Privacy Policy

Sail HYSTS is committed to data protection by complying with the UK General Data Protection Regulation (GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025. GDPR protects your personal data, which is information that directly or indirectly identifies you or your personal matters.

1 Sail HYSTS Legitimate Interest in personal data.

The personal data we hold is required to effectively operate the Scheme. We have a Legitimate Interest to hold and process it. We will only hold data we need for this purpose.

2 Information Sail HYSTS holds.

We hold some of your personal data, to enable selected personnel to manage Sail HYSTS operations. This information is derived from:

· A completed Gift Aid form – Name, address, phone numbers and in some cases, the bank details of individuals.

· A Young Person’s application – Name, age, limited medical information and contact details of those with parental responsibility.

· Details held on Volunteers – Name, contact details, RYA qualifications, self disclosure and references forms, next of kin, and from the DBS certificate: age, place of birth and address.

· Details held on Senior Instructors – Name, contact details, next of kin, RYA qualifications, bank details and from the DBS certificate: age, place of birth and address.

You have certain Individual rights, these are:

· the right to be informed – of the data Sail HYSTS holds.

· the right of access;

· the right to rectification;

· the right to erasure;

· the right to restrict processing;

· the right to data portability;

· the right to object; and

· the right not to be subject to automated decision-making including profiling.

3 What is the right of access?

You have the right to ask us whether we are using or storing your personal information. You can ask us for copies of your personal information, verbally or in writing, known as making a subject access request or SAR.

4 Why make a subject access request?

You can make a subject access request to find out:

· what personal information we hold about you;

· how we are using it; and

· where we got your data from.

This information can also help you exercise your other information rights effectively.

5 Protecting your personal information

This is achieved by:

· By keeping physical documents locked in a steel cabinet.

· By restricting access to personal data.

· By guarding access to computer files by password.

6 Sharing your personal information

Sail HYSTS does not share your information outside Sail HYSTS except where necessary, for example:

· Notifying authorities

· Providing information to emergency responders

· Providing information to HMRC for gift aid claims

7 How long does Sail HYSTS hold my information?

We hold your information for as long as you are associated with Sail HYSTS and for up to 18 months after your last interaction with us. After that time your personal data will be destroyed.

8 Who do I contact?

If you have a concern about the way we are collecting or using your personal data, you should raise your concern with the Sail HYSTS Principal (principal@hysts.co.uk).

9 Sail HYSTS Website

The Sail HYSTS website privacy and cookie policies can be found on the website’s home page.

10 Data protection complaints

Anyone who believes that we have not handled their personal data in accordance with applicable UK data protection law may make a data protection complaint to us. To help us investigate efficiently, we encourage complainants, where reasonably possible, to provide: their name and preferred contact

details; what happened and when; why they are dissatisfied; relevant supporting information; and the outcome they seek but does not need to cite legislation or use technical language. Suggested brevity is guidance only. We will not impose rigid word limits that prevent consideration of information reasonably necessary to understand or investigate the complaint.

You may submit your complaint by email to principal@hysts.co.uk or in writing to our postal address:

Sail HYSTS

c/o Bedhampton Community Centre

21 Bedhampton Road

PO9 3ES

We will take reasonable steps to recognise and appropriately route data protection complaints received through other channels.

We will acknowledge receipt of a complaint within 30 days of our receiving the complaint. Without undue delay, we will take appropriate steps to respond, including making appropriate enquiries, and will keep the complainant informed about progress. Without undue delay, we will inform the complainant of the outcome.

Where a complaint also contains a request to exercise a data protection right, such as a subject access request or data rectification, erasure, restriction or objection, we will identify and handle that element under the applicable rights procedure and legal timescale. We will not treat the general complaints timetable as replacing statutory rights-request deadlines.

Data protection complaints will be handled fairly and objectively, with an appropriate record of the issues, enquiries, evidence, updates, findings, outcome and remedial action. Where the complainant remains dissatisfied, they may complain to the ICO. Our internal process does not remove that right.

Data protection complaints will not be automatically paused merely because a submission is lengthy or clarification has been requested. We will continue to take appropriate steps without undue delay in relation to issues that can reasonably be identified.

11 Outcome and Remedies

Our response to a complaint will normally summarise the issues considered, explain the outcome and reasons in a proportionate manner, and state any action taken or proposed that can lawfully and fairly be disclosed.

