EASI Privacy Policy

Last Updated: 20 August 2026

Effective Date: 20 August 2026

1.0 Who We Are

1.1 This Privacy Policy explains how eFoil Accreditation & Safety International Ltd, a company registered in England and Wales (company number ######), trading as EASI ("EASI", "we", "us"), collects, uses and protects your personal data when you use the EASI application ("App"), this website, or our WhatsApp line.

1.2 EASI is the data controller for the personal data described in this policy.

1.3 We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1.4 This policy should be read together with our Terms of Use.

1.5 Transition. Until eFoil Accreditation & Safety International Ltd completes its registration, the App is operated on its behalf, and that company becomes the controller on incorporation. Your rights under this policy apply throughout and are not affected.

2.0 The Personal Data We Collect

2.1 Account information — full name, username, email address, profile photo, date of birth, country or region, language preference.

2.2 Rider profile — your recorded rider level and status, weight and riding preferences, bio and experience, preferred brand and setup.

2.3 Session data — session date, location, duration, conditions, notes, and who took part. Where a session involves other riders or an instructor, their participation is recorded against the same session.

2.4 Equipment data — the gear in your quiver, your preferred setups, and product selections.

2.5 Your WhatsApp number.

2.5.1 You may add a WhatsApp number to your profile. Storing it is optional.

2.5.2 Your number is not shown to other users by default. Your profile carries a "Message me on WhatsApp" control which is switched OFF unless you turn it on.

2.5.3 If you turn it on, other users of the App can contact you on WhatsApp from your public profile. You can turn it off at any time, which stops it being shown from that point forward.

2.5.4 Please be aware that anything shown publicly can be seen, copied or recorded by others while it is visible. Turning the control off prevents future display but cannot recall what someone has already seen or saved.

2.6 Messages and voice notes you send to our WhatsApp line.

2.6.1 You can log sessions and contact us by sending a message or a voice note to the EASI WhatsApp number.

2.6.2 When you do, we receive and store the message, any audio you send, your phone number, and a record of our replies to you.

2.6.3 Voice notes are transcribed to text. Transcription runs on EASI's own hardware using a local speech model. Your audio is not sent to any third-party transcription service, and it is not used to train anyone's models.

2.6.4 A transcript may contain whatever you said, including place names, coordinates for where you rode, and the names of other people you mention. We use this to create or update your session records.

2.7 Your home town and the network map.

2.7.1 You may add a home town to your profile. It is free text that you type, and adding it is optional.

2.7.2 If you add one, we convert it into approximate coordinates on our own servers, so that it can be shown as a pin on the EASI network map.

2.7.3 Your pin is not shown by default. It appears only if you switch on the map setting in your account, and you can switch it off at any time.

2.7.4 The pin shows your town, not your address. The App does not ask for, or use, your device's location, and we do not track where you are.

2.8 Maps.

2.8.1 The App and this website use Google Maps to display the network map.

2.8.2 When a map loads, Google automatically collects some data, including your device type and operating system, your IP address, and an identifier used by the Maps service. Google collects this, not us, and Google's Privacy Policy applies to it.

2.9 Device and usage data — app usage patterns, device type and operating system, and basic analytics for performance, security and stability. This is generally used in aggregated form and is not intended to identify you.

2.10 We do not collect special category data (such as health or biometric data) and ask you not to submit it in free-text fields or voice notes.

2.11 What we do not do. The App has no in-app messaging between users, and it cannot record audio. We do not read your WhatsApp account, your contacts, or any conversation you have with another person.

