Safeguarding and Child Protection Policy
If a child is in immediate danger
Call 999. Do not wait, do not message us first, and do not try to find out more before you ring.
If a child is not in immediate danger but you are worried about them, read "How to report a concern" below. You do not have to be certain. You do not have to have evidence. Telling someone is the right thing to do.
- Us: [email protected]
- NSPCC helpline (adults worried about a child): 0808 800 5000
- Childline (for anyone under 19): 0800 1111
Our commitment
Most of the people whose data flows through SailCoach are children. Sailing is one of the few sports where a twelve-year-old regularly trains alongside adults, travels to events, and is coached one-to-one on the water. We build the software that sits between those people, so we carry a share of the responsibility for keeping it safe.
We commit to:
- treating the welfare of a child as more important than our relationship with a coach, a club, or a paying customer;
- making it easy to tell someone, including telling someone who is not us and not the child's own club;
- acting on what we are told, quickly, and referring to the statutory agencies when the threshold is met;
- building the platform so that the risky things are harder and the safe things are the default;
- saying plainly where our controls are not yet good enough, and publishing the date by which they will be.
The section "What we are changing, and when" lists the gaps in the product as it stands today, each with a date.
This policy is written to sit alongside UK child-protection practice: the Children Act 1989 and the Children Act 2004, the statutory guidance Working Together to Safeguard Children, and the safeguarding standards that the RYA sets for affiliated clubs and recognised training centres.
Who this applies to, and what we are not
This policy applies to:
- everyone at Innovology Ltd — directors, staff and contractors;
- coaches, club administrators, sailors and parents using SailCoach, in what they do on the platform;
- anyone who becomes aware of a concern through the platform, whatever their role.
We are a software provider, not a club. We do not employ coaches, run training sessions, supervise children on the water, or hold the duty of care during a session. Clubs, centres and coaches do. We cannot obtain DBS checks on club coaches, because we are not the regulated activity provider for their work — that responsibility sits with the organisation they coach for.
What we are responsible for is the platform: who can contact a child through it, what an adult can see about a child, what happens to images and medical information, and whether a concern raised through it reaches someone who will act. Those are our duties and this policy covers them.
Our Safeguarding Lead
We have a named Safeguarding Lead. The role is held by a director of Innovology Ltd, and it is the role — not a committee and not "the support inbox" — that owns safeguarding decisions here.
Contact: [email protected]
We do not publish the post-holder's name on this page, because the page changes less often than the person might. Ask at [email protected] or [email protected] and we will tell you who currently holds the role.
The Safeguarding Lead is responsible for:
- receiving and recording concerns;
- deciding whether to refer to children's social care, the police, a club welfare officer or the RYA;
- deciding whether to suspend an account while a concern is looked at;
- keeping the safeguarding record;
- reviewing this policy every year and after every incident.
If your concern is about the Safeguarding Lead, or about anyone at Innovology Ltd, do not come to us first. Use one of the independent routes below. That is not a formality — it is the point of having them.
Recognising a concern
You do not need to be able to name what you are seeing. If something feels wrong, report it. The categories below are to help you describe it, not to set a test you have to pass.
The four recognised categories of abuse
| Category | What it can look like |
|---|---|
| Physical abuse | Hitting, shaking, throwing, or deliberately causing injury. In sport it also covers pushing a child beyond safe physical limits, or using exercise as punishment. |
| Emotional abuse | Persistent criticism, humiliation, shouting, threats, scapegoating, or making a child feel worthless. Constant pressure to win, or blame for losing, sits here. |
| Sexual abuse | Any sexual activity involving a child, including touching, exposure, showing sexual images, or sexual conversation — whether or not the child appears to consent. A child cannot consent to sexual activity with an adult in a position of trust. |
| Neglect | Failing to meet a child's basic needs — leaving a young sailor without supervision, food, warmth, shelter, or the right kit for the conditions. |
Two further categories matter in sport specifically: bullying, including bullying by other sailors, and discriminatory abuse on grounds of race, disability, sex, gender identity, sexual orientation, religion or belief.
The online ones that matter here
Because SailCoach is a messaging and record-keeping platform, these are the patterns most likely to appear in front of us:
- Grooming. An adult building trust with a child in order to abuse them. The tells are ordinary-looking: unusual amounts of private attention, gifts or special treatment, "you're more mature than the others", asking to move the conversation to WhatsApp, Snapchat, Instagram or a games chat, asking for a phone number, and — above all — asking a child to keep something secret from their parents or their coach.
