect and will not produce an error.
• If you lose the link, you can request removal by emailing info@ukopra.co.uk from the subscribed address.

6.3 QR code scans at events

UKOPRA Paddock uses QR codes on boat hulls, pit boards, and printed materials at events. Scanning a QR code redirects you to a team's public Paddock page. We record each scan so teams and sponsors can measure the reach of their branding.

• What is recorded: the QR code that was scanned, the time of the scan, your browser's user-agent string, the referring page (if any), and a coarse location — the ISO two-letter country code and city name of the scan.
• How the location is derived: our hosting provider (Vercel) resolves your approximate location at its edge network using the connecting IP address, and passes only the resulting country and city headers to our application. Your raw IP address is not stored, logged in our application logs, or passed to teams or sponsors.
• Lawful basis: legitimate interest (UK GDPR Article 6(1)(f)) — teams have a legitimate interest in measuring the effectiveness of their branding at events, and the data is limited to coarse geographic information with no direct identifier of the individual scanning.
• Who sees it: aggregated scan counts and country/city breakdowns are shown to the scanned team in their dashboard, and to sponsors in downloadable event reports. Raw scan rows are accessible only to UKOPRA administrators.
• Retention: individual scan rows are retained for 24 months for season-over-season reporting, after which they are aggregated into anonymous monthly totals and the underlying rows are deleted.

7. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure of your data
• Restrict or object to processing
• Data portability
• Lodge a complaint with the ICO (ico.org.uk)

To exercise any of these rights, please contact us via the Contact page.