3.0 Why We Use It, and Our Lawful Basis

3.1 We use your personal data for the purposes below. The lawful basis we rely on for each is given after the dash.

(a) Creating and managing your account, and providing the App — contract (Article 6(1)(b))

(b) Displaying your profile, logbook and any recorded level to other users — contract (Article 6(1)(b))

(c) Recording sessions, including sessions you log by message or voice note — contract (Article 6(1)(b))

(d) Transcribing voice notes you send us, so they can become session records — contract (Article 6(1)(b))

(e) Showing a "Message me on WhatsApp" control on your public profile — consent (Article 6(1)(a)), given by turning the control on, and withdrawn by turning it off

(f) Showing your pin on the public network map — consent (Article 6(1)(a)), given by switching the map setting on, and withdrawn by switching it off

(g) Replying to you on WhatsApp about something you contacted us about — contract (Article 6(1)(b)), or legitimate interests (Article 6(1)(f)) where you are not yet a user

(h) Operating, maintaining, securing and improving the App — legitimate interests (Article 6(1)(f)), being our interest in running a safe and working platform

(i) Analytics and performance measurement — consent (Article 6(1)(a)), given through the cookie banner

(j) Maintaining platform safety and integrity, and preventing fraud and abuse — legitimate interests (Article 6(1)(f))

(k) Keeping a record of anyone who has asked us not to contact them — legitimate interests (Article 6(1)(f)), being our interest in reliably honouring that request

(l) Keeping a record that an account was deleted and when — legal obligation and legitimate interests (Articles 6(1)(c) and 6(1)(f)), so we can demonstrate we honoured the request

3.2 Where we rely on legitimate interests, we have balanced those interests against your rights, and you may object at any time under section 7.

3.3 Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing already carried out.

3.4 We do not use your data for advertising, and we do not use your voice notes, transcripts or session data to train artificial-intelligence models for anyone else.

4.0 Sharing

4.1 We do not sell your personal data. If that ever changes, we will update this policy and obtain your consent where required.

4.2 With other users — depending on your activity, other users may see your profile information, your logbook and any recorded level, your participation in activities, and, if you have turned the relevant control on, your WhatsApp contact button and your map pin.

4.3 With accredited operators — where an operator confirms a session you took at their location, or assesses and awards you a level, that operator sees the data necessary to do so.

4.4 When you message on WhatsApp — WhatsApp is operated by Meta, not by EASI. Any conversation you have there is also processed by Meta under its own terms and privacy policy, over which we have no control. If another user contacts you through the button on your profile, that conversation happens entirely on WhatsApp and we are not party to it and do not store it.

4.5 With Google — when a map loads, Google receives the data described in 2.8.2. Google's Privacy Policy governs how Google uses it.

4.6 With service providers — hosting, infrastructure, analytics and security providers acting as our processors under Article 28 contracts. They may use your data only to provide services to us.

4.7 For legal and safety reasons — where reasonably necessary to comply with law or legal process, respond to lawful requests from authorities, protect the rights, property or safety of users, EASI or others, or detect and prevent fraud, abuse or security issues.

5.0 Where Your Data Is Held, and International Transfers

5.1 Our main database is hosted in Frankfurt, Germany, inside the European Union.

5.2 Transfers from the EU to the United Kingdom are covered by the European Commission's adequacy decision for the UK, so no additional safeguard is required for them.

5.3 We also operate our own hardware in the Cayman Islands. This is where voice notes are received and transcribed, and where transcripts and message records are held.

5.4 The Cayman Islands is not covered by a UK adequacy decision. For transfers there we use an appropriate safeguard under Article 46 UK GDPR — the ICO's International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses — together with a transfer risk assessment.

5.5 You may request a copy of the safeguard we rely on by emailing us at the address in section 12.

6.0 Storage, Security and Retention

6.1 We take appropriate technical and organisational measures to protect your data, including secure storage, controlled access, and platform-level security protections. No system is completely secure.

6.2 We retain personal data for the following periods:

(a) Account and profile data — while your account is active. If you delete your account, see 6.3.

(b) Session records and any recorded level — while your account is active. See 6.4 for what happens on deletion.

(c) WhatsApp conversation records, including transcripts of your voice notes — automatically deleted after 90 days.

(d) The voice notes, photos and files you send us — kept while we need them to complete your session record, and erased when you ask us to under 6.5.

(e) Your home town and the coordinates derived from it — kept while they are on your profile. Clearing your town removes them, and they are deleted with your account.