Possible outcomes include no further action, an explanation, apology, correction, service improvement, review of a decision, staff or volunteer support, training, policy change, referral to another process, or other proportionate remedial action. An apology does not necessarily constitute an admission of legal liability.

We may be unable to disclose confidential personal information, employment action, safeguarding information, legal advice or information whose disclosure would be unlawful or unfair. We will not use confidentiality as a blanket reason to avoid giving a meaningful response.

12 Appeals

If the complainant is dissatisfied with the formal outcome of their complaint, they may request a further review by Sail HYSTS within 28 calendar days of receipt of our response. The request should, where reasonably possible, identify why the outcome or process is said to be wrong, unfair or incomplete. We may accept a late request where there is a reasonable basis for doing so.

The review will, so far as reasonably practicable, be conducted by a person who was not the original decision-maker and has no material conflict of interest. Where the Chair is involved, conflicted or unavailable, the review will be considered by the Principal, another unconflicted trustee, or an independent person appointed for that purpose.

We will aim to notify the review outcome within 28 calendar days. If more time is reasonably required, we will explain why and provide a revised timescale.

The review will normally conclude Sail HYSTS’s internal general complaints process. This does not affect your right to approach the ICO, court, tribunal, police, statutory body, or other competent organisation.

13 Anonymous complaints

Anonymous complaints will be considered on the information available and will not be disregarded solely because they are anonymous. The absence of contact details may limit our ability to clarify matters, investigate fully or communicate an outcome.

We will assess seriousness, credibility, available evidence, safeguarding implications, risk and whether other information supports further enquiries. We will not assume that an anonymous complaint is malicious merely because the complainant is unidentified.

14 Confidentiality, privacy and records

Data protection complaints will be handled as confidentially as reasonably possible. Information will be shared only with those who need it to assess, investigate, respond to or act on the complaint, or where disclosure is required or permitted by law. We cannot guarantee absolute confidentiality.

Complaint records will be generally retained for 6 years after closure where justified by legal, regulatory, evidential and organisational needs, but shorter or longer periods may apply by category, as determined by us. Data protection rights-request records may have a different documented period. Safeguarding, serious incident, litigation, insurance or regulatory records may require longer retention. No record will be kept longer merely for our convenience.

Normal deletion of records may be suspended where information is subject to a legal hold, actual or anticipated litigation, safeguarding concern, regulatory enquiry, law-enforcement request, audit, insurance matter or investigation. Any suspension will be limited and regularly reviewed.

15 Notes:

1. The Sail HYSTS Data Protection Policy is reviewed annually and amended if necessary.
2. Additional information visit the UK Information Commissioners Office (ICO): ico.org.uk

Links to other websites 

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.  

Cookie Policy

This Cookie Policy explains what cookies are, how we use them on our website, and the choices you have.

What are cookies?

Cookies are small text files that are placed on your device (computer, tablet, or phone) when you visit a website. They help the site work properly and allow us to understand how people use our pages so we can improve them.

Cookies cannot run programs, access your data, or harm your device.

Types of cookies we use

Your choices

When you first visit our website, you will see a cookie banner that allows you to:

• Accept all cookies
• Reject non-essential cookies
• Adjust Preferences – To choose which cookies you want to allow

You can change your choices at any time by deleting our cookies in your browser and re-entering our site.

You can also block cookies through your browser settings. If you block essential cookies, some parts of the site may not work properly.

Third-party cookies

Some cookies are set by third-party services we use, such as:

• Analytics tools (e.g., Google Analytics)
• Embedded videos (e.g. Vimeo)
• Advertising networks

These third parties may use their own cookies. We recommend checking their privacy policies for full details.

How long cookies stay on your device

Some cookies are session cookies, which disappear when you close your browser.

Others are persistent cookies, which stay on your device until they expire or you delete them.

Changes to this cookie policy

We may update this Cookie Policy from time to time. We will post any changes on this page with a new “last updated” date below.

Contact us

If you have any questions about this Cookie Policy or how we use cookies, you can contact us at:

Email: webmaster@hysts.co.uk

Registered Address: Havant Youth Sail Training Scheme -Sail HYSTS, Bedhampton Community Centre, 21 Bedhampton Road, PO9 3ES.

The policies on this page were last updated: 8th July 2026