- Inappropriate adult-to-child contact. Messaging a child late at night. One-to-one contact a parent could not see. Comments about a child's body or appearance. Contact that has nothing to do with sailing.
- Images. Photographs or video of a child taken, kept or shared without permission, images that are sexualised, images that identify where a child trains or lives, or a child being asked to send a picture of themselves. See our Photography, Video and Image Use Policy.
- Bullying between sailors. Group chats that exclude or target one child, screenshots passed around, pile-ons about a race result, threats. Peer-on-peer abuse is abuse, and "they're all kids" is not a reason to leave it.
If you are a young sailor reading this: if a message makes you uncomfortable, you have not done anything wrong, and you will not be in trouble for telling someone. See Privacy: the short version for young sailors and Childline on 0800 1111.
How to report a concern
If a child is in immediate danger
Call 999. Then tell us at [email protected] when you can, so that we can act on the platform side — for example by suspending an account.
Report it to us
Email [email protected]. This mailbox is monitored by the Safeguarding Lead.
Tell us whatever you know. Do not wait until you can write a complete account. If it is easier, send two lines now and the detail later. If you can, include:
- who the concern is about — a name, a username, an email address, or a club and squad if that is all you have;
- which child is affected, if you know;
- what happened, in your own words, with dates and times if you have them;
- where it happened — in a SailCoach message, at the club, at an event, on another app;
- what the child said, as close to their exact words as you can manage;
- anything you have already done — who else you have told, whether a parent knows;
- how we can reach you, and whether you are happy for us to say who reported it.
Three things to hold on to:
- You do not need to be certain. "I might be reading too much into this" is a good enough reason to send the email. Deciding whether there is something in it is our job and the statutory agencies', not yours.
- Do not investigate it yourself. Do not question the child in detail, do not confront the adult, and do not warn anyone that a report has been made. Well-meant questioning can make a child's account unusable as evidence and can put them at greater risk.
- Do not delete anything. If the concern involves messages on the platform, leave them where they are. We can retrieve message history and audit records, but it is far easier if nothing has been cleared.
Today, reporting a concern to us means sending an email. There is a "report" action on individual messages inside the product, but do not rely on it. It writes the report to a moderation queue and flags the message. It does not notify anyone, no email is sent, no alert fires, and there is no screen anywhere in the product that displays the queue — it is read only when we go and look. We are building a proper in-product route to the Safeguarding Lead; the date is in the table below. Until then, the email address on this page is the route that works.
Report it to someone who is not us
You are not required to come to us at all, and there are times when you should not. If your concern is about SailCoach itself, or about the Safeguarding Lead, or if you have told us and nothing has happened, use one of these. They are independent of us and — apart from the first — independent of the child's club.
| Route | Contact | Use it when |
|---|---|---|
| The club's welfare officer | Every RYA-affiliated club and recognised training centre should have one. Ask the club, or check its website. | The concern is about something at the club and is not about the welfare officer or the club's leadership. |
| The RYA safeguarding team | [email protected] — and see rya.org.uk, under Safeguarding, for the current phone number and the RYA's own reporting form. | The concern is about a coach, an instructor, a club, or the way a club has handled a report. The RYA can act on a club's affiliation and on an instructor's qualifications; we cannot. |
| The Local Authority Designated Officer (LADO) | Call your local council and ask for the LADO, or for the child protection team. In Scotland and Northern Ireland, ask for the local child protection service. | An adult who works or volunteers with children has behaved in a way that may have harmed a child. This is the formal route for allegations against adults in a position of trust, and it exists precisely so that the adult's own organisation is not the only one deciding. |
| Children's social care | Your local council's children's services duty team. | A child is being harmed or is at risk of harm at home or anywhere else. |
| The police | 999 in an emergency; 101 otherwise. | A crime may have been committed. |
| NSPCC helpline | 0808 800 5000, or [email protected] | You are an adult who is worried about a child and want advice before doing anything else. Free and confidential, and you can stay anonymous. The helpline is not open 24 hours — check the current hours at nspcc.org.uk before you rely on it, and use the email outside them. If a child is at immediate risk, call 999, not the helpline. |
| Childline | 0800 1111, or childline.org.uk | You are under 19 and something is worrying you. Free, 24 hours, confidential, and it will not show on a phone bill. |
The NSPCC's Child Protection in Sport Unit (thecpsu.org.uk) publishes good, practical guidance for clubs and volunteers on all of this.
If you are outside the UK, call your local emergency number, and report to your country's child-protection service. You can still email [email protected] and we will act on the platform side, but a national agency will always be able to do more than we can.
Whistleblowing
If you work for us, or with us, and you believe we are mishandling a child-protection matter — including one you have already reported — you can blow the whistle. You do not have to go through your manager, and you do not have to go through the Safeguarding Lead.
The NSPCC is a prescribed person under the Public Interest Disclosure Act 1998 for matters of child welfare and child protection, and a disclosure to a prescribed person is protected in law. The NSPCC Whistleblowing Advice Line is 0800 028 0285, or [email protected]. You can use it anonymously. Check the current opening hours at nspcc.org.uk.
You can also go straight to children's social care, the police, the LADO or the RYA. None of those routes needs our permission or our knowledge.
Nobody at Innovology Ltd will be dismissed, disciplined, demoted, passed over or dropped as a contractor for raising a child-protection concern in good faith — with us, with a statutory agency, or with a prescribed person. That holds where the concern turns out to be mistaken, and it holds where the concern is about a director. Retaliating against someone who has raised one is itself a dismissable matter.
What we do when we receive a concern
| Stage | What happens | When |
|---|---|---|
| Acknowledgement | We confirm we have your report and give you a reference. If you have sent it anonymously and left no way to reply, we still record and act on it. | Within 1 working day |
| Initial review | The Safeguarding Lead reads the report, checks the platform record (messages, audit log, account history, connections), and decides on immediate action. | Within 1 working day of acknowledgement |
| Immediate protective action | Where there is a risk to a child, we suspend or restrict an account straight away — before any investigation, without notice, and without needing the account holder's agreement. We would rather be wrong and reverse it. | Immediately, where needed |
| Referral | Where the threshold for a referral to children's social care, the police, the LADO or the RYA is met, we refer. Where we suspend an account because an adult has harmed or may harm a child, we tell the club and the RYA, and we remind the club in writing that it may owe a referral to the Disclosure and Barring Service. | Usually same day; never later than 1 working day after the decision |
| Outcome | We tell you what we have done, so far as we are able to without breaching another person's confidentiality or cutting across a statutory investigation. | Within 10 working days, or sooner |
A referral is not optional. If the threshold is met, we refer — whether or not the reporter wants us to, whether or not the child wants us to, whether or not a club asks us not to, and whether or not it is commercially awkward. We do not seek the agreement of the person the concern is about before referring. Where a statutory agency is involved, they lead and we follow their direction.
We keep a record. Every concern is recorded: what was reported, when, by whom, what we decided, why, who we told, and when. Safeguarding records are held outside the coaching product in restricted storage, and only the Safeguarding Lead has routine access. We hold them for longer than ordinary account data, because a concern about a child can matter many years later — the periods are in our Data Retention Schedule. This is a manual process operated by a person, not an automated one, and we say so rather than implying a system that does not exist.
If you are unhappy with how we handled a concern, our Complaints Policy sets out how to challenge it — and the independent routes above remain open to you at every point.
Confidentiality and information sharing
We handle safeguarding information carefully and share it with as few people as possible. But there is one promise we will not make.
We cannot promise to keep a safeguarding concern secret. If a child is at risk, we will pass the information to the people who can protect them — children's social care, the police, the LADO, a club welfare officer, or the RYA — and we will do that whether or not we have been given permission.
If you are a child telling us something, we will be honest with you about that. We will tell you what we are going to do and who we are going to tell, before we do it wherever we safely can, and we will explain why. What we will not do is promise secrecy in order to get you to talk and then break the promise.
This is settled practice in UK child protection, not our invention: confidentiality is never a reason to leave a child at risk, and information sharing between the people who need to know is one of the things repeatedly found to have been missing when things have gone badly wrong.
The data protection position: sharing information to protect a child is lawful. We rely on Article 6(1)(d) (vital interests) or 6(1)(f) (legitimate interests) of the UK GDPR, and where the information is health data or concerns criminal allegations, on Article 9(2)(g) together with the condition at Schedule 1, Part 2, paragraph 18 of the Data Protection Act 2018 — safeguarding of children and of individuals at risk. That condition exists so that data protection cannot be used as a reason not to report. We do not tell the person a report is about that a report has been made, where doing so would put a child at risk or prejudice an investigation. Our Privacy Policy covers this in full.