(f) Device and analytics data — up to 26 months, in aggregated form.

(g) A record that a number asked not to be contacted — kept indefinitely, because deleting it is the only way we could accidentally contact you again.

(h) A record that an account was deleted, and when — kept as an audit entry. See 6.4.

(i) Records we are required by law to keep, such as accounting records — for the period the law requires, typically 6 years.

6.3 Deleting your account. You can delete your account from within the App, or by emailing us. Deletion starts a 30-day grace period, during which you can reactivate. After 30 days, an automated job permanently deletes your user record, your rider, instructor, operator, retail, service and brand profiles, your quiver and preferred setups, your roles, your verifications, and your participation records.

6.4 What survives deletion, and why. Two things are deliberately kept:

(a) Sessions that other people also took part in are not deleted, because they are also those riders' and that operator's records. Your link to them is removed.

(b) A single audit entry recording that an account was deleted, when it was requested, and when it was completed. We keep this so we can demonstrate that we honoured your request.

6.5 Our WhatsApp line is separate from your app account. Deleting your account in the App removes your account and your records in the App, but it does not by itself clear the messages, voice notes and transcripts held on our WhatsApp line. To erase those, message us "delete my data" on WhatsApp or email the address in section 12, and we will erase everything associated with your phone number.

7.0 Your Rights

7.1 Under UK GDPR you have the right to:

(a) be informed about how we use your data — this policy

(b) access the personal data we hold about you

(c) rectify inaccurate or incomplete data

(d) erasure of your data ("the right to be forgotten")

(e) restrict our processing in certain circumstances

(f) data portability — receive your data in a structured, commonly used, machine-readable format

(g) object to processing based on legitimate interests, and to direct marketing at any time

(h) withdraw consent at any time where we rely on it

(i) not be subject to solely automated decision-making with legal or similarly significant effects

7.2 We do not carry out automated decision-making or profiling that produces legal or similarly significant effects. Transcribing a voice note is an automated step, but it only turns your own words into text for your own records, and a person can correct it.

7.3 To exercise any right, email admin@easi.network. We respond within one month, as UK GDPR requires. Exercising your rights is free.

7.4 To stop us contacting you on WhatsApp, reply STOP to any message from us, or email us. We will add your number to a suppression list and you will not hear from us again.

7.5 You have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at any time:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF ico.org.uk — 0303 123 1113

We would appreciate the chance to address your concern first, but you are not required to contact us before complaining.

8.0 Cookies

8.1 This website uses cookies necessary for it to work, and analytics cookies to understand how it is used.

8.2 Non-essential cookies are set only with your consent, given through the cookie banner. You may decline, and you may change your choice at any time through your browser settings.

8.3 Our contact form uses Google reCAPTCHA to prevent automated abuse. Google's privacy policy and terms apply to that service.

9.0 Other People Mentioned in Your Sessions

9.1 If you mention another rider or an instructor when logging a session, we record that they took part.

9.2 If that person has an EASI account, it appears in their records too. If they do not, we hold only what is needed to complete your session record.

9.3 If you have been named in someone else's session and you would like it removed, email us at the address in section 12 and we will remove it.

10.0 Your Responsibilities

10.1 You are responsible for keeping your login details secure, for the accuracy of information you provide, and for choosing what you share with others in your profile, your sessions, and anything you choose to display publicly.

11.0 Children's Privacy

11.1 The App is not intended for anyone under 18 without the consent of a parent or legal guardian.

11.2 We do not knowingly collect data from children without appropriate consent. If you believe a child has provided personal data without consent, contact us and we will delete it.

12.0 Changes and Contact

12.1 We may update this policy. Where changes are material we will notify you in the App or by other reasonable means, and you may be asked to accept the update to continue using the App.

12.2 This policy is governed by the law of England and Wales.

12.3 For any question about this policy, or to exercise a right:

eFoil Accreditation & Safety International Ltd

Email: admin@easi.network