The Cape 31 International Class Association ("the Association", "we", "us") is the governing body for the Cape 31 one-design racing class. We operate the Class Management System (CMS) at cms.cape31class.org to manage class membership, boat registration, regatta entries, race results, and crew categorisation.
The Association is the Data Controller for personal data collected and processed through this system. We are committed to protecting your personal data and handling it in accordance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR 2016/679), and the Data Protection Act 2018.
We collect and process the following categories of personal data:
| Category | Data items | Source |
|---|---|---|
| Identity | Full name, nationality | Registration form or admin entry |
| Contact | Email address, mobile phone number | Registration form or admin entry |
| Sailing credentials | World Sailing sailor ID, World Sailing category (Amateur / Professional / Uncategorised) | Self-declared by sailor or entered by boat owner / admin |
| Boat & class membership | Hull number, sail number, boat name, ownership status, entry history | Class registration and regatta entry |
| Regatta participation | Regatta entries, crew rosters, race results, fee payment status | Entry forms submitted by boat owner or captain |
| Account credentials | Hashed password (never stored in plain text), account role and regional access permissions | System-generated on account creation |
| Authentication | Google account profile name and email (when signing in with Google) | Google OAuth — provided by Google with your consent |
| System activity | Login timestamps, activity log entries for audit purposes | Automatically recorded by the CMS |
We do not collect sensitive personal data such as racial or ethnic origin, health data, financial data beyond race fee status, or data about children under 18.
| Purpose | Lawful basis (UK/EU GDPR) |
|---|---|
| Class membership administration — managing boat registrations, ownership records and membership status | Legitimate interests of the class association as a sporting governing body |
| Regatta entry management — processing entries, crew rosters, and race fee administration | Performance of a contract (the entry agreement) / Legitimate interests |
| World Sailing crew categorisation — verifying and recording amateur / professional status for compliance with class rules and World Sailing regulations | Legal obligation (compliance with World Sailing Sailor Classification Code) / Legitimate interests |
| Communications — sending notifications about class events, entry confirmations, crew detail requests, and system alerts | Legitimate interests / Consent (where required) |
| Race results publication — publishing finishing positions and standings | Legitimate interests of the class and its members in transparent sporting results |
| System security and audit — maintaining activity logs to prevent unauthorised access and resolve disputes | Legitimate interests |
| Google sign-in — authenticating your identity using your Google account | Consent (you choose to use Google sign-in) |
We do not sell your personal data. We share data only with the following third-party processors who act on our instructions and are contractually bound to protect your data:
We may also share data with:
World Sailing — sailor categorisation information may be shared with World Sailing as required for compliance with the Sailor Classification Code.
Race organisers and yacht clubs — entry and crew information is shared with the organising authority of each regatta for the purposes of race management, measurement checks, and protest procedures.
Class regional administrators — class administrators in your region may access your data to manage regional class activities.
Law enforcement or regulatory authorities — where we are legally required to disclose information.
Some of our third-party processors operate outside the UK and European Economic Area (EEA). Where data is transferred internationally, we ensure appropriate safeguards are in place:
Supabase is hosted on infrastructure that may process data in the United States. Supabase operates under Standard Contractual Clauses (SCCs) approved by the European Commission for transfers of personal data to third countries.
Google LLC and EmailJS operate under Standard Contractual Clauses and, where applicable, are certified under frameworks recognised by UK and EU data protection authorities.
Microsoft Azure hosting is provisioned in the UK South region. Data stored in the CMS database resides on Supabase infrastructure (see above).
| Data type | Retention period |
|---|---|
| Active member account | For the duration of class membership, plus 3 years after last activity |
| Regatta entry and race result records | Retained indefinitely as part of the class's sporting record |
| Crew categorisation declarations | 7 years (to support any retrospective categorisation disputes) |
| System activity logs | 2 years |
| Email communications | 2 years |
| Inactive accounts (no activity, membership lapsed) | Deleted or anonymised after 3 years of inactivity |
Race results including names and finishing positions are considered part of the permanent sporting record of the class and are retained indefinitely. This is standard practice in competitive sailing and is consistent with World Sailing guidelines.
Under UK GDPR and EU GDPR you have the following rights regarding your personal data:
To exercise any of these rights, contact us at cape31one@gmail.com. We will respond within 30 days. We may need to verify your identity before fulfilling a request.
The CMS uses browser localStorage to store your session state and application data locally on your device. This is functional storage required for the CMS to operate — it is not used for advertising or tracking.
We do not use third-party tracking cookies, advertising cookies, or analytics cookies. Google Fonts are loaded from Google's servers, which may set cookies in accordance with Google's own privacy policy.
When you sign in with Google, Google's authentication service uses cookies to manage your session. These are governed by Google's Privacy Policy.
We take the security of your personal data seriously. Our technical and organisational measures include:
Encryption in transit — all data is transmitted over HTTPS (TLS 1.2+). Passwords are hashed using industry-standard algorithms and are never stored in plain text.
Access controls — the CMS uses a role-based access control system. Only authorised administrators and regional managers can access member data beyond their own profile. All administrative actions are logged.
Infrastructure security — the CMS is hosted on Microsoft Azure (UK South) with Supabase providing database services. Both providers maintain ISO 27001 certification and SOC 2 compliance.
Data minimisation — we only collect data that is necessary for the purposes described in this notice.
We may update this Privacy Notice from time to time to reflect changes in our data processing activities, applicable law, or best practice. The effective date at the top of this page indicates when the notice was last updated.
Where changes are significant, we will notify members via the CMS or by email. Continued use of the CMS after the effective date of an updated notice constitutes acceptance of the changes.
Previous versions of this notice are available on request by contacting us at cape31one@gmail.com.
For any questions about this Privacy Notice or to exercise your data protection rights, please contact: