Privacy Notice — Castleconnell Boat Club

This notice describes how Castleconnell Boat Club ("we", "the Club") processes personal data when running regattas through the rowOps Race platform.

Who is the controller?

What we process

For each rower entered in a regatta we process:

• First name + surname — to identify entries in start lists, draws, and results.
• Rowing Ireland membership ID — to link our records to the Rowing Ireland federation database. Sourced from RI's own CSV exports under the data-sharing arrangement set out in the RI privacy policy.
• Crew composition — which rowers are in which crews, and any race-day substitutions (who left a seat, who took it, when, and the reason the operator typed).
• Race results — finish times, positions, and any operator-applied flags (DNF / DQ / DNS).
• Replaced and reset results — when a result is corrected, replaced by another source, re-run or reset, we keep the value it replaced, with who changed it, when and why. When a race is reset we also keep its timing record, and the entry of a late entrant who had raced. These copies are used only to resolve disputes about a result, are seen by the Club's operators only, and are never published.
• Masters category (where applicable) — on the water, the category is given with the entry, or set by the Club's organiser, and is kept on the crew. At an indoor (erg) regatta, the age band is worked out from the rower's date of birth, and is kept with the result when the date of birth is deleted under the rule for rower names (see How long we keep it). Date-of-birth itself is never displayed publicly.
• Contact details on an online entry — where you enter through this site rather than through a Rowing Ireland export (indoor / ladder / open regattas), we hold the email address and, if given, the phone number of the entrant and of the club delegate who submitted the entry. Used to confirm the entry, chase a payment, and reach you about a change on race day. Never published.
• Para classification (where applicable) — the sport class (PR1 / PR2 / PR3) an adaptive competitor races in, its confirmation status and the classifier's name. This is health data under Art. 9(1) and is processed under Art. 9(2)(g) — a classified event cannot be run fairly without it. Visible only to Club admins; it is deliberately excluded from every public page and from the JSON API.
• Water-safety incident records — where an incident occurs on the water we record what happened, where, how serious it was, which crew was involved and whether a minor was involved. Incidents recorded as medical concern a person's health and are Art. 9 data, processed under Art. 9(2)(c) — vital interests — and Art. 6(1)(d). Operator-only; never published.
• Boat position (GPS) — where a regatta uses tracking, the boat's latitude, longitude, speed and heading are recorded through the race. The fix is tied to a boat and a tracker, not to a named individual, but a crew is identifiable from the draw, so we treat it as personal data. Live positions are shown on the public spectator map for the duration of the event.
• Payment records (paid entries only) — the amount, currency, and the payment reference our payment provider returns. Card details never reach this platform; they are entered on the provider's own hosted page. Where an entry fee — for a regatta, an indoor (erg) event or a ladder — is paid in person or by bank transfer instead, the Club's organiser records the amount, how it was paid (cash, bank transfer or other), an optional receipt or transfer reference, and which organiser recorded it and when. A recording made in error is never changed or deleted: it is marked void, with which organiser voided it, when and why, and kept as the record of what was corrected. The reference and the reason for a void can carry the payer's name, so both are deleted with the entry's other personal data.
• Per-second erg race telemetry (indoor erg regattas only) — during a live erg race the rowing machine reports, about once a second, your pace per 500 m, stroke rate, power output (watts) and the distance you have covered, and we store that stream against your entry. The live feed also keeps a copy in the race's timing record at your start, at each split, and when you finish or stop: your pace per 500 m, stroke rate, heart rate (if your monitor sends one), calories, stroke count, the distance covered so far and your split times so far. It is used to run the live race display and to draw a post-race pace and stroke-rate graph. Where the post-race graph is switched on, it is shown publicly beside your result, under the same name-withholding as the result itself: if you have objected to being listed publicly, the graph is shown without your name. Power output, heart rate, calories and stroke count are recorded but not published. The copy in the timing record is part of your telemetry: when the Club deletes a regatta's telemetry, that copy is deleted with it, and it counts toward the Club's stored data in the same way — except the distance covered, which stays on your finish (it is part of your result, kept so a later attempt can still be corrected). The times of each start, split and finish, and your result, are kept.
• Photo-finish images and video clips — camera images taken during a race, a video clip of the race and a photo-finish image of the finish line, captured as evidence for deciding results.
• Erg device keys (indoor erg regattas only) — the keys that let a venue's laptop send a rowing machine's readings to the platform. For each one we hold the name the Club gives it, which organiser set it up, when it was last used and, where it is given, a rowing machine's serial number. A key is stored only in a form that cannot be turned back into the key. The keys are used to check that readings come from a device the Club has set up.
• Concept2 Logbook link (indoor erg regattas only, where a person chooses to link their account) — the person's Concept2 account number, when the link was made and when it last synced and, for a link made directly with this platform, the encrypted keys Concept2 issues for it. It is used to read the person's saved workouts, with read-only access, and to match them to their entries so a result can be recorded.

