Website privacy policy

01Introduction

The Admiral Lord Nelson Scout Active Support Unit (ALN SASU) is committed to protecting personal information and respecting the privacy of individuals who use the RN Affiliated Sea Scouts website, the RNAffss Portal and our associated services.

This policy explains:

• What personal information we collect.
• Why we collect and use that information.
• How Google Sign-In operates.
• How personal information is stored, protected and shared.
• How information relating to Scout Groups, volunteers, camps and young people is managed.
• Who is responsible for managing personal information.
• How individuals can exercise their rights under UK data protection legislation.

We aim to process personal information fairly, lawfully and transparently, in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and applicable Scouts policies.

This policy applies to the public website and the RNAffss Portal, including its administrative, membership, event and camp management functions.

02Who We Are and Data Protection Responsibilities

The RN Affiliated Sea Scouts website and RNAffss Portal are administered by the Admiral Lord Nelson Scout Active Support Unit (ALN SASU), which manages the operational arrangements for the portal.

The Support Unit determines the day-to-day purposes and processes associated with the information it manages through the portal, subject to applicable organisational and legal responsibilities.

Current central data protection arrangements

Operational organisation: Admiral Lord Nelson Scout Active Support Unit.

Central Data Protection Manager: Nathan Cole.

Current ICO registration: Held in the name of Nathan Cole.

Planned change: Transition of the registration to the appropriate Scout support organisation.

Contact email: info@rnseascouts.org.uk.

Nathan Cole currently oversees the arrangements for personal information processed through the portal, including privacy, information security, data access and the delegation of administrative responsibilities.

The Support Unit may delegate defined operational responsibilities to authorised members and appointed camp management teams.

Such delegation may include maintaining records, managing authorised users, administering activities and responding to data-related requests.

Delegation does not remove the accountability of the person or organisation legally responsible as data controller.

The legal identity of the data controller will be confirmed against the applicable Scout governance arrangements. The organisation or person acting as controller is determined by who decides the purposes and essential means of processing, rather than solely by whose name appears on an ICO registration.

This section will be updated when the planned registration change and associated organisational arrangements are completed.

03What This Policy Covers

This policy applies when individuals:

• Browse or interact with www.rnseascouts.org.uk.
• Sign into or use the RNAffss Portal.
• Access or update Royal Navy affiliation records.
• Administer Scout Groups, Scout Troops or Explorer Scout Units.
• Register for, manage or attend camps and events.
• Submit applications, forms or enquiries.
• Volunteer for or organise activities.
• Have their information recorded for legitimate administrative, safety or safeguarding purposes.

It may apply to adult volunteers, administrative users, parents, carers, young people, event participants and other individuals whose information is processed through these systems.

Where an activity requires additional privacy information, this may be provided separately.

04Personal Information We Collect

The information collected depends on how the website or portal is used.

4.1 Portal account information

For authorised portal users, we may collect:

• Full name.
• Email address.
• Google account identifier.
• Profile image, where provided.
• Associated Scout Group or organisational role.
• Portal permissions and approved access levels.
• Account status.
• Login and account activity records.

4.2 Scout Group and affiliation information

We may maintain:

• Scout Group and section names.
• Royal Navy affiliation numbers.
• Scouts membership or organisational reference numbers.
• Regional, county and district information.
• Group contact details.
• Details of authorised adult representatives.
• Affiliation reviews and administrative records.
• Partnership, grant and eligibility information.
• Relevant organisational correspondence.

4.3 Camp and event information

For the administration of camps, activities and events, we may collect:

• Participant and volunteer names.
• Scout Group or Explorer Unit details.
• Age or date of birth where required.
• Parent or carer contact details.
• Emergency contact information.
• Attendance and booking information.
• Activity selections and allocations.
• Accommodation and tent allocations.
• Dietary requirements.
• Relevant medical and accessibility information.
• Volunteer duties and management responsibilities.
• Event-related correspondence and incident information.

4.4 Sensitive information

Some activities may require information about an individual's health, disabilities, medication, allergies, dietary needs or other circumstances relevant to their safety and welfare.

Safeguarding information may also be processed where necessary.

This information is subject to additional restrictions and will only be available to individuals whose responsibilities justify access.

Information about children and young people is treated with particular care.

