Privacy Policy

1. Who we are

Water Creations Swim Academy (“WCSA”, “we”, “us”) is the data controller for personal information collected through this website and our services. WCSA is a limited company registered in England and Wales, company number 14749719.

Contact:
info@wcsacademy.co.uk
020 8016 4222

2. The law we follow

We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations 2003.

3. What we collect

For swimmers and camp attendees

We may collect:

• Child’s name and date of birth
• Parent or carer contact details
• Emergency contact information
• Medical conditions or allergies relevant to safe participation
• Swimming ability and progression records
• Photography consent preferences
• Safeguarding records where necessary

For STA course learners

We may collect:

• Name and date of birth
• Address and contact details
• Existing qualifications
• Assessment outcomes and certification records

For website visitors

We may collect technical information through cookies and analytics tools. Please see our Cookie Policy for more information. 

4. Why we collect it (our lawful basis)

We process personal data for the following reasons:

• Contract — to deliver swimming lessons, camps and courses you have booked
• Legal obligation — for safeguarding, health and safety, DBS checks and tax records
• Vital interests — in safeguarding or medical emergencies
• Legitimate interest — for operational communication and service management
• Consent — for marketing communications and photography permissions

5. Special category data

Health and medical information is collected only where relevant to safe participation and is processed on the basis of explicit consent and substantial public interest under Schedule 1 of the Data Protection Act 2018.

Safeguarding records are processed under the safeguarding of children substantial public interest condition.

6. Who we share it with

We use trusted third-party services to operate our business, including:

• Soakly — bookings and registers
• GoCardless — direct debit processing
• STA — course registration and certification
• Microsoft — cloud storage and email systems

Each provider operates under an appropriate Data Processing Agreement.

We do not sell personal data and we do not share personal information with third parties for marketing purposes without explicit consent. 

7. How long we keep it

• Swimmer and camp attendee records: duration of enrolment plus 3 years
• STA learner records: duration of certification plus 3 years (or as required by STA)
• Financial and payroll records: 7 years from the end of the tax year
• Safeguarding records: lifetime of the organisation plus 7 years, or until the child’s 25th birthday — whichever is longer
• Marketing consent records: duration of consent plus 1 year after withdrawal

8. Your rights

Under UK GDPR, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to processing
• Request data portability

To exercise any of these rights, email: info@wcsacademy.co.uk

We aim to respond within 30 calendar days.

9. International transfers

Our primary data processing takes place in the UK. Where third-party processors transfer data outside the UK, we ensure appropriate safeguards are in place, including UK adequacy regulations or Standard Contractual Clauses.

10. Data breaches

Where a personal data breach poses a risk to individuals’ rights and freedoms, we notify the Information Commissioner’s Office within 72 hours. Where required, affected individuals will also be informed directly.

11. Complaints

If you are unhappy with how we have handled your data, please contact us first.

You may also contact the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

0303 123 1113
ico.org.uk

12. Governing law and review

This policy is governed by the laws of England and Wales.

It is reviewed annually, or sooner where legislation, ICO guidance or our data processing activities change.