Dockside Privacy Policy

Last updated: 22 April 2026

We've tried to make this page as easy to get through as possible. Your privacy is important to us, and you entrust us with your data. We take that responsibility seriously.

This policy explains what personal data we collect, why we collect it, how we look after it, and what rights you have over it. It is written to be compliant with UK GDPR, the EU GDPR where it applies to you, and the Data Protection Act 2018.

1. Who we are and when this policy applies

Dockside is operated by Artemis Consulting Limited (trading as Dockside) (“Dockside”, “we”, “us”). If you hold a Dockside account, use our website, or appear in sailing results we collect, this policy applies to you.

Dockside processes personal data in two different roles, and it is worth knowing which one applies to you:

  • When you hold a Dockside account (as a sailor, club official, race officer, or admin), we are the data controller for the data you give us to hold your account and to interact with the platform.
  • When you are a member of a sailing club or association that uses Dockside, your club or association is the data controller for your membership, event, and racing data. Dockside acts as their data processor — we hold and process that data only on their instructions, under a contract called a Data Processing Agreement. Questions about that data should normally go to your club or association in the first instance; we will help them respond.

We note above which role applies to each activity so you know whom to contact.

2. What information we collect

Information you give us. When you create an account you provide your name, email address, and date of birth. You may also provide boat details, sail number, club memberships, emergency contact details, and profile preferences. We encrypt sensitive fields (your name, date of birth, emergency contacts, and additional email addresses) so they are protected even if a database copy is ever compromised.

Information about your sailing activity. When you enter events, sign on for race days, or record results, we hold that information so your club or association can run the event and publish results.

Information we collect automatically. Like most online services, we collect anonymous data about how people use Dockside — page views, performance metrics, and error reports. This helps us find and fix problems and work out what to build next. We do not profile named users through analytics.

Information collected from public sources. We collect publicly available sailing results published by clubs and race organisers, including data generated with Sailwave and similar scoring systems. This typically includes a sailor's name, sail number, club, race results, and related performance data. We only process factual results that have already been made public. We respect robots.txt and other access controls during collection. If your information appears on Dockside and you would prefer it not to, please contact us (Section 9) and we will remove or anonymise it.

Special-category (sensitive) data — medical and dietary information. Sailing is a safety-critical activity. To run a race day responsibly, your club or association may ask you (or your parent or guardian, if you are a junior sailor) for information about medical conditions, medications, and dietary requirements that are relevant to your safety on the water. This information is treated under the special-category rules of UK GDPR Article 9. We encrypt it at rest, restrict access to authorised race officers and admins, and log every time anyone reads it. We never use it for marketing, analytics, or any purpose other than running your event safely.

Event photographs. Your club or association may upload photographs from events, training, and club activities. These can include images of identifiable individuals, including children. Your club or association is responsible for getting the right consents (including parental consent for any image that identifies a child). Dockside applies default-restricted visibility to images of children. If you (or, for a child, the parent or guardian) want a specific photograph removed, contact us or your club and we will action the removal within 14 days.

What we don't collect. Dockside is not designed to hold information about your race or ethnicity, religious or political beliefs, sexual orientation, trade union membership, biometric or genetic identifiers, or criminal records. If that ever changes for a new feature, we will update this policy and seek appropriate consents before the change goes live.

3. Why we use your information (our legal basis)

Under UK GDPR we must rely on a specific legal basis for every activity. Ours are:

a) To make Dockside work for you — contractual necessity (Art. 6(1)(b))

We need your email to create your account, your name to display on sign-on sheets, your boat details to enter you into races, and so on. Without this basic data we cannot provide the service you've asked for.

b) Safety at sea — vital interests (Art. 6(1)(d))

Emergency contact information is used in the event of an on-the-water incident to help reach your next of kin or nominated contact. Storage of the emergency contact is on the basis of contract (we need it to provide the service); use in an incident is on the basis of vital interests.

c) To aggregate and publish race results — legitimate interest (Art. 6(1)(f))

We collect and display publicly posted sailing results so the community has a central record of race outcomes, and so sailors can view their history in one place. We minimise the data we hold, respect access controls at collection time, and honour removal requests promptly. After a long period of inactivity we anonymise a sailor's name on historical records while preserving the race result itself.

d) To make Dockside better — legitimate interest (Art. 6(1)(f))

We use anonymised and aggregated usage data to improve the platform and fix bugs. We do not profile named users, and you can opt out of analytics cookies at any time via your cookie preferences.

e) To communicate with you about the service — contractual necessity (Art. 6(1)(b))

We use your email to send service-related information: account notifications, sign-on confirmations, password resets, and similar. You cannot opt out of these while you have an active account, but we keep them to a minimum.

f) Marketing and newsletters — consent (Art. 6(1)(a))

For anything beyond service communications — product updates from Dockside, club or association marketing, newsletters — we rely on your explicit consent. You can withdraw consent at any time from your account preferences, and we keep a record of when consent was given or withdrawn.

g) Security, fraud prevention, and legal compliance — legal obligation and legitimate interest (Art. 6(1)(c), 6(1)(f))

We log significant actions on the platform to help us investigate problems, support customers, and meet our accountability obligations under GDPR.

A fuller register of every activity and its legal basis is maintained internally and can be provided on reasonable request.

4. Children's data

Dockside is routinely used to record and manage data about junior sailors, and we take this seriously. The age of digital consent is 13 in the UK and 16 in the Republic of Ireland. For data subjects under that age, we require the consent of a parent or guardian.

