Privacy Policy

Privacy Policy

1. Who we are and who controls your data

Olympus Swim is a software platform for competitive swimming clubs in the United Kingdom, provided by Olympus Sports Systems Ltd, trading as Olympus Swim, of 98 Heol Gwyrosydd, Swansea, SA5 7BY.

When you are a member, parent, coach, volunteer, or committee member of a swimming club that uses Olympus Swim, your club is the data controller for your personal data. Your club decides what information is collected and why, and it is responsible for telling you how that data is used, through its own privacy notice. Olympus Swim is the data processor. We process personal data only on the club's documented instructions, under a Data Processing Agreement between the club and Olympus Sports Systems Ltd, and we do not decide what is collected or why.

For a small set of matters that are not about club members, Olympus Sports Systems Ltd is itself the data controller: our own contractual and billing relationship with each club, the business contact details of people at clubs who enquire about or sign up to the platform, and the security and system logs we keep to run the platform safely. The audit log inside each club's own environment, which records who did what to the club's records, is different: we process it on the club's behalf.

This policy explains, from Olympus Swim's perspective, what personal data passes through the platform, how it is protected, and who it is shared with, so that anyone whose data we process, in either capacity, can understand how it is handled. Where your club is the controller, this policy sits alongside, and does not replace, the privacy notice your club gives you directly.

2. The personal data processed through the platform

Depending on a person's role within a club, the platform processes the following categories of personal data.

Swimmers, including children

• Name, date of birth, and gender
• Squad and membership status
• Attendance records and training history, including the reason recorded for an absence and, where a coach notes that a swimmer got out of a session early, a note of roughly how much of the session they did
• Training load figures, calculated from the session plans assigned to the sessions a swimmer attended (see section 4)
• Medical conditions and allergies, where a parent or guardian has agreed the club may keep a record of them, and emergency contact details
• Wellness data, where the club has switched wellness logging on for the swimmer's squad, including observations recorded by named club staff (see section 4)
• Competition entries and personal best times
• Photographs and video images, where the club uploads them, and the associated consent or opt-out preference

Parents and guardians

• Name and contact details
• Relationship to one or more swimmers
• Invoice and payment history, including Direct Debit mandate reference and status
• Messages sent and received through the platform
• Acceptance of this policy and consent choices, each recorded with the date and time and the version of this policy in effect

Coaches, volunteers, and committee members

• Name and contact details
• Role and squad assignments
• DBS records and qualification details
• Coaching hours and session records
• Acknowledgements of club policies
• Messages sent and received through the platform

Prospective members (waiting list)

• Name, date of birth, gender, ability level, and intended squad, collected by the club before any offer of membership is made

We do not hold full bank or card details ourselves. Payment information is held by our payment provider, Stripe, as set out in section 8.

3. Children's data

Olympus Swim is used by clubs that work with children. We take particular care with the personal data of anyone under 18. The platform is structurally designed to protect children. Coaches cannot exchange direct private messages with swimmers under 18, and a swimmer's own login cannot send or receive messages at all. All messages are logged and can be read by the club's Welfare Lead. Access to a child's data is limited to those who need it for their role within the club.

A swimmer of any age can have their own login. For a swimmer under 18, it is created and controlled by the swimmer's parent or guardian. It is read-only: the swimmer can see their own personal bests, timetable and eligible events. A swimmer aged 14 or over has one further action, which is to submit their own wellness entry, and only where wellness is switched on for their squad and their parent or guardian has agreed to it. A swimmer under 14 has no action of their own; wellness for that age group is logged by the parent or guardian. A swimmer aged 18 or over is an adult and an individual user in their own right.

The first time a parent or guardian signs in, they see a single consent screen before anything else in the portal opens. On that screen they read this policy and tick to accept it. For each child linked to their account, they then answer yes or no to whether the club may keep a record of that child's medical conditions and allergies. Where a child is 14 or over and has their own login, the parent or guardian is also asked yes or no to whether that child may log their own wellness. Nothing else in the portal opens until this screen has been completed.

Each answer is recorded with the date and time and the version of this policy in effect when it was given. Afterwards, the Data & Privacy page shows when the parent or guardian accepted this policy, with an option to read it again. The answer on medical records can be changed from the Data & Privacy page, and the answer on a child aged 14 or over logging their own wellness can be changed from the Wellness page.

A note for swimmers

If you are a swimmer, your club keeps your name, date of birth, squad, attendance and race times on Olympus Swim so your coaches can run training and enter you into galas. Your coaches, your club's Chair and Vice-Chair, and its Welfare Lead can see this information, and so can your parent or carer, who also controls your login. Your club's Meet Secretary can see your basic details, squad and personal bests, and your parents' details. Your club's Treasurer can see your name and your parents' details. Olympus Swim staff can reach your club's records only to give the club support. Nobody can message you through the platform. If your club has switched on wellness logging and you are 14 or over, you can choose to log how you are doing. Your coaches, your club's Chair, Vice-Chair and Welfare Lead, and your parent or carer can see what you log. You can ask your club, or us, what information is held about you, and you can tell us if you are unhappy about how it is used. Section 14 explains how.

