Hastings Fly Fishers Club Limited (HFFC) is the data controller for personal information it determines how and why to use. This policy covers hastingsflyfishers.co.uk, shop.hastingsflyfishers.co.uk and associated Club services. Registered office: Unit 2.02 High Weald House, Glovers End, Bexhill, East Sussex, England, TN39 5ES. Company number: 00265927. Privacy email: enquiries@hastingsflyfishers.co.uk. Telephone: 01424 870498.

Depending on your interaction with the Club, this may include names, addresses, telephone numbers, email addresses, membership references and status, reservation and equipment-hire details, guest and junior booking details, catch returns, shop orders, delivery details, payment status and correspondence. Website systems may also collect account, technical, security and cookie-preference information.

We use relevant information to administer memberships and shareholder access; manage fishing reservations, boat and outboard hire; fulfil shop orders; send transactional communications; record catch returns; protect our services; maintain accounting records; and meet legal obligations.

Depending on the activity, our lawful basis may be performance of a contract, compliance with a legal obligation, legitimate interests in administering and securing the Club, or consent where required. We assess any additional legal conditions before processing special-category information.

Member and shareholder records are used for eligibility, renewals, governance and restricted access. Where junior anglers are involved, we use information necessary for bookings, supervision and Club administration, with appropriate safeguards.

Reservation details support booking confirmations, amendments, availability and attendance. Catch returns support fishery management and statistics. Shop order information, including customer and order details received through eBay where an order is placed on that marketplace, supports fulfilment, delivery or collection, and customer service. HFFC uses the information supplied for these purposes and related record-keeping. eBay separately handles personal information under its own privacy policy. Public reporting should avoid identifying individuals unless justified and lawful.

The Club uses website hosting and software services, including Hostinger and WordPress/WooCommerce, where applicable. Personal information may be processed by providers only to the extent necessary for their actual services and subject to appropriate arrangements.

We maintain transaction and accounting records necessary for Club administration and legal obligations. If a customer pays using a Square terminal and chooses to receive a receipt by email or text message, Square may save the email address or telephone number provided for that purpose. Providing these details for a receipt is optional.

We may send essential booking, membership, order, cancellation, refund and security messages. Any optional promotional messaging will be managed in accordance with applicable electronic-marketing rules and consent or other lawful requirements.

For information about essential cookies, any optional analytics, cookie controls and a verified cookie inventory, please read our Cookie Policy.

Information may be shared with authorised Club personnel and providers where necessary and lawful. If information is transferred internationally, appropriate safeguards or other lawful transfer arrangements will be used. The Club must confirm the locations and transfer safeguards of each provider before making a definitive statement about international transfers.

We retain identifiable information only while it is needed for the purposes described in this policy, for applicable legal obligations or for the establishment, exercise or defence of legal claims. UK GDPR does not prescribe a universal retention period. The following are proposed review periods for the Club to adopt and implement, not claims that automated deletion is already in place:

• Active member and shareholder administration: while the relationship continues; review ordinary contact and access details when it ends.
• Former member contact details and routine correspondence: normally review for deletion or anonymisation 12 months after the relationship or enquiry ends, unless a continuing reason exists.
• Reservation and equipment-hire administration: normally review 12 months after the booked date; retain the minimum necessary longer where accounting, safeguarding, complaints or claims require it.
• Invoices, payments, refunds and accounting records: normally retain for six years from the end of the relevant accounting period, or longer where a specific legal obligation applies.
• Catch records: retain identifiable entries only for a documented fishery-management need; retain genuinely anonymised statistics where useful.
• Security and technical logs: proposed routine review after 90 days, except where needed for a security incident or investigation.
• Complaints, accidents and disciplinary matters: retain according to the nature of the incident, relevant legal time limits and ongoing proceedings, with periodic review.

Depending on the circumstances, you may request access, correction, erasure, restriction, portability or object to certain processing. You may withdraw consent where processing relies on it. Contact the Club using the privacy contact details above.

You can raise concerns with the Club or complain to the Information Commissioner’s Office at ico.org.uk. We may update this policy when our services or legal obligations change and will show the revised effective date.