4.5 Technical information

When using the website or portal, technical systems may process:

• IP addresses.
• Browser and device information.
• Authentication and session identifiers.
• Access times.
• System error information.
• Security logs.
• Cookies or equivalent technologies required for operation.

This information supports security, troubleshooting and reliable operation.

05Google Sign-In and Google User Data

The RNAffss Portal uses Google Sign-In to authenticate authorised users.

Google Sign-In allows individuals to use their existing Google account without creating a separate portal password.

5.1 Information received from Google

When a user chooses Continue with Google, Google authenticates their identity.

Depending on the permissions requested and the information supplied by Google, the portal may receive:

• Their Google account email address.
• Their display name.
• Their unique Google account identifier.
• Their Google profile picture, where provided.

The portal uses standard authentication-related information to establish the user's identity.

5.2 How Google information is used

Information received through Google Sign-In is used to:

• Authenticate the user.
• Create or identify their portal account.
• Confirm whether the account is authorised.
• Associate the user with their assigned organisational roles.
• Apply appropriate access restrictions.
• Support account security and administration.
• Maintain relevant authentication and audit records.

Google account information is not used for unrelated marketing, advertising profiling or the sale of personal information.

5.3 Information we do not access through standard Google Sign-In

Using standard Google Sign-In does not, by itself, authorise the portal to access:

• Gmail messages.
• Google Drive documents.
• Google Contacts.
• Google Calendar events.
• Google account passwords.

If additional Google services or permissions are introduced in the future, the relevant privacy disclosures and authorisation arrangements will be updated before those features are enabled.

5.4 Google account passwords

We do not collect or store users' Google account passwords.

Authentication is handled by Google through the approved authentication process.

5.5 Sharing and storage of Google user information

Google account information received by the portal may be processed through Supabase for authentication, account identification and session management.

Relevant user identifiers and account information may also be stored in the portal's authorised user records to manage access and permissions.

Access is restricted to authorised functions and personnel.

Google user information is not sold or shared with advertisers.

It may be processed by contracted technology providers where necessary to operate and secure the application, subject to their applicable data protection arrangements.

5.6 Google privacy information

Google operates its authentication service under its own privacy arrangements.

Google Privacy Policy:
https://policies.google.com/privacy

Users can manage third-party access to their Google account through their Google account settings.

06Authentication Through Supabase

The RNAffss Portal uses Supabase to support Google authentication and the management of authenticated user sessions.

Supabase may process:

• Account identifiers.
• Names and email addresses supplied through authentication.
• Authentication tokens.
• Session information.
• Account metadata.
• Relevant technical and security information.

This processing allows users to sign in securely and allows the portal to recognise authenticated sessions.

During Google authentication, users may see the Supabase-managed domain:

lazuurappdmgzjulupat.supabase.co

This is associated with the technical authentication service used by the RNAffss Portal.

The appearance of this domain does not mean that Supabase operates the RN Affiliated Sea Scouts organisation.

Supabase Privacy Policy:
https://supabase.com/privacy

07Portal Access and User Permissions

Access to the RNAffss Portal is managed according to an individual's approved organisational responsibilities.

A successful Google login does not automatically grant access to private records.

Users may be assigned roles such as:

• SASSU Administrator.
• Authorised Support Unit Member.
• Camp Manager.
• Camp Management Team Member.
• Scout Group Representative.
• Other specifically authorised roles.

Access permissions may be restricted to particular Scout Groups, camps, events or functions.

Authorised administrators may approve, amend, suspend or revoke access where appropriate.

Users must only access information required for their assigned responsibilities.

The portal may record administrative changes and relevant access activity to support accountability and security.

08Why We Use Personal Information

We use personal information for the legitimate administration and operation of RN Affiliated Sea Scout activities and services.

These purposes include:

• Managing Royal Navy affiliation records.
• Maintaining accurate Scout Group information.
• Communicating with authorised volunteers and representatives.
• Administering camps and activities.
• Allocating volunteers and activity responsibilities.
• Supporting participant welfare and safety.
• Managing emergency information.
• Maintaining portal security.
• Investigating incidents and technical problems.
• Meeting legal and safeguarding obligations.
• Responding to enquiries and requests.
• Maintaining appropriate records and accountability.

We do not use personal information for purposes incompatible with those for which it was collected unless there is an appropriate lawful basis.