4. Wellness and training load

Wellness

Wellness logging runs for a squad only if the club has turned it on, which a club does squad by squad. Where it is on, wellness is recorded through two separate tools.

The first is the swimmer and parent log. A swimmer aged 14 or over may log their own wellness from their own account, where their parent or guardian has said yes on the consent screen. A parent or guardian may log wellness on behalf of a swimmer under 14, after giving separate consent the first time they choose to do so. The log offers four optional factors, each on a 1 to 10 scale: perceived effort or fatigue, recovery, stress from outside swimming, and feel for the water. It uses fixed numeric options only and allows no free text. A swimmer or parent can log one factor or all four, and a session with no entry shows as no response. Entries in this log do not send a notification to anyone.

The second is the staff duty-of-care observation, recorded by a named coaching or welfare role at the club (Coach, Head Coach, Welfare Lead, Chair or Vice-Chair) when they notice something about a swimmer's demeanour, physical state, or surroundings. It uses fixed options and allows an optional free-text note of up to 150 characters. Every observation, including any note, is attributed to the member of staff who recorded it. A green observation notifies nobody. An observation flagged amber sends a notification to the club's Head Coach only, and the club's Welfare Lead can read the full observation log.

Notifications inside the platform support a coach's awareness of a swimmer's wellbeing and training load. They are not a safeguarding alert system, a notification does not by itself trigger any welfare process outside the platform, and any safeguarding concern should be raised through the club's own safeguarding procedure. Olympus Swim does not receive or act on safeguarding concerns.

Training load

The platform calculates a weekly training load for each swimmer from the planned distance of the session plan that a coach has assigned to each session the swimmer attended. Where a coach notes that a swimmer got out of a session early, the figure for that session is adjusted by the coach's estimate of how much of the session the swimmer did. These are planned figures. They are not a record of the distance a swimmer actually swam, and they do not use any wellness entry.

Training load is shown to the Coach, Head Coach, Chair and Vice-Chair, and a parent or guardian can see their own child's figure. When one week's load rises or falls sharply compared with the week before, the platform shows a neutral flag to coaches. It makes no decision about a swimmer and stops no one from doing anything.

5. How personal data is used

Personal data is processed to operate the platform and provide the services clubs rely on, including managing memberships, squads, and waiting lists, recording attendance, supporting coaching and wellbeing, managing competition entries, handling club communications, producing invoices and financial records, and maintaining safeguarding and compliance records. Providing support to clubs and users is carried out as processor, within the club's instructions under the Data Processing Agreement.

Separately, and only in our own right as controller, we process limited administrative and security data: our own contractual and billing relationship with each club, the business contact details of people at clubs who enquire about or sign up to the platform, and the security and system logs we keep to run the platform safely. Under each club's instruction in the Data Processing Agreement, we also create aggregated, anonymised data from the platform and use it only to maintain, secure and improve the service. It identifies no individual and no club, and we do not try to re-identify it.

6. Legal basis for processing

Each club, as controller, decides its own legal basis for each kind of processing and tells its members in its own privacy notice. The platform is designed to support the bases set out below, and Olympus Swim processes data strictly within the club's instructions.

Where Olympus Sports Systems Ltd is itself the controller, for our own contractual and billing relationship with a club, the business contact details of people at clubs, and the security and system logs we keep to run the platform safely, we rely on legitimate interests and, for billing, performance of our contract with the club. We do not rely on consent for this processing, and it does not extend to a club's own decisions about its members' data.

7. Automated processing and profiling

The platform does not make decisions about swimmers or other individuals by automated means. The training load flags in section 4 are shown to coaches for their information. A coach decides what, if anything, to do, and the flag blocks nothing. No decision with a legal or similarly significant effect on anyone is made by the platform, so the restrictions on automated decision-making in Article 22 of the UK GDPR do not apply.

8. Who we share data with

We do not sell personal data, and we do not allow advertisers to access it. We share personal data only with the service providers necessary to operate the platform, and we require each of them to protect the data and to process it only on our instructions. These providers include our development and hosting operations partner (Cogs Group Ltd, trading as CogsAI), our hosting and infrastructure provider (Cloudflare), our database provider (Supabase, hosted in the United Kingdom), our email delivery provider (Resend), our error monitoring provider (Sentry), our status monitoring provider (Better Stack), our source control provider (GitHub), which does not hold production personal data in the ordinary course, and our payment provider (Stripe Payments UK Ltd and Stripe Payments Europe Ltd), which processes the payment information needed to collect Direct Debit and card payments on a club's behalf. Stripe also acts as an independent controller for certain of its own processing, such as fraud prevention and regulatory compliance, under its own privacy notice. We may also disclose personal data where required by law, or to protect the safety of a child or another individual.

