• Document Title: Plas Heli Privacy & Data Protection Policy
• Version: 2026.0‑Draft
• Status: Draft for Review
• Prepared By: Stephen
• Reviewers: Plas Heli Directors
• Current Approved Version: Legacy paper/website version
• Digital Version Status: Being modernised for inclusion in the Governance Library
• Effective Date: To be set upon Board approval
• Approval Date: Pending Board decision
• Next Review: 12 months after approval

Plas Heli Cyf processes personal data under the following lawful bases:

• Consent – where you actively agree to receive communications or participate in activities;
• Contract – where we provide services such as camping, parking, berths, room hire, event entry or training;
• Legal obligation – compliance with regulatory, financial, safeguarding and health & safety requirements;
• Legitimate interests – operating and managing Plas Heli facilities, events, communications and volunteer activities;
• Vital interests – protecting individuals in emergencies.

When you provide personal data to Plas Heli Cyf, we will explain why we need it and how it will be used. You will normally be treated as having consented to our use of your personal data under the terms of this policy if you then:

• use any of our facilities or the facilities of Plas Heli, the Welsh National Sailing Academy and Event Centre;
• obtain any goods or services from us;
• participate in any sporting event, experience day, boat show, or sporting competition run by us;
• enter a competition, promotion or survey run by us;
• visit the Plas Heli website or any of our associated websites;
• become a volunteer of the user groups of Plas Heli or in any other capacity;
• subscribe for Plas Heli e‑newsletters and updates;
• arrange for any child for whom you are responsible to participate in a Plas Heli activity;
• become an instructor, coach or operational helper.

In the membership application process of CHPSC, applicants may consent for their details to be shared with Plas Heli Cyf so that appropriate discounts afforded to CHPSC members can be provided. The data received and held on trust by Plas Heli for CHPSC is limited to:

• Name;
• Membership Number; and
• Postcode.

You may give us information about you by filling in forms on Plas Heli websites (or associated event websites), completing paper forms, or corresponding with us by telephone, e‑mail or otherwise. This includes information you provide when you:

• subscribe for e‑newsletters and updates;
• pay for camping on the Plas Heli site;
• pay for car parking in Plas Heli parking areas;
• pay for pontoon berths on Plas Heli pontoons;
• purchase any of our merchandise, goods or services;
• register as a volunteer;
• register for training or coaching programmes;
• enter or sign up for any sporting event, social event, race or cruise;
• register, visit or use any Plas Heli or associated websites;
• search our website for information, guidance, a product or service;
• participate on Plas Heli social media pages or groups;
• report a problem with the Plas Heli website (or associated websites);
• participate in or enter a competition, promotion or survey run by Plas Heli Cyf;
• become a member of CHPSC, renew your membership or amend or update your membership details (limited data held on trust as described above).

The information collected will be appropriate for the purpose intended only and may include:

• your name;
• your address;
• e‑mail address;
• telephone number(s);
• boat details – dinghy/boat storage and pontoon berths;
• car registration details – for car parking permits;
• motor‑home registration details – for camping.

When you visit PlasHeli.org or any associated event websites, we may automatically collect certain technical and usage information. This helps us operate the site securely, improve user experience, and understand how visitors use our services.

• IP address used to connect your device to the internet;
• login information (where applicable);
• browser type and version;
• time zone setting;
• browser plug‑in types and versions;
• operating system and platform;
• full URL clickstream to, through and from our site (including date and time);
• products or services viewed or searched for;
• items purchased and the cost of those items including any discounts;
• page response times and download errors;
• length of visits to certain pages;
• page interaction information (scrolling, clicks, mouse‑overs);
• methods used to navigate away from pages.

We may also receive information about you from others acting on your behalf, for example:

• a person making a booking for you;
• a parent or guardian providing information for a child.

PlasHeli.org uses cookies to distinguish you from other users, improve your browsing experience, and help us make improvements to the site. Cookies are used in accordance with the Privacy and Electronic Communications Regulations (PECR).