We have assessed Dockside against the UK ICO's Age Appropriate Design Code. In particular: a child's contact details are restricted by default in membership directories; the parent or guardian's email is set as the primary contact; we do not use children's data for marketing, profiling, advertising, or product improvement; and parents and guardians can request takedown of any image of their child (action within 14 days).

If you believe we hold information about a child without appropriate consent, please contact us immediately and we will take prompt action.

5. Who we share your data with

We do not sell your personal data. We share it only with carefully chosen third parties that help us run the service, each bound by a written data-processing contract:

  • Vercel — application compute (London, UK) and CDN. Operational logs and platform observability data are processed by Vercel's US control plane under UK IDTA / EU SCCs; we redact personal data from these logs.
  • Neon — PostgreSQL database hosting (EEA).
  • Brevo — transactional email delivery (EU).
  • AWS S3 — object storage for uploaded files, event photographs, and signed PDFs (EEA).
  • Stripe — payment processing (UK and US). Stripe captures card details directly — we never see your card number.

Our full, up-to-date list — with purpose, hosting region, and transfer mechanism — is at dockside.app/sub-processors. We commit to giving our customer organisations at least 30 days' notice before adding a new sub-processor.

Beyond these service providers, we will only disclose personal data where we are legally required to (for example, a valid court order or regulatory request), and we will push back on any request that appears to overreach.

6. How long we keep your data

We keep personal data only as long as necessary for the purpose for which we collected it. The main defaults are:

  • Active accounts — for the life of the account.
  • Inactive accounts — pseudonymised 36 months after last activity.
  • Emergency contacts and safety-relevant medical/dietary data — purged immediately on deactivation or account deletion.
  • Event and sign-on records — 7 years after the event.
  • Race results — indefinite. Honestly: published race results identify the sailor by sail number as well as name, so we cannot fully anonymise them. If you do not want your name on past results, you can ask us (or your club) to redact it under your right to object — see Section 7.
  • Event photographs — for the lifetime of your club's use of Dockside, with image-by-image takedown on request within 14 days.
  • Payment records — 6 years (UK accounting and tax obligations).
  • Email delivery logs — 12 months. Consent records — kept indefinitely so we can always evidence the state of your preferences.
  • Audit logs — 6 years. Security event logs — 24 months.

If you close your account, we delete your credentials, profile, emergency contact, and any medical/dietary information immediately. Historical race results are kept (per above) but you can object to your name appearing on them. Backups rotate on a fixed schedule; after rotation they cannot be restored.

7. Your rights

Under UK GDPR you have the following rights over your personal data:

  • Right of access — ask for a copy of the data we hold about you.
  • Right to rectification — correct inaccurate or incomplete data. Most fields can be edited directly in your profile.
  • Right to erasure — ask us to delete your account and associated personal data. Historical race results are anonymised rather than deleted (see Section 6).
  • Right to restriction — ask us to limit how we process your data in certain circumstances.
  • Right to data portability — get a copy of your data in a machine-readable format so you can move it elsewhere.
  • Right to object — object to processing we carry out on the basis of legitimate interest, including analytics and the collection of your publicly posted race results. Where you object to your name appearing on historical race results, the relevant club or association assesses your objection. If they accept it, we redact your name from the published results (the sail number, boat, and position remain).
  • Right to withdraw consent — where we rely on consent (for marketing and optional cookies), withdraw it at any time.

Where your club or association is the controller of data about you (see Section 1), you exercise these rights with them; we help them respond. Where Dockside is the controller (your Dockside account itself, public race results we collect, and analytics), you can exercise these rights with us directly.

Self-serve data export and account deletion are being rolled out in your profile settings. Until those are live, please contact us (Section 9) and we will action your request within one month.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk if you think we have not handled your data fairly.

8. International transfers

Most of our processing happens within the United Kingdom or the European Economic Area. Where a sub-processor (such as Stripe for payments) processes some data in the United States, that transfer is protected by Standard Contractual Clauses and the UK International Data Transfer Agreement included in their Data Processing Agreement.

Full detail on transfers, regions, and safeguards is at dockside.app/sub-processors.

9. Security

We implement appropriate technical and organisational measures to protect your information. Our main measures are:

  • AES-256-GCM field-level encryption at rest for sensitive personal data.
  • TLS 1.2 or higher in transit.
  • Role-based access control enforced at application and API layers.
  • Comprehensive audit logging of significant actions.
  • Regular security reviews and a documented incident-response process, including a 72-hour commitment to notify affected parties of any personal data breach.

10. Cookies

We use a small number of strictly necessary cookies to keep you signed in and to remember your preferences. Any optional cookies (for analytics or advertising) are loaded only with your explicit consent. See our Cookie Policy for the full list and how to manage your choices.

11. Changes to this policy

We may update this policy from time to time, for example if we add a feature that involves new types of data, or if the law changes. We will notify you of significant changes by email or through a prominent notice on the website. Continuing to use Dockside after a change means you accept the updated policy.

12. Contact us

For any question about this policy, the data we hold about you, or to exercise a right, please contact us. Our primary data-protection contact is the founder.

If we are your processor because your club or association uses Dockside, please contact them first — they can action most requests directly, and we will help.

Artemis Consulting Limited (trading as Dockside). Last updated: 22 April 2026.