Club data terms · Rollcast

What we handle

Your club is the controller of its club records. Sebastian Smith, trading as Rollcast, is its processor. For the duration of your use of Rollcast, we store, organise, back up, display, export and send service notices using records about members, applicants and committee people: identity and contact details, application answers, memberships, recorded subscriptions, permits, messages, catches, incidents and club files. The purpose is administering club membership and fishing records. Please agree any processing of special-category information with us before providing it.

Instructions and security

We process club records only on the club's documented instructions, including authorised use of Rollcast and written support requests, unless law requires otherwise. We will tell the club about such a requirement unless prohibited, and flag an instruction we believe breaches data protection law. People with access to club records must keep them confidential. We use appropriate technical and organisational security measures proportionate to the risk, including access controls, encrypted connections and restricted service administration.

Providers

The club authorises Railway for hosting and file storage, Cloudflare R2 for private backup storage, and Resend for email delivery, and PostHog for coded usage and error records that contain no club records. We will use written terms requiring equivalent data protection obligations, remain responsible for our sub-processors, and tell the club before adding or replacing one, allowing a reasonable opportunity to object before its data is sent to the new provider. International transfers must have the safeguards required by UK data protection law. Contact us for the applicable provider and transfer details.

Requests and incidents

Taking account of the processing and information available to us, we help the club respond to people's data rights requests and meet its security, breach-notification, impact-assessment and regulator-consultation obligations. We will notify the club without undue delay after becoming aware of a personal data breach affecting its records. We provide information reasonably needed to demonstrate compliance and allow proportionate audits or inspections by the club or its appointed auditor.

Backups and deletion

We take private nightly copies of records and uploaded files for recovery from data loss. Each backup is scheduled for automatic deletion after seven days; deletion normally completes within a further day. Deleted information may remain in an earlier backup until that copy expires. These copies are isolated from ordinary use. Before restored records are used, we reapply deletion instructions.

When the club leaves

At the club's choice, we return or delete its personal records and delete existing copies when our service ends, unless law requires retention. Any remaining backup copies are handled as described above. Contact us to arrange export, deletion or an audit through Help & contact.