For the officials and volunteers on a regatta's rota we process:

• Officials and volunteers — the name of each official and volunteer on a regatta's rota and the role they are given. Where the Club enters them, an official's qualification, a volunteer's mobile number and email address, and a note about either are held too. Nothing removes them automatically.

How we use it

• Race administration — drawing heats and finals, lane allocation, timing, and result publication. Legitimate interest of the Club (running fair competition) and contract performance for entered crews.
• Public results — Club + Surname + Initial appear on the live spectator page, draw, results, and downloadable JSON API. This mirrors the format published on raceclocker.com (Rowing Ireland's sanctioned results portal), under the same Art. 6(1)(f) legitimate-interest basis as RI use.
• Audit + safeguarding — every steward action is recorded for the operator audit log (kept 365 days then auto-purged).

Who we share it with

• Rowing Ireland — the federation receives our submitted results as part of the standard event-reporting flow.
• Other competing clubs — through the public draw / results pages.
• Stripe — where you pay an entry fee online. Stripe processes your name, email address and card details as a controller in its own right to take the payment and meet its anti-money-laundering obligations; we receive back only the amount and a payment reference. Fees settle into the Club's own Stripe account — the platform never holds the Club's money.
• Platform operator — rowOps Race the platform processes data on our behalf under a data-processing arrangement (Art. 28 GDPR). The platform does not use your data for any other purpose.

