Privacy Policy

All accounts for participants under the age of 18 must be created and managed by a parent or legal guardian. The parent or guardian is the primary account holder and is responsible for all decisions about data and consent on behalf of their child.

Young people under the age of 13 cannot provide valid consent for the processing of their personal data under UK GDPR. Parental or guardian consent is required for all data processing relating to children under 13 and is strongly recommended for 13–17 year olds.

We comply with the ICO's Age Appropriate Design Code (Children's Code). This means we: apply the highest privacy settings by default for child accounts; do not use children's data for profiling or marketing purposes; do not share children's data with third parties except where strictly necessary for service delivery; and give particular weight to the best interests of the child in all data decisions.

We collect only the data that is strictly necessary for the safe and effective delivery of our coaching services to young participants. Medical and health data is treated as special category data and processed only where we have explicit parental consent and a clear legitimate purpose related to safeguarding or coaching effectiveness.

Name, date of birth, email address, phone number, postal address, and account login credentials. For youth accounts: parent/guardian details as above, plus the young person's name, date of birth, and relevant coaching information.

Session booking history, programme enrolment records, payment records (transaction references only — full card details are processed and stored by Stripe, our payment processor, and never held by us). Membership tier and billing status.

Session notes written by coaches, surf skill assessments and progression milestones, video footage from coaching sessions and biomechanical analysis, fitness and conditioning data, competition results and feedback, individual development plans, and RSJ HP Programme performance records (where applicable).

Where provided via our consent forms and waivers: medical conditions relevant to safe participation, medications, allergies, emergency contact details, and physical ability declarations (e.g. swimming proficiency). This data is classified as special category data under UK GDPR and is processed only with your explicit consent.

For Elite members and HP Programme participants who use RSJ-provided wearable devices: heart rate data, session intensity metrics, activity data, and GPS/location data recorded during coached sessions. This data is synced to your RSJ member portal.

Video footage recorded during coaching sessions for biomechanical analysis purposes, and photographs or video taken at events or camps where you have given consent. Video footage of young participants is treated with additional care — see Section 7 for details.

IP address, device type, and browser/operating-system information, collected automatically when you use our website or member portal.

For members, we also keep a record of your account activity within the portal: the date and time you log in and log out (including whether you signed out yourself or were signed out automatically after a period of inactivity), how long each session lasts, and which sections or features of the portal you use. We use this to keep your account secure and detect unusual sign-ins, to power the automatic inactivity sign-out that protects your account, and to understand how members engage with the portal so we can improve it and offer you timely, relevant support. Cookie data is described in the Cookies section below.

Records of communications between you and RSJ Surf Academy (email, contact form, portal messaging), including enquiries, coaching feedback, and customer service correspondence.

Video footage recorded during coaching sessions is used solely for coaching, biomechanical analysis, and performance feedback purposes. This footage is stored securely in the RSJ member portal (Kaizen Lab) and is accessible only to the member and relevant RSJ coaches. Footage of minors is visible only to the parent/guardian account holder and named RSJ coaches — never shared publicly or with third parties.

We do not use images or video of identifiable individuals — particularly children — for promotional or marketing purposes without separate, explicit written consent. This consent is managed independently of the coaching waiver and can be withdrawn at any time. Withdrawal of promotional consent does not affect your ability to use our services.

Video footage of participants under 18 receives the highest level of protection. It is not shared externally, not used for any purpose other than coaching analysis, and is deleted at the end of the applicable retention period (see Section 10). Access is restricted to the parent/guardian, the athlete, and approved RSJ coaches only.

When you use the RSJ Apple Watch App or Mobile App, we collect the following health and biometric data during surf sessions:

• —Heart rate (beats per minute) — recorded continuously during sessions via Apple Watch sensors
• —GPS location and surf session track — latitude, longitude, speed, and direction throughout the session
• —Wave count — estimated number of waves ridden during a session
• —Top and average paddling speed, surfing speed, and distance
• —Distance paddled and distance surfed per session
• —Calorie estimates — calculated from heart rate, speed, and bodyweight data
• —Session duration and active time in the water

Heart rate and calorie data derived from heart rate constitute special category health data under UK GDPR Article 9(1) and the Data Protection Act 2018 Schedule 1. Processing this data requires an explicit legal basis in addition to a standard lawful basis.

For adult members, the legal basis for processing is explicit consent (Article 9(2)(a) UK GDPR), given at the time of app activation or via the Waivers section of the member portal. For youth members (under 18), explicit parental consent is required under both UK GDPR and the ICO Age Appropriate Design Code (Children's Code).

Health and biometric data collected by the RSJ apps is used solely to:

• —Analyse surf session performance and athletic workload
• —Track progression over time in the RSJ member portal (Surf Tracker)
• —Provide coaches with data to inform training recommendations
• —Generate session summaries visible to the athlete (and parent/guardian for youth accounts)

We will never sell health or biometric data, share it with third parties for commercial purposes, use it to profile members for advertising, or process it for any purpose beyond the direct coaching relationship. Health data is not used to make automated decisions that produce significant legal or similar effects.

Health and biometric data belonging to members under 18 is subject to the strictest protections in line with the ICO Children's Code and the UN Convention on the Rights of the Child. Specifically:

• —Explicit parental/guardian consent is required before any Watch App or Mobile App data is collected from a young person
• —Health data is visible only to the parent/guardian account holder and named RSJ coaches — never to the young person without parental account access
• —Health data is not used to build any commercial profile or shared with any party outside RSJ
• —Parental consent for health data collection can be withdrawn at any time, which will immediately disable data collection for that account
• —Health data for youth participants is retained only for the duration of the coaching relationship and is deleted upon account closure or consent withdrawal

You may withdraw consent for health data collection at any time by visiting the Waivers section of your member portal or by contacting us at surf@rsjsurfacademy.com. Withdrawal will immediately disable health data collection and will result in deletion of all previously collected health data within 30 days, unless retention is required for a legitimate legal purpose. Withdrawal of health data consent does not affect your access to other RSJ services.

The RSJ Watch App and Mobile App integrate with Apple HealthKit. Apple's own privacy controls govern what data the RSJ app is permitted to access, and you may adjust these permissions at any time in your iPhone's Health settings. RSJ does not write data to Apple Health that was not originated by RSJ's own sensors and algorithms.

We share data with third-party service providers who process it on our behalf under data processing agreements. These include:

• —Stripe, Inc. — payment processing (data processed in the US under Standard Contractual Clauses)
• —Cloud hosting and infrastructure providers for the member portal and website
• —Email delivery providers for transactional and marketing communications
• —Analytics providers (anonymised/aggregated data only)

We may disclose personal data where required to do so by law, by court order, or to a regulatory authority. In the context of youth safeguarding, we may share information with local authority children's services, the police, or other relevant agencies where we have a safeguarding concern, without requiring consent where doing so is in the best interests of the child or is legally required.

Emergency contact details and relevant medical information may be shared with emergency services, medical professionals, or the named emergency contact in the event of a medical emergency during a session or programme.

In the event of a sale, merger, or transfer of all or part of RSJ Surf Academy, personal data held at the time may be transferred to the acquiring entity. You will be notified of any such transfer in advance.