Privacy Policy

What we collect, why, and how we look after it.

School Of Fish is committed to protecting and respecting your privacy. This policy explains how we collect, use, and protect the personal information of our learners, coaches, parents, guardians, and trainees.

For the purposes of the UK General Data Protection Regulation (UK GDPR), the Data Controller is School Of Fish Ltd, registered in England and Wales (company number 16920892), registered office 41 Harveys Close, Spalding, PE11 2NX, and registered with the Information Commissioner's Office (reference ZC160843).

Effective from July 2026. Jurisdiction: United Kingdom.

We collect different types of data depending on whether you're booking a session, enrolling in a coach training course, or joining a membership.

Personal Identification

• Parents, guardians and adults: name, address, email, phone number.
• Junior learners: name, date of birth (for age-appropriate supervision and rod licence compliance).
• Coach training candidates: name, address, email, phone, date of birth, angling experience.

Sensitive Information (Special Category Data)

Because of the physical nature of angling and our duty of care, we may collect:

• Medical information: allergies, physical disabilities, medication requirements, or learning differences (for example ADHD or autism) where these affect safety on the bankside.
• Dietary requirements: only if food is provided during a session.
• Criminal record data: for coach training candidates only, we process Enhanced DBS check data as required by law for working with children.

Financial Data

Payment details are processed securely via third-party providers (Stripe, PayPal). We do not store full card numbers.

Photos and Video

Photographs and short videos taken during sessions, used for marketing, social media, and training review (subject to your consent at booking).

Children's data. Where we hold data about anyone under 18, it is provided and consented to by a parent or guardian, and we handle it with care appropriate to their age, having regard to the ICO's Age Appropriate Design Code.

We collect data directly from you when you:

• Book a session, course, or membership through our booking platform.
• Complete a parental consent or medical disclosure form.
• Sign up for our newsletter or join the Coaches Community.
• Send us a message through the contact form on this site, email us, or message us on social media.
• Complete a coach training check on this site, where your name, email, score and date come to us so the completion can be logged.

Under UK GDPR, we must have a lawful basis for processing your data. The basis depends on what we're using it for:

• Processing bookings and payments. Lawful basis: contract. Necessary to deliver the service you've purchased.
• Ensuring safety (medical information). Lawful basis: vital interests in emergencies, plus explicit consent at the time of booking.
• Photography for marketing. Lawful basis: consent. You can opt in or out at booking and withdraw at any time.
• DBS checks for coach training. Lawful basis: legal obligation. Required for safeguarding children.
• Newsletters and updates. Lawful basis: consent if you opted in, or legitimate interest for existing customers regarding their bookings.

We do not sell your data. We share it only with:

• Emergency services if an accident occurs on the bankside.
• Service providers who help us operate (booking software, payment processors such as Stripe and PayPal, accounting software). They process your data only for the specified purpose and in accordance with our instructions.
• Our contact form provider (Web3Forms), which delivers messages and form submissions sent through forms on our website to our inbox. They process the form data only to pass it to us, and hold a copy for a short period before it's deleted.
• Google Firebase, which stores the optional cloud backup for our World of Fish game. The backup is encrypted on the device before it is sent, holds only game progress (no name, age, or contact details), is keyed to a code rather than an account, and is deleted automatically after 24 months or by the player at any time. Firebase, and Google reCAPTCHA which guards it against abuse, are only contacted if a player chooses to back up. The same Firebase service, in its London region, also holds our coach register: the qualification, training and compliance records we keep on coaches and candidates. Access is restricted to the school's operator account.
• Accrediting bodies (1st4Sport) for the issue and validation of coach training qualifications.
• Regulatory authorities (the Environment Agency, the Information Commissioner's Office, or relevant safeguarding authorities) where legally required.

International transfers. Some of our providers (for example Stripe, PayPal, and Cloudflare) may process data on servers outside the UK. Where they do, that data is protected by appropriate safeguards, such as UK adequacy regulations or standard contractual clauses.