What the platform does today to reduce risk
These are controls that exist now. We have deliberately not listed anything that is planned — planned controls are in the next section.
Images, video and files
- Media is stored in a private bucket. There is no public URL for a photo or a video of a sailor; access is through short-lived links issued to a signed-in user who is entitled to see that file.
- A link is only minted after an access check on the record the file hangs off — the note, the session or the event. Separately, the server refuses to store a file reference that does not sit under the uploader's own prefix, which blocks the common failure where someone borrows another person's file reference and gets a working link back.
- File types are restricted, which blocks a class of attack where a "photo" is really a script.
Medical and welfare information
- A squad medical note about a child is visible to that squad's head coach and to the coaches listed on the squad; the day view shows a coach only the notes for sailors in their own group. It is not on the roster list — the roster shows only that a note exists, not what it says. Narrowing access to the coach actually running that day's session is work we have not done, so adding a coach to a squad should be treated as giving them the medical notes of every sailor in it.
- Profile medical notes, emergency contacts, date of birth and phone numbers are stripped out for anyone who is merely connected to a sailor. A coach being connected to a sailor does not get them.
- There is no export, download, print or email path for squad medical notes — we checked for one when we audited this in September 2026. The text leaves our servers only to the screen of a coach who is entitled to see it.
Public exposure
- There is no public directory of sailors and no browsable index. The only people-search for accounts matches an exact email address or phone number, which is a deliberate design decision because most sailors here are children. One lookup falls short of that standard and we would rather say so here: any signed-in user can type in a sail number and get back the names and race history attached to it, from the published-results corpus described in our Privacy Policy. Sail numbers are short and are painted on the hull. Restricting, rate-limiting and logging that lookup is a dated commitment in our DPIA.
- A coach's public profile page never names the sailors they coach.
- Nothing in a signed-in area is available to search engines, and none of it is in our sitemap.
- Race results — which do contain real children's names, gathered from public results publishing — are behind sign-in. A crawler gets a sign-in page.
Adults, children and accounts
- Where a date of birth is missing or unreadable, we treat the account as belonging to a child. Oversight fails safe rather than open.
- A parent or guardian of a sailor under 18 can read what their child reads: their profile, their sessions, the coaching notes written about them.
- A parent can never post as their child. A guardian can act for a child on scheduling, consent, profile details and data entry, but speaking in a conversation as the child is refused unconditionally, for every account, with no override. One limit on what that guarantees: where a parent created the account, the parent chose the email address the password link went to, so the refusal stops a guardian speaking as the child through the guardian's own account — it cannot stop somebody who holds the child's sign-in.
Messages
- Messages cannot be edited or deleted. Once a message is sent, it stays — to the sailor, to their guardian, and in our records.
- Every message sent is written to an audit log with the time, the account, the IP address and the device.
- A message can be reported from within the product. That report is recorded and the message is flagged, but nothing is notified and no screen displays the queue — see "How to report a concern" above. Do not rely on it; email [email protected].
- Access to reported messages and to private message content for moderation purposes is restricted to administrators. Coaches are not moderators. Being a coach in a conversation does not give anyone the right to read other people's private messages.
Coach credentials
- DBS checks and safeguarding certificates are first-class credential types on a coach's record, alongside first aid and instructor qualifications, with expiry dates and a real status: valid, expiring, lapsed or unverified.
- A coach cannot verify their own credential. Verification is the club's to give. A coach enters the certificate; a club administrator confirms it; and if the coach then edits the substance of the entry, the verification is voided and has to be given again.
- There is no self-declared vetting field. A coach cannot enter their own "background check" status on their profile. The field has been removed from the interface and the server rejects it if a client sends one.
- Two credential surfaces are still self-typed and unchecked, and we would rather you knew which: the free-text "certifications" box on a coach's profile, and the qualifications list on a coach's public page. Neither is marked as unverified, so a parent looking at a public coach page cannot tell a sighted certificate from a typed claim. Labelling them is in the table below.
What we are changing, and when
The controls above are real. The following gaps are also real, and we would rather you read them here than discover them.
