Security Policy

Bluewaters Club holds only the minimum personal information needed to run the Club. This Policy sets out how we protect that information and how to report a security concern.

1. Scope

This Policy applies to all personal data held by the Club — member records, booking correspondence, payment information (as processed by our provider), and any information you share with the Secretary.

2. Data location

Member records are held on infrastructure located within the European Union. Payment information is not stored by the Club; it is handled by our payment provider on their own PCI-compliant infrastructure.

3. Access controls

Access to member records is limited to the Secretary and, on a need-to-know basis, the Skippers and Committee members responsible for administration. All administrative access requires multi-factor authentication. Records of access are retained for one year.

4. Transmission

All personal information transmitted between you, the Club, and our providers is protected in transit using standard TLS encryption. We do not accept membership or booking information through unencrypted channels.

5. Backups

Backups of Club records are taken daily, encrypted, and retained on a rolling thirty-day basis. Backups older than thirty days are permanently deleted.

6. Incident response

In the unlikely event of a data breach that affects member information, we will notify affected members within seventy-two hours of becoming aware of the incident, and cooperate with the relevant data protection authority as required by law.

7. Reporting a concern

If you believe you have identified a vulnerability in the Club's systems, or if you have a security concern about how your information is being handled, please write to the Secretary at secretary@bluewaters.club with the subject line "Security". We treat these communications with priority and will acknowledge receipt within two working days.

8. Third-party providers

We work with a small number of vetted third-party providers (payment processing, accounting, website hosting). Each is bound by a data-processing agreement that requires them to maintain security standards at least as strong as those set out in this Policy.

9. Review

This Policy is reviewed annually by the Committee, and revised as necessary. Material changes are noted at the top of this page.