We keep personal data only for as long as needed for the purpose it was collected, plus any legal, accounting, or insurance requirements:

• Standard booking data: retained for 6 years after the last booking for tax and accounting purposes.
• Medical and consent forms: destroyed shortly after each session, unless an incident occurred. Accident and injury records are kept for 7 years in line with insurance requirements.
• Safeguarding records: concerns, disclosures, incident reports and allegations are kept far longer than ordinary records, because it can take many years for someone to come forward. A safeguarding record about a child is kept until that child reaches 25. A safeguarding record about an adult at risk is kept for six years from the date the matter was concluded. Where a record relates to an allegation or case of child sexual abuse we keep it for 75 years, with periodic review, following the recommendation of the Independent Inquiry into Child Sexual Abuse. Records found to be unfounded or malicious are removed. Access is restricted to the Designated Safeguarding Lead and, where the law requires it, the statutory agencies.
• Coach training records: retained for 7 years after qualification or course end, whichever is later.
• Unsuccessful coach applicants: details deleted after 12 months.
• Marketing data: retained until you withdraw consent or unsubscribe.

We've put appropriate security measures in place to prevent your personal data from being lost, used, or accessed in an unauthorised way:

• Paper forms (such as bankside medical sheets) are kept in a secure folder by the lead coach and destroyed or filed securely after each session.
• Digital data is stored on password-protected, encrypted systems.
• Access is limited to staff who need the data to do their job.

Under UK GDPR, you have the right to:

1. Request access to the personal data we hold about you (a Subject Access Request).
2. Request correction of any inaccurate data.
3. Request erasure of your data, subject to our legal retention requirements.
4. Object to your data being processed (for example for marketing).
5. Withdraw consent at any time where we rely on consent (for example photography).

To exercise any of these rights, email info@schooloffish.co.uk.

Our site may include links to third-party websites (for example the Environment Agency). We don't control these sites and we're not responsible for their privacy practices. Check their own privacy policies before sharing data with them.

This site doesn't use cookies. We use Cloudflare Web Analytics to count visits and see which pages get read, so we know what's useful. It's cookieless, doesn't track individual visitors, and collects no personal data. Nothing is stored on your device, and there's nothing you need to accept or opt out of.

SOF Chat is a private message board for qualified School Of Fish coaches and staff. It is adults only. Learners, parents and Squad members have no access to it.

What we store: the text of each message, the display name and account identifier of whoever wrote it, the channel it was posted to, the time it was sent, any reactions, and whether it was edited or pinned. Coaches can set a profile holding the name the room sees, an optional line about themselves, and an optional photograph, which is stored with the profile rather than as a separate file. A profile is written by the coach it belongs to; School Of Fish staff can remove a photograph that should not be there. Messages do not carry your email address. Membership of the room is held separately as your email, name, coaching level and organisation, and only the operator account can read that list. Other members see your name and level, never your email.

Who reads it: every channel is visible to the Designated Safeguarding Lead, without exception, and to the operator account. Restricted channels are limited to the coaching level or delivery unit they belong to. Nothing in the room is private between two members, and there is no direct-message function.

Reports: if you report a message, we store your email, your note, and a copy of the message text as it appeared. Only the Designated Safeguarding Lead and the operator account can read reports.

How long: messages are kept for twelve months and then deleted. Safeguarding reports and any messages they relate to are kept for as long as the relevant safeguarding record requires, which may be longer.

Removing yourself: email info@schooloffish.co.uk or the Designated Safeguarding Lead at safeguarding@schooloffish.co.uk and we will remove your access and delete your messages and profile, including any photograph, normally within seven days. Messages that form part of a safeguarding record are the one exception; we will tell you if that applies and why.

We may update this policy from time to time. The current version is the one published on this page. Significant changes will be notified by email to active customers.

Contact & Complaints

Questions about this policy? Email info@schooloffish.co.uk and we'll come back to you.

You have the right to complain to the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to address your concerns first.