9. Where data is stored

Our primary database is hosted in the United Kingdom. Some of our service providers process data within the European Economic Area; transfers from the United Kingdom to the European Economic Area are permitted under the United Kingdom's own adequacy regulations, without additional safeguards. Some of our providers are part of United States groups, and some processing takes place at globally distributed edge locations without persistent storage. Transfers to or access from the United States or any other country outside the United Kingdom and the European Economic Area are made under the United Kingdom Extension to the EU-US Data Privacy Framework where the provider is certified under it at the time, or otherwise under the International Data Transfer Agreement or the United Kingdom International Data Transfer Addendum. Payment data processed by Stripe may be transferred outside the United Kingdom and the European Economic Area within the Stripe group; those transfers are protected by the European Commission's standard contractual clauses as supplemented by the United Kingdom International Data Transfer Addendum.

10. How long data is kept

Personal data is kept for as long as a club uses the platform and the data is needed to provide the service, and thereafter only for as long as required to meet legal, safeguarding, or financial record-keeping obligations, as instructed by the club. Where a person applies to a club's waiting list and is not offered membership, their information is kept only for as long as the club needs it to manage the waiting list, and is deleted once that need ends. When a club leaves the platform, its data is returned or deleted in line with our agreement with that club. If a parent or guardian withdraws consent to wellness logging, the entries logged through that route are deleted.

11. Your rights

Under the UK GDPR, individuals have the right to access the personal data held about them, to have inaccurate data corrected, to have their data deleted, to restrict or object to processing, and to receive their data in a portable format, and, where processing relies on consent, to withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal. A parent or guardian can change their answer on medical records at any time from the Data & Privacy page, and their answer on a child aged 14 or over logging their own wellness from the Wellness page. Withdrawing consent for wellness logging switches that route off for the child and deletes the entries logged through it.

The platform is built to action these rights on a club's instruction. A club administrator can export all data held for a named individual, including coaches, volunteers and committee members as well as swimmers and parents. A club administrator can also raise an erasure request, but nothing is deleted until the club's Chair has reviewed and signed it off, since the right to erasure is not absolute and the club needs to consider whether an exemption applies. Every request, decision and completion is recorded in the audit log. After an erasure, the person no longer appears in any list, record or history on the platform. Records the club must keep by law, such as safeguarding messages, policy acknowledgements, consent evidence, the audit log and financial records, are kept with the person replaced by an anonymised identifier.

To exercise any of these rights, an individual should contact their club in the first instance, since the club is the controller. Olympus Swim can also be contacted directly using the details in section 14 and will refer the request to the relevant club.

12. Security

Personal data is protected with technical and organisational measures appropriate to its sensitivity. These include encryption in transit and at rest using AES-256, role-based access controls that limit each user to the data necessary for their role, separation of each club's data enforced at the database level, append-only audit logging, secure authentication, and regular backups. No system can be guaranteed completely secure, but the platform is designed with the protection of children's data and sensitive information as a priority.

13. Cookies and location

This website and the platform use cookies that are necessary for them to function, including for secure login and session management. We do not use advertising cookies. Where any non-essential cookie, including any analytics cookie, is introduced on this website or the platform, we will seek consent before it is set and update this policy accordingly.

The platform has no location feature, and registers are taken by hand. Our security logs record IP addresses, as they must, and we do not use them to locate a child or anyone else.

14. Contact and complaints

For anything relating to how your club handles your personal data, contact your club in the first instance. For anything relating to how Olympus Swim itself handles data in its own right as controller, or for general questions about this policy, contact Olympus Swim at joel@olympus-swim.co.uk. Olympus Sports Systems Ltd's ICO registration reference is ZC236989.

If you want to complain about how your information has been handled, you can tell your club or tell us, and we will acknowledge a complaint about our own processing within 30 days and tell you what we have done. A swimmer or a parent or guardian can make a complaint in their own words, and we will reply in plain language. Individuals also have the right to lodge a complaint with the Information Commissioner's Office, the UK supervisory authority for data protection, at ico.org.uk. We would, however, appreciate the opportunity to address any concern before it is raised with the ICO.

15. Changes to this policy

We may update this policy from time to time. Where a change is material, we will give clubs at least 30 days' written notice and, where appropriate, ask for renewed acknowledgement, including from parents and guardians. The version and effective date at the top of this policy indicate when it was last revised. This version takes effect for clubs and users already on the platform 30 days after we notify them of it.