Privacy policy
Last updated: 12 October 2026
Who is responsible for your information?
Rowing Fantasy League is operated by [COMPANY NAME], the controller responsible for personal information used by this site.
- Privacy contact: [PRIVACY CONTACT EMAIL]
- Postal address: [COMPANY POSTAL ADDRESS]
Information we handle
- Account information: your email address, account identifier, authentication records and account creation or sign-in timestamps. Supabase handles your password and authentication credentials.
- Technical information: IP addresses, browser and request information, security events and diagnostic logs handled by our hosting and authentication providers.
- Rowing information: event details, crew names, clubs, categories, start orders, race times, positions and penalties imported from publicly available Oar Online event pages. Crew labels may identify individual competitors, including juniors.
- Preferences and enquiries: your display theme, cookie-notice acknowledgement and information you provide when contacting us.
You can browse public pages without creating an account. An email address and password are required for email/password registration. Please do not send passwords or authentication codes in privacy enquiries.
Why we use information
- Providing your requested account, sign-in, verification and password recovery: processing necessary to perform our agreement with you.
- Keeping the service secure and diagnosing faults: our legitimate interests in preventing abuse and operating a reliable service.
- Publishing rowing draws and results: our proposed legitimate interest in helping users follow rowing events. [CONFIRM AND DOCUMENT THE LEGITIMATE INTERESTS ASSESSMENT, INCLUDING JUNIOR COMPETITORS.]
- Handling enquiries and privacy requests: our legitimate interest in responding to you and, where applicable, compliance with legal obligations.
Public availability does not remove competitors' privacy rights. You may object to our use of information relating to you. We do not use automated decisions that have legal or similarly significant effects on you. This site does not currently include advertising or analytics integrations.
Who receives information?
Supabase provides account authentication. Cloudflare hosts the site and provides database, cache and operational services. Authentication emails are delivered through Supabase and its configured email delivery provider [CONFIRM EMAIL PROVIDER]. These providers handle information needed to supply their services. Public rowing information displayed on this site is available to other visitors; your account email is not a public profile.
The site currently loads Google Fonts from Google's servers. Your browser therefore makes requests to Google, which receive your IP address and browser/request information. See Google Fonts privacy information.
Information may also be disclosed when required by law or necessary to respond to a lawful request. [CONFIRM PROVIDER PROCESSING AGREEMENTS AND ANY OTHER RECIPIENTS.]
International processing
Our providers may process information outside the UK or European Economic Area. [CONFIRM SUPABASE PROJECT REGION, PROVIDER/SUBPROCESSOR COUNTRIES AND APPLICABLE TRANSFER SAFEGUARDS, SUCH AS ADEQUACY OR APPROPRIATE CONTRACTUAL CLAUSES, INCLUDING UK REQUIREMENTS.] Contact our privacy contact for information about applicable safeguards once these details are confirmed.
How long information is kept
Information should be kept only as long as needed for its stated purpose, including any applicable legal or security requirements. The following periods must be confirmed against our actual systems:
- Account records: [CONFIRM RETENTION AND INACTIVE-ACCOUNT PERIOD].
- Imported rowing draws and results: [CONFIRM ARCHIVE/DELETION PERIOD].
- Technical and security logs: [CONFIRM PROVIDER LOG RETENTION].
- Enquiries and privacy-request records: [CONFIRM RETENTION PERIOD].
- Backups and cached copies: [CONFIRM EXPIRY AND DELETION PROCEDURE].
Deleting an account does not automatically delete independently sourced public race results. You can make a separate request about those records.
Your rights and requests
Depending on the circumstances, you can request access to your personal information, correction, deletion, restriction of processing and a portable copy. You can object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting prior lawful processing. These rights have conditions and exceptions.
For an account deletion, data copy, correction or objection relating to rowing results, contact [PRIVACY CONTACT EMAIL]. Include the email associated with your account or the event and crew entry concerned. We may need proportionate verification of your identity. Requests are normally answered within one month, subject to applicable legal extensions. Self-service account deletion and export are not currently available.
You can complain to the UK Information Commissioner's Office or, where applicable, your local data protection authority.
Children and junior competitors
Imported event data may include junior competitors. If information about you or a child in your care raises a concern, contact our privacy contact with the relevant event details. [CONFIRM ACCOUNT AGE POLICY, CHILDREN'S CODE APPLICABILITY AND ANY REQUIRED CHILDREN'S DATA RISK ASSESSMENT.]
Changes to this policy
We will update this page when our data handling changes. The date above identifies the latest revision. Material new uses of personal information will require appropriate notification and, where required, consent.