Nothing in this section is a hypothetical risk. Each line describes the platform as it is on 17 September 2026.
Delivered in the release that carries this policy: the self-declared "background check" field is gone from the coach profile, from the interface and from the server's update schema, so a coach can no longer assert their own vetting status.
| What is not good enough today | What we will do | By |
|---|---|---|
| A sailor under 18 can change their own date of birth, and doing so switches off their parent's access to their profile, messages and coaching notes — with no notification to the parent. | Lock the date of birth once set. A change for an under-18 requires a guardian or us, and the guardian is notified. | 31 October 2026 |
| Any adult in the same club can open a private conversation with a child without being connected to them, because a club-membership fallback intended for club-wide announcements also applies to direct messages. | Restrict that fallback to club announcements and emergency broadcasts. Direct contact with a child will require a connection. | 31 December 2026 |
| A guardian is never told when an adult asks to connect to their child, or when their child receives a first message from a new adult. Oversight works only if the parent thinks to go and look. | Notify the guardian on a connection request to a child, on its acceptance, and on a first message from a new adult. | 31 December 2026 |
| Automated checks on messages flag a short list of swear words. They do not detect grooming. We have written a scanner that looks for contact-detail exchange, requests to move to another app and secrecy language — it is not yet applied to messages. | Apply that scanner to messages, route what it finds to a trained reviewer rather than only flagging it, and keep improving it. It will support human judgement, never replace it. | 31 December 2026 |
| A verified, in-date DBS and safeguarding certificate are recorded but do not gate anything. A coach with no credentials at all is not restricted. | Make verified, in-date DBS and safeguarding certification a requirement — configurable by the club, on by default for work with under-18s — before a coach can be assigned to a squad or message a sailor under 18. | 31 December 2026 |
| The free-text "certifications" box on a coach's profile and the qualifications list on a coach's public page are typed by the coach and checked by nobody, and neither carries a marker saying so. | Mark every credential we display, on the profile and on the public page, as verified or unverified, so a parent can tell a sighted certificate from a typed claim. | 31 December 2026 |
| Background-check values a coach asserted before we removed the field are still stored on old records, though they can no longer be set or displayed. | Purge them from the database. | 31 December 2026 |
| Date of birth is required by the sign-up form but not by the server behind it, so an account can be created without one. | Require and validate date of birth server-side at sign-up, for every route into the product. | 31 March 2027 |
| We hold no record of a parent's permission for photographs or video of their child. | Per-child image permission, given by the guardian, enforced when media is uploaded and when it is shared. See Photography, Video and Image Use Policy. | 31 March 2027 |
| A parent is not asked to approve their child's account, and the parent's email address collected at sign-up is an unverified hint that nobody acts on. | Verify the parent's address at sign-up and require the parent to activate the account before a self-registered child can connect to an adult or send a message. See Children's Code Conformance Statement. | 31 March 2027 |
| Reporting a message writes a record to a queue that no screen displays and no alert fires on, so the report reaches nobody until we go and look. | Alert the Safeguarding Lead on every message report, and build the screen that shows the queue. | 31 December 2026 |
| The only in-product way to raise a concern at all is to report an individual message. There is no way to raise a concern that is not about a specific message. | A standalone "report a concern" route, usable by a sailor, a parent or a coach, reaching our Safeguarding Lead directly and outside the club's control. | 30 June 2027 |
These are the same dates as the risk register in our Data Protection Impact Assessment. If one moves, both move.
If a date in this table slips, we will change the date in this document and say why in the version history, rather than quietly leaving it. The dates are commitments about engineering work; they are not a reason to wait before reporting a concern, and none of them changes the fact that [email protected] works today.
What we expect of coaches and other adults
These expectations apply to every adult using SailCoach in connection with a child. They are part of our Code of Conduct, and breaking them can cost you your account and will be reported to your club and, where appropriate, to the RYA.
- Keep communication on the platform. Messages here are logged, reportable and visible to a guardian. A WhatsApp thread is none of those things.
- No private off-platform contact with a child without their parent's knowledge. Not direct messages on social media, not a personal phone number, not a private group chat, not a games platform. If a child contacts you privately, tell their parent and your club welfare officer.
- Nothing one-to-one that a parent could not see. Assume every message you send a child will be read by their mother. If that thought changes what you were about to write, do not write it.