How long we keep it

• The regatta's own record — its draw, crews, results and race timing record — is kept for as long as the regatta is on the platform. The Club can delete only a regatta that was never published, never raced and never took money, and that has taken no online entries and has no online entry open. Nobody can delete a regatta that has raced or that holds money records (invoices that are not void, entries that are paid, refunded, part-paid or have a card payment in progress, fees taken by hand), protests, safety incidents, telemetry, kept copies of replaced results, ladder entries or a ladder season it seeds, while it holds them. All of a regatta's record is deleted when the Club's data is deleted from the platform (see the last item of this list). The personal data in the record is reduced as the items below say.
• Protests and rulings: the written grounds of a protest or appeal and the reasons given for its ruling are blanked two years after the protest is closed (ruled or withdrawn). A protest that is still open is not blanked by age. The outcome, any penalty, the dates, the crew and lane it concerned, who lodged it and who ruled on it, and the evidence attached to it (its kind, its caption and the reference typed for it) are kept as part of the regatta's record.
• Historic results: a result keeps the event, the club, the place, the time and the surname and first initial of each rower in it, with no end date, as part of the regatta's record (see the first item of this list). To have your name taken off a result, see Object under Your rights.
• Replaced and reset results (the kept copies): kept for dispute resolution for as long as the regatta's record is kept (see the first item of this list). If you ask us to erase your data, what happens to them depends on whether you raced alone — see Erasure under Your rights.
• Rower names + identifiers: 14 days after the last regatta the rower competed in has ended, and not before 14 days after the rower's own record was last changed, the rower's date of birth and Rowing Ireland ID are deleted and their first name is cut to its initial; the surname and initial stay with the results (see Historic results above). A rower who is in no regatta at all is treated the same way 14 days after their record was last changed. A regatta is dated by its end date, or by its start date when it has none; a regatta with no date at all does not count as ended, so a rower entered in one is not reached automatically. Where the rower's full name was also typed into a note, a reason or a protest, that text is blanked in the same run, unless a current rower of the Club has the same name. The files a regatta's results or draw were imported from, and any export of the regatta, carry names: they are not part of this run and are kept on the platform until the Club's data is deleted from it (see the last item of this list). A file a regatta's entries, event list or seed times were uploaded or fetched from is deleted once its import has run; anything of it still on the platform is deleted 14 days after the regatta ends.
• Online-entry contact details: blanked 14 days after the entry reaches a final state (approved, rejected or refunded); an entry still waiting for its payment is blanked 28 days after it was made. Either way, an entry's details are not blanked until 14 days after the event it is for has ended (for a ladder entry, its season), so the organiser still has them on the day, a late entry's included. An event with no date set, or a ladder season with no end date, does not hold them back.
• Entries made on this site (indoor erg, on-water and ladder): when an entry's contact details are blanked (see above), so are the entrant's name, date of birth and club, the name and email address of any club delegate who made the entry, and any notes the organiser added. A later change to an indoor or ladder entry within those 14 days starts them again. For a relay entry, each team member's name and date of birth are blanked at the same time, except those of a member who is still on the Club's current list of rowers, which are blanked once the member is no longer on it. An entry that has been paid, or that needs no payment, is kept in full until the organiser approves or rejects it. The rest of the entry is kept as the Club's record of it: the events entered, the weight class, expected times, the amount paid and the payment reference, and the organiser's reason for a rejection. That reason, like any note the organiser typed, is blanked earlier if it holds the full name of a rower whose first name has been cut to its initial, under the rule for rower names. The result the entry made keeps the entrant's surname and initial (see Historic results above).
• Para classification: the classification record (the sport class, its confirmation status, the date it is valid until, the classifier's name, when it was signed, where the classification came from and any notes) is kept until the rower record is purged or erased, and is then deleted outright; it is not deleted when it stops being valid. A para class declared on an indoor entry form is cleared with the rest of the entry's personal details (see the item above). The class copied onto a crew when the entry is approved stays on the crew as part of the result, and is cleared from the crew when a rower of that crew is erased.
• Water-safety incidents: the free-text account (what happened, where) is blanked 90 days after the incident is resolved. The longer window reflects the safeguarding duty to keep an incident record. Structural fields — kind, severity, date and which crew was involved — are kept for aggregate safety reporting; the names of that crew follow the crew's own retention. An incident that is never marked resolved is not blanked.
• Import diagnostics: the warnings raised when an entries file is loaded quote the crew label from that file, so they are cleared 14 days after the regatta ends. For a regatta with no end date, the record of an import is cleared 14 days after it was run, and the copy kept on the regatta itself 14 days after the regatta was last changed.
• Photo-finish images and video clips: deleted 30 days after the regatta ends. A regatta is dated by its end date, or by its start date when it has none; a regatta with no date at all does not count as ended, so its images and clips are not deleted automatically.
• Erg device keys (the keys that let a venue's laptop send a rowing machine's readings to the platform): switched off 14 days after the regatta ends. A regatta is dated by its end date, or by its start date when it has none; a regatta with no date at all does not count as ended, so its keys stay on.
• Boat GPS fixes: kept as the Club's data until the Club deletes it — there is no automatic purge. They follow the same per-second store as the Club's erg telemetry: when the Club deletes a regatta's per-second data, that regatta's GPS track is deleted with it, and counts toward the same stored data.
• Per-second erg race telemetry, and the copy the live feed keeps in the race's timing record: kept as the Club's data until the Club deletes it — it is not deleted automatically. The telemetry a reset keeps for dispute resolution counts toward the Club's stored data too, and is deleted with the rest. The Club can delete a regatta's telemetry while keeping its results — the timing record's copy goes with it, and the times, and the distance covered at the finish, stay — and it is deleted with the regatta. You can ask for yours to be erased at any time (see Erasure for a crew of two or more), and it is included when you ask for a copy of your data.
• Payment amounts + references: kept as part of the Club's financial records. The one exception is the receipt or transfer reference an organiser types for a fee paid by hand: it is deleted with the entry's contact details (see above), and the amount, method and who recorded it are kept.
• Audit log: 365 days unless extended for a specific incident.
• Concept2 Logbook link: a link that has not synced for 180 days (counted from when it was made, if it never has) is switched off automatically. For a link made directly with this platform, the encrypted keys are kept until the person disconnects it.
• Venue laptops: a regatta can be run from a laptop at the venue that syncs with the platform. That laptop holds its own copy of the regatta.
• The Club's own timing devices keep a copy of each press for 30 days: race, lane, bow, time, board and device id, with no name, to check the timing record.
• Backups: deleted or blanked data can remain in the platform's encrypted backups for up to about 12 months (a backup is taken every night; daily copies are kept for 7 days, weekly ones for 4 weeks and monthly ones for 12 months), and is gone when the last backup that holds it is deleted. Backups are used only to restore the platform after a failure, and restored each night into a scratch copy to check that a restore would work.
• When the Club's use of the platform ends: the platform operator exports the Club's data to a single encrypted file for the Club, checks that file against what the platform holds, and then deletes the Club's data from the platform, together with the files held for the Club. The sign-in accounts that belonged to the Club alone are erased in the same step (name, email, password and authenticator removed; the account number is kept so audit records still match), except an account that holds a Concept2 link and a platform operator's own account, which are not. An account that also belongs to another organisation keeps its details and loses only its place in the Club. The Club's data is not deleted while a card payment or refund for it is still in progress with Stripe.