09Lawful Basis for Processing

We process personal information under one or more lawful bases recognised by the UK GDPR.

Depending on the circumstances, these may include:

Legitimate interests: Where processing is necessary and proportionate for administration, security, volunteer coordination and the operation of Scout-related activities.

Legal obligation: Where processing is necessary to comply with applicable legal requirements.

Contract: Where processing is necessary to perform an agreement or provide an agreed service.

Consent: Where consent is appropriate and has been validly obtained.

Vital interests: Where processing is necessary to protect someone's life.

Where special category information is processed, including relevant health information, an additional condition under Article 9 UK GDPR must also apply.

Safeguarding-related processing may require further consideration of relevant legislation and organisational procedures.

The applicable lawful basis depends on the specific information and purpose involved. Consent is not automatically the lawful basis for every camp record or administrative activity.

10Children and Young People's Information

The RNAffss Portal may process information relating to children and young people taking part in Scout activities.

We recognise the importance of protecting their privacy.

Information will only be collected where necessary and appropriate for the relevant activity or administrative purpose.

Access to children's information is restricted to authorised individuals with a legitimate need.

Medical, welfare and safeguarding information must not be accessible to general portal users.

Where parent or carer information or authorisation is required, appropriate arrangements will be made.

Information relating to children and young people will be managed in accordance with applicable Scout safeguarding requirements, privacy procedures and data protection law.

11Camps and Events Management

The RNAffss Portal supports the planning and administration of camps and events.

Information collected for these purposes may be used for:

• Participant registration.
• Booking administration.
• Activity allocation.
• Accommodation arrangements.
• Volunteer management.
• Catering and dietary planning.
• Emergency contact arrangements.
• Welfare and safeguarding administration.
• Incident reporting.
• Operational communications.

Access to camp information is restricted according to approved roles and responsibilities.

Camp Managers and other authorised team members may be given access to relevant information for specific events.

Access may be withdrawn when it is no longer required.

Different categories of camp information may be subject to different retention periods.

12How Information Is Shared

We may share personal information where necessary for legitimate operational, safety, safeguarding or legal purposes.

Recipients may include:

• Authorised members of the Admiral Lord Nelson Scout Active Support Unit.
• Approved Scout Group representatives.
• Appointed camp management teams.
• Other relevant Scout organisational bodies.
• Activity providers and delivery partners where necessary.
• Emergency services or medical professionals where appropriate.
• Safeguarding authorities.
• Regulators and public authorities where required by law.
• Technology providers operating the website and portal.

Personal information is not made available to unrelated third parties simply because they request it.

We do not sell personal information.

We do not share Google Sign-In information with third parties for their own advertising or marketing purposes.

13Technology and Service Providers

The website and portal use external technology services.

Google

Google provides the authentication service used when individuals sign into the portal with their Google accounts.

Google may also provide administrative tools where separately configured.

Privacy information:
https://policies.google.com/privacy

Supabase

Supabase supports authentication, user sessions and relevant application services.

Privacy information:
https://supabase.com/privacy

Cloudflare

Cloudflare provides infrastructure used to host, deliver and secure the portal application.

Cloudflare may process technical information necessary to provide these services.

Privacy information:
https://www.cloudflare.com/privacypolicy/

Wix

Wix hosts and supports the public RN Affiliated Sea Scouts website.

Privacy information:
https://www.wix.com/about/privacy

Google Sheets and Google Workspace

Where Google Sheets or Google Workspace services are configured for approved administrative purposes, they may be used to maintain or process relevant organisational records.

Access will be restricted to authorised users, and applicable data protection arrangements will be observed.

The use of a particular provider depends on the functionality deployed and enabled at the relevant time.

14Information Security

We take reasonable technical and organisational steps intended to protect personal information.

Measures may include:

• Secure Google authentication.
• Encrypted HTTPS connections.
• Role-based access restrictions.
• Backend permission checks.
• Restricted administrative access.
• Appropriate management of authentication credentials.
• Security and activity logging.
• Controlled access to sensitive information.
• Procedures for handling suspected data breaches.
• Periodic review of user permissions.

Authorised users are responsible for protecting their own Google accounts and devices.

Users must not share access credentials or permit unauthorised individuals to use their accounts.

Suspected unauthorised access, data loss or other security concerns should be reported promptly to info@rnseascouts.org.uk.

