Privacy Policy

Privacy Policy — MTsail Maritime Training

1. Who we are MTsail Maritime Training is an RYA-recognised training centre. Our Data Protection Officer is Teresa Townsley — teresatownsley@gmail.com. This policy explains how we handle the personal information we hold about you, whether on paper or electronically.

2. What data we collect and why When you book a course we collect: name, address, nationality, passport number, date of birth, contact details, emergency-contact details, and a Fitness-to-Take-Part and Health Declaration. We use this data to deliver the course you booked, to keep you safe on the water, and to meet our RYA reporting obligations.

Lawful bases (following our legitimate-interests assessment):

• Contract — to fulfil our obligations to you and to respond to pre-booking enquiries.
• Legitimate interests — running the training centre safely and efficiently.
• Consent — for optional processing (e.g. marketing emails, photographs used on our website or social media). Consent can be withdrawn at any time by emailing the DPO.

3. Who we share data with

• RYA — on successful course completion, your name, contact details, date of birth, certificate number and date of issue are transmitted to the RYA via a secure web portal so the RYA can record your qualification. See rya.org.uk/privacy-policy.
• Emergency services and next of kin — only in the event of an accident or medical emergency.
• Our payment processor — for booking deposits and balances (they do not receive your medical information). We do not sell your data. We do not share it with third parties for marketing.

4. Medical information Held only for the duration of the course and then shredded/deleted. All medical forms include an express consent statement for use in course assessment.

5. Retention

• Course records and RYA reporting data: retained for 7 years after the course, for insurance and audit.
• Medical forms: destroyed at the end of the course.
• Marketing preferences: retained until you unsubscribe.

6. Cookies and analytics Our website uses Google Maps to display our location. Google may set cookies as part of that service — see Google's privacy policy for details. We use minimal analytics to understand which pages are read; we do not use these to identify individuals.

7. Your rights Under GDPR you have the right to: access the data we hold about you; ask us to correct it; ask us to erase it (where we are not obliged to keep it); ask us to restrict or object to processing; and receive a portable copy of the data you gave us. To exercise any of these rights, email the DPO at teresatownsley@gmail.com. We respond within one month.

You also have the right to lodge a complaint with a supervisory authority — in Spain, the Agencia Española de Protección de Datos (aepd.es); in the UK, the Information Commissioner's Office (ico.org.uk).

8. Security Data is held on password-protected devices and encrypted backups. Paper records are kept in a locked filing area. Only the Principal, Chief Instructor, DPO and course instructors have access to the data they need to do their jobs.

9. Third-party websites Our website may link to external sites (RYA, marinas, suppliers). We are not responsible for the privacy practices of those sites.

10. Changes to this policy We review this policy annually. The current version date is shown at the top of this page.