Privacy Policy

Privacy Policy Last updated: April 2, 2026

This Privacy Policy describes how MOSS Sailing School ("the Site", "we", "us", or "our") collects, uses, and discloses your personal information when you visit or use our services at moss-sailing.com (the "Site"), book a sailing course, or otherwise communicate with us (collectively, the "Services"). For the purposes of this Privacy Policy, "you" and "your" means you as a user of the Services, whether as a student, prospective student, website visitor, or other individual whose information we have collected in accordance with this Policy.

Please read this Privacy Policy carefully. As a company based in the Netherlands, we are subject to the General Data Protection Regulation (GDPR) and act as the data controller of your personal information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for operational, legal, or regulatory reasons. We will post the revised Policy on the Site and update the "Last updated" date. Where required by law, we will notify you of material changes.

How We Collect and Use Your Personal Information

To provide the Services, we collect personal information from a variety of sources as described below. We use information we collect to communicate with you, deliver and improve the Services, process course bookings and payments, comply with legal obligations, and protect our rights and the rights of our users.

What Personal Information We Collect

Information You Provide Directly

When you interact with our Services, you may provide:

Contact details including your name, address, phone number, and email address.

Booking information including your name, billing address, payment confirmation, email, and phone number.

Account information including your username, password, and any security information used to protect your account.

Course-related information such as your sailing experience, RYA qualification history, and any health or safety information relevant to your participation in a course.

Customer support information including any details you share when contacting us.

Some features of our Services require you to provide certain information. You may choose not to provide it, but this may prevent you from booking or accessing certain courses or features.

Information We Collect Automatically

When you visit our Site, we may automatically collect certain usage data, including device and browser information, IP address, pages visited, and interaction data. We use cookies and similar technologies for this purpose — see the Cookies section below.

Information We Obtain from Third Parties

We may receive information about you from third-party service providers involved in delivering our Services, including:

Payment processors (such as Stripe), who collect payment information to process your booking in order to fulfil our contract with you.

Infrastructure providers including Vercel (hosting and edge network), Neon (database), and Vercel Blob (file storage), who process data on our behalf to operate the Site.

Any information obtained from third parties is treated in accordance with this Privacy Policy.

How We Use Your Personal Information

Course Bookings and Services. We use your information to process bookings, collect payments, send booking confirmations and course-related notifications, manage your account, and administer RYA course administration requirements. The legal basis is the performance of a contract with you (Art. 6(1)(b) GDPR).

Marketing and Communications. With your consent, we may send you marketing communications about upcoming courses, offers, and news. You can withdraw consent at any time. The legal basis is consent (Art. 6(1)(a) GDPR).

Security and Fraud Prevention. We use your information to detect and prevent fraudulent or unlawful activity. The legal basis is our legitimate interest in keeping our platform and users secure (Art. 6(1)(f) GDPR).

Legal Compliance. We may process your information to comply with applicable laws and regulatory obligations, including those relating to RYA course record-keeping. The legal basis is compliance with a legal obligation (Art. 6(1)(c) GDPR).

Service Improvement. We use aggregated and anonymised data to analyse and improve our Site and Services. The legal basis is our legitimate interest in operating and developing our business (Art. 6(1)(f) GDPR).

Cookies

We use cookies and similar technologies to operate and improve our Site, remember your preferences, and analyse usage. You can control cookies through your browser settings, though disabling them may affect how the Site functions.

How We Disclose Your Personal Information

We do not sell your personal information. We may share it in the following circumstances:

Service providers who operate on our behalf, including hosting (Vercel), database (Neon), file storage (Vercel Blob), and payment processing (Stripe).

The Royal Yachting Association (RYA), to the extent required to register your course completions or issue qualifications.

Legal or regulatory authorities, where required by law or to protect our rights and the rights of others.

In connection with a business transaction, such as a merger or acquisition, subject to appropriate confidentiality protections.

We do not share your personal information with third-party advertisers.

Third-Party Websites

Our Site may contain links to third-party websites, including the RYA and other sailing organisations. We are not responsible for the privacy practices of those sites and encourage you to review their policies independently.

Children's Data

Our Services are not directed at children under 16. Where a minor is enrolling in a course, a parent or guardian must provide consent and act as the primary contact. If you believe a child's data has been submitted without appropriate consent, please contact us so we can delete it.

Data Retention

We retain your personal information for as long as necessary to provide the Services, maintain accurate course and qualification records, comply with legal obligations, and resolve disputes. When data is no longer needed, we delete or anonymise it securely.

International Transfers

Your data is stored and processed within the European Economic Area where possible. Where transfers outside the EEA are necessary (for example, to infrastructure providers based in the United States), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Your Rights

As an EEA resident, you have the following rights under the GDPR:

Access – request a copy of the personal data we hold about you.

Rectification – request correction of inaccurate data.

Erasure – request deletion of your data in certain circumstances.

Restriction – ask us to pause processing of your data.

Portability – receive your data in a structured, machine-readable format.

Objection – object to processing based on legitimate interests.

Withdrawal of consent – withdraw any consent you have given at any time.

To exercise any of these rights, please contact us using the details below. We will respond within one month as required by the GDPR. You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Contact

For any questions about this Privacy Policy or to exercise your rights, please contact us:

MOSS Sailing School

Pekelharinghaven 51

1671 HM Medemblik

The Netherlands

Email: info@moss-sailing.com

MOSS Sailing School is the data controller of your personal information for the purposes of applicable data protection law.