Privacy Notice — FIRST LIGHT

1. Who is responsible for your data

FIRST LIGHT is the data controller for everything described in this notice. That means we decide what gets collected and what happens to it, and we are the ones answerable for it.

For anything to do with your data — a question, a correction, a deletion, or any of the rights set out in section 7 — write to firstlight.privacy@gmail.com. It reaches us directly.

We have not appointed a Data Protection Officer, and we are not required to: we are not a public authority, we do not monitor anyone on a large scale, and we do not process special-category data.

2. What we collect

Only what you type into a form, plus the page you submitted it from. We do not buy data about you, and we do not build a profile of you from anywhere else.

Promotion and Production applications

Name: Required. So we know who we are answering.
Email address: Required. The only channel we use to reply.
Sport or sports: Required. Part of assessing the application.
Country: Required. Travel and logistics bear on whether we can take a camp.
Social media handles: Optional, up to ten. Publicly visible accounts you choose to point us at.
Existing sponsors: Optional free text.
Message: Optional free text. Whatever you choose to tell us.
Submission metadata: The page URL the form was sent from, and the date and time of submission.

Commercial waitlist

Name: Required.
Email address: Required.
Record and level: Required. Part of assessing when the waitlist becomes relevant to you.
Fight promotion or organisation: Optional.
Social media handles: Optional, up to ten.
Existing sponsors: Optional free text.
Message: Optional free text.
Submission metadata: The page URL the form was sent from, and the date and time of submission.

The free-text fields are yours to fill as you like. Please do not put anything in them that falls into the special categories under Article 9 of the GDPR — health or injury details, racial or ethnic origin, religious or political beliefs, sexual orientation, biometric data. We do not ask for any of it, we have no use for it, and we will delete it if it arrives.

Our forms carry a hidden field that only automated submissions fill in. It collects nothing about you.

3. Why we hold it, and on what legal basis

Promotion and Production applications: Legitimate interests — Article 6(1)(f). Assessing an application we were asked to assess, and replying to it. You approached us about a service; handling that enquiry is what both sides expect, and it does not override your rights or freedoms.
Commercial waitlist: Consent — Article 6(1)(a). There is nothing to assess yet. You are asking us to keep your details on file until your name is at a stage where the service applies, and you give that consent by submitting the form. You can withdraw it at any time, and withdrawing is as easy as giving it: one email.

That is the whole purpose. We use what you send to evaluate your application and to answer it. Nothing else.

4. What we do not do with it

We do not sell your data, and we never will.
We do not share it with third parties for their own marketing, or for any other purpose of theirs.
We do not add you to a newsletter or a marketing list on the strength of an application. If we ever run one, you would have to ask for it separately.
We do not use it for automated decision-making or profiling within the meaning of Article 22. A person reads every application.
We do not publish it, and we do not discuss an application outside the people who need to read it to answer it.

5. Who processes it on our behalf

A form submission passes through a small number of service providers who act as processors for us, under contract, on our instructions only. They may not use your data for their own purposes.

Google: Receives and stores every form submission (Apps Script and Sheets), and delivers the internal notification telling us an application has arrived (Gmail). This is where your application actually lives.
Cloudflare: Hosts and delivers this website. It sees the technical request data any web server sees — IP address, browser, page requested. It does not receive form contents: submissions go from your browser straight to Google without passing through it.

We use no advertising trackers, no analytics cookies, and no third-party embeds that profile you. The typefaces are served from this site rather than from a font network, so simply reading this page sends your IP address to nobody but our host.

Transfers outside the UK and EEA

Both providers above are US-headquartered and may process data outside the UK and EEA. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, and both providers self-certify under the EU–US and UK–US Data Privacy Framework. You can ask us for details of the safeguards that apply to your data.

We will disclose data to a public authority only where the law requires it of us.

6. How long we keep it

Applications we decline, or that go unanswered by you: Kept for 12 months from the last contact, then deleted. Careers in this sport move; an application that was early in March can be right in December, and we would rather recognise you than start from nothing.
Applications that become an engagement: Kept for the length of the engagement, and for 6 years after it ends, which is the period we are required to keep contract and accounting records for.
Commercial waitlist entries: Kept for 24 months, or until you withdraw consent, whichever comes first. At 24 months we either ask you to renew or we delete the entry.

Deletion means deletion from our live systems. Backups roll off on their own schedule and are not searched or used for any other purpose in the meantime.

7. Your rights

Under the GDPR you have the following rights over your data. Exercising any of them costs nothing, and we will answer within one month.

Access — a copy of everything we hold about you, and confirmation of what we do with it (Article 15).
Rectification — correction of anything inaccurate or incomplete (Article 16).
Erasure — deletion of what we hold, where we have no overriding reason to keep it (Article 17).
Restriction — a freeze on our use of it while a dispute about accuracy or grounds is settled (Article 18).
Portability — the data you gave us, in a structured, machine-readable format, sent to you or to someone you name (Article 20).
Objection — you can object to our processing on legitimate interests at any time, and we stop unless we can show compelling grounds that override your interests (Article 21).
Withdrawal of consent — for the Commercial waitlist, at any time, with no effect on anything done before you withdrew (Article 7(3)).

Write to firstlight.privacy@gmail.com. We may ask you to confirm who you are before we act, so that nobody else can use these rights against you.

Complaints

If you think we have handled your data badly, tell us first — we would rather fix it. You do not have to, though. You can complain directly to a supervisory authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the data protection authority of the country you live or work in, or where the issue arose.

8. Changes to this notice

If we change how we handle applications, this notice changes with it and the date at the top moves. Material changes affecting data we already hold are sent to the email address you gave us.