Your rights

Under the GDPR and the Irish Data Protection Acts you have the right to:

• Access the personal data we hold about you (Art. 15).
• Correct inaccurate data (Art. 16) — contact the club secretary above; corrections feed into the next regatta export.
• Erasure (Art. 17) where there is no overriding legitimate interest — particularly where the rower is a minor and a parent / guardian objects. If you ask us to erase your data and you rowed in a crew of two or more people (a crew boat or an erg relay), the crew's results, timing records and the erg telemetry recorded for the crew are kept for dispute resolution, with your name and your link to your seat removed. Any heart-rate reading recorded on the crew's erg is deleted. If you raced alone, your name and your link to your seat are removed, and your result itself is kept without a name. If the rule for rower names had not yet reached your record, your entry is also scratched, so it no longer appears in the published results, and the kept copies of your race and the readings recorded during it are deleted, while its timing records and your finish and split times stay. Once that rule has reached your record, your result stays in the published results without your name, and the kept copies and readings of your race stay as that rule left them. A race-day substitution you were part of is kept as the other rower's record, with your name removed from it and the reason typed on it deleted.
• Object to processing on legitimate-interest grounds (Art. 21) — including objection to public listing. To have your name removed from published results, email the contact shown above: for now the Club does this by hand, and from then on your name is withheld on the public pages and in the JSON API (where it has not already been removed).
• Lodge a complaint with the Irish supervisory authority: Data Protection Commission, Fitzwilliam Square, Dublin 2.

Cookies + tracking

Public spectator pages — the live draw, results, map and ladder views — set no cookie at all. A strictly-necessary session cookie is set only where a page carries a form that needs protecting against cross-site request forgery (sign-in, password reset, entry forms), and operator dashboards additionally set an authenticated session cookie. There are no advertising trackers. We measure site traffic with Cloudflare Web Analytics, a cookieless, aggregate service: it sets no cookies, stores nothing on your device, and does not profile or identify individual visitors. No data is sold, traded, or used for behavioural profiling.