For detailed information about the cookies used and their purposes, please refer to our Cookie Policy.

All Plas Heli websites use HTTPS and SSL encryption to ensure that data transmitted between your browser and our servers remains private and secure.

We use personal data to fulfil our obligations to you and to operate Plas Heli safely, effectively and lawfully. This includes:

• providing services such as camping, car parking, pontoon berths, room hire, race entries, participation events, social events, coaching and training;
• registering you as a volunteer, coach, helper or participant;
• performing management and governance duties for the benefit of user groups and the community;
• complying with rules of governing bodies and regulatory authorities;
• managing complaints or issues of legitimate concern.

We also use your information to keep you updated:

• By e‑newsletter:
• notifying you about changes to our facilities, services or activities;
• sharing achievements, updates and articles of interest;
• providing information about other goods or services we offer.

• By website content and articles:
• ensuring content is presented effectively on your device;
• administering the site and supporting internal operations such as troubleshooting, data analysis, testing, research and statistics;
• identifying and implementing improvements to the site and its content;
• allowing you to participate in interactive features when you choose to do so;
• maintaining site safety and security;
• measuring the effectiveness and relevance of website content.

We do not share your personal data with third parties except where necessary and lawful:

• with CHPSC for membership verification and discount processes;
• where required to comply with legal obligations;
• to protect the rights, property or safety of Plas Heli Cyf, including sharing information with organisations for fraud prevention or credit risk reduction.

We retain personal data only for as long as necessary to fulfil our obligations to you and to meet legal requirements.

Where a service lapses, we may retain your data for up to two years to facilitate renewal.

We may also retain anonymised data for historical or statistical purposes.

Data is stored securely on password‑protected systems and in locked filing systems for paper records. We take all reasonable steps to ensure your data is treated securely and in accordance with this policy.

If you are given (or choose) a password or PIN to access parts of the Plas Heli website, you are responsible for keeping it confidential. Please do not share passwords or PINs with anyone.

The transmission of information over the internet is not completely secure. While we do our best to protect your personal data, we cannot guarantee the security of data transmitted to us; any transmission is at your own risk.

Once received, we use strict procedures and security features to prevent unauthorised access. All Plas Heli websites use HTTPS and SSL encryption to protect data in transit.

If we retain your personal data after a service has lapsed, you have the right to ask us to stop processing it. You can exercise your rights at any time by contacting us by e‑mail at .

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of your data where appropriate;
• restrict how we process your data in certain circumstances;
• object to processing based on legitimate interests or direct marketing;
• withdraw consent where processing is based on consent;
• request transfer of your data (data portability) in certain cases.

Our site may, from time to time, contain links to and from the websites of partner organisations, advertisers and affiliates. If you follow a link to any of these websites, please note that they have their own privacy policies and we do not accept responsibility or liability for those policies. Please check those policies before submitting any personal data.

You are entitled to request access to the personal data we hold about you. Access requests should be made by e‑mail to Plas Heli Cyf at .

We will respond within one calendar month, in line with UK GDPR requirements.

Any changes we make to this privacy policy in the future will be posted on the PlasHeli.org website and, where appropriate, notified to you by e‑newsletter. Please check back regularly to see any updates or changes. The version date is shown at the bottom of this document.

Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to Plas Heli Cyf at .

A copy of the legacy Privacy & Data Protection Policy (paper/website version) is retained for audit and governance purposes. It reflects the policy in force prior to the adoption of this modern digital version.

Plas Heli Cyf complies with UK GDPR and the Data Protection Act 2018. We follow the core data protection principles, including:

1. Personal data shall be processed lawfully, fairly and in a transparent manner.
2. Personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes.
3. Personal data shall be adequate, relevant and limited to what is necessary.
4. Personal data shall be accurate and, where necessary, kept up to date.
5. Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary.
6. Personal data shall be processed in a manner that ensures appropriate security.
7. Personal data shall not be transferred outside the UK or EEA unless appropriate safeguards are in place.