Although we take steps to protect information, no electronic system can guarantee absolute security.

15Information Retention

We retain personal information only for as long as necessary for the purpose for which it was collected, subject to applicable legal obligations, safeguarding requirements and approved retention arrangements.

Retention periods may vary by category.

For example:

Portal accounts: Retained while an individual requires authorised access, with appropriate account administration and removal procedures.

Scout Group records: Retained while necessary for affiliation administration, organisational history and applicable record-keeping obligations.

Camp and event records: Retained for operational purposes and any required post-event period.

Medical and safeguarding records: Subject to additional access restrictions and applicable safeguarding and retention requirements.

Security and audit logs: Retained for periods justified by security, investigation and accountability needs.

Information that is no longer required will be securely deleted, anonymised or appropriately archived.

Where an individual requests deletion, any continuing legal, safeguarding or organisational requirement to retain the information will be considered.

16International Data Processing

Some technology providers may store or process information outside the United Kingdom.

Where personal information is transferred internationally, the responsible data controller must ensure appropriate safeguards are in place under UK data protection law.

These may include UK adequacy regulations, approved contractual safeguards or another lawful transfer mechanism.

Details of relevant processing arrangements may be requested using the contact information in this policy.

17Cookies and Similar Technologies

The RN Sea Scouts website and RNAffss Portal may use cookies or similar technologies.

These may be necessary for:

• Authentication and login sessions.
• Maintaining secure access.
• Essential website functionality.
• Remembering appropriate preferences.
• Security and service performance.

Where non-essential cookies, analytics or tracking technologies are used, appropriate information and consent arrangements will be provided where required.

Users can manage cookies through their browser settings.

Disabling essential cookies may prevent certain portal features from operating.

18Your Rights Under UK GDPR

Individuals have rights relating to their personal information, subject to applicable conditions and exemptions.

These may include the right to:

• Be informed about how their information is used.
• Request access to their personal information.
• Request correction of inaccurate information.
• Request erasure in appropriate circumstances.
• Request restriction of processing.
• Object to certain processing.
• Request data portability where applicable.
• Withdraw consent where consent is the lawful basis.

Requests should be sent to:

info@rnseascouts.org.uk

Requests will be handled by the appropriate data controller in accordance with UK data protection law.

We may need to verify the identity of a person making a request before disclosing personal information.

19Managing or Removing Google Account Access

Users can review and manage applications connected to their Google account through Google's account settings.

Removing the portal's authorisation may prevent subsequent access until authentication is completed again.

Removing Google authorisation does not automatically remove records lawfully retained for Scout Group administration, camp management, safeguarding or other justified purposes.

Individuals wishing to request the deletion or correction of their portal account information should contact:

info@rnseascouts.org.uk

Requests will be assessed in accordance with applicable data protection rights and retention obligations.

20Data Breaches and Security Incidents

Suspected data breaches or unauthorised disclosures should be reported promptly to the central data protection manager.

The Support Unit will assess reported incidents and take appropriate steps to contain, investigate and address them.

Where legally required, personal data breaches will be reported to the Information Commissioner's Office and affected individuals within the applicable statutory timescales.

Records of relevant incidents and decisions will be maintained as appropriate.

21Complaints

If you have concerns about how your personal information is handled, please contact us first so that we can investigate.

Email: info@rnseascouts.org.uk

You also have the right to raise a complaint with the UK Information Commissioner's Office.

Information Commissioner's Office
Website: https://ico.org.uk
Telephone: 0303 123 1113

22Contact Information

For privacy enquiries, subject access requests, correction or deletion requests, and concerns about the RNAffss Portal, contact:

Admiral Lord Nelson Scout Active Support Unit
RN Affiliated Sea Scouts
Central Data Protection Manager: Nathan Cole
Email: info@rnseascouts.org.uk
Website: https://www.rnseascouts.org.uk

The responsible data controller will handle or oversee the response as appropriate.

23Changes to This Privacy Policy

We may update this policy to reflect changes in the portal, organisational arrangements, technology providers, processing activities or relevant legislation.

The latest version will be published at:

https://www.rnseascouts.org.uk/privacy-policy

Material changes will be communicated where appropriate.

Admiral Lord Nelson Scout Active Support Unit
Supporting the Royal Navy Affiliated Sea Scouts

End of Privacy Policy — Version 1.2