- Never ask a child to keep anything from their parents or their club. Secrecy between an adult and a child is the single clearest warning sign there is, and there is no legitimate coaching reason for it.
- Do not promise a child confidentiality about something they tell you. Tell them you will have to pass it on, and who to.
- Keep it about the sailing. No comments about a child's body, weight or appearance beyond what the sport genuinely requires, and where it does — crew weight, fitness, kit — handle it in the way this platform is designed for and with the parent in the loop.
- Report, do not investigate. If a child tells you something, listen, do not press for detail, write down what they said in their words as soon as you can, and report it. Today, that means [email protected] and your club welfare officer.
- Photographs and video follow the Photography, Video and Image Use Policy. No personal device shots of other people's children posted anywhere.
Parents and sailors are covered too: the Acceptable Use Policy applies to bullying, harassment and abusive content from anyone, of any age.
What we expect of clubs using SailCoach
We provide the platform; the club provides the safeguarding framework around it. If your club uses SailCoach for work with children, we expect that:
- the club has its own safeguarding policy and a named welfare officer, and that sailors and parents know who that is;
- everyone in a role with regular contact with children has an appropriate DBS check at the correct level, obtained by the club — not self-declared;
- coaches and instructors hold current safeguarding training, and it is renewed rather than done once;
- volunteers and coaches are recruited properly: application, references taken up and read, identity checked, and a conversation about safeguarding at interview;
- club administrator accounts are given out sparingly, and only to vetted people. A club administrator on this platform can see the medical notes, emergency contacts, dates of birth and phone numbers of every sailor in their club, can read reported private messages, and can download the whole membership as a spreadsheet — names, dates of birth, and parents' names and email addresses, in one click. That is an appropriate capability for a welfare role and an inappropriate one for a general volunteer login shared around the committee;
- concerns are logged and escalated — to the LADO and to the RYA where the criteria are met — and not settled informally within the club;
- where a coach, instructor, administrator or volunteer is removed from working with children — or resigns, or is moved to other work — because they have harmed a child or pose a risk of harm to children, the club refers them to the Disclosure and Barring Service. That is a legal duty on the club under section 35 of the Safeguarding Vulnerable Groups Act 2006, and failing to make the referral is a criminal offence under section 38. It is not discretionary, it is not discharged by telling the RYA or the LADO instead, and it is not ours to do for you — we are not the regulated activity provider for a coach's work. Tell us when you have made one, so we can act on the account.
We will support a club's safeguarding officer with whatever platform records they legitimately need for an investigation. We will also decline a request from a club where handing over the material would put a child at greater risk, and we will say so.
Training and our own people
Everyone at Innovology Ltd with access to production data completes safeguarding awareness training before that access is granted, and refreshes it at least every three years. The Safeguarding Lead maintains training at a level appropriate to the role and keeps up to date with RYA and NSPCC guidance.
We are a small team. That is not an excuse for weaker safeguarding, but it does shape how we do it: rather than pretending to an internal panel we do not have, we have made the independent escalation routes in this policy prominent and we use them ourselves. We do not have a Data Protection Officer and are not required to appoint one; the reasoning is in our Privacy Policy.
Access to children's personal data inside the company is limited to those who need it to run the service. Message activity is audit-logged, as described above; we do not yet have a general audit trail covering every administrative action, and we are working on one. How we protect the platform more broadly is set out in our Security and Vulnerability Disclosure Policy.
Review
This policy is reviewed:
- every year, and re-dated even where nothing changes, so you can see it has been looked at;
- after any safeguarding incident or referral, to ask what the platform should have done differently;
- whenever a commitment in the table above is delivered, or whenever a date in it moves;
- whenever RYA or statutory guidance changes in a way that affects us.
Every version of this policy stays published with its effective date, so you can compare what we said before with what we say now.
Comments on this policy — including "this reads well but it did not work when I tried it" — go to [email protected].
Related documents
- Code of Conduct — what we expect of coaches, sailors, parents and clubs
- Photography, Video and Image Use Policy — images of children, and how to withdraw permission
- Complaints Policy — if we have handled something badly
- Children's Code Conformance Statement — how we measure up against the ICO's standards for children's services
- Privacy Policy and Privacy: the short version for young sailors
- Data Protection Impact Assessment — our published assessment of the risks this platform creates
- Your Data Rights — including how a parent exercises them for a child