01Who we are
This website is operated by Whitewater Training Limited, a company registered in England and Wales (company number 12513243), with its registered office at Blake Tower, Floor LG 12, Barbican, London EC2Y 8BR, United Kingdom. For the purposes of UK GDPR and the Data Protection Act 2018, Whitewater Training Limited is the data controller for any personal data described in this notice.
For any privacy query, including to exercise your rights described below, write to [email protected] or to the registered office address above.
02What we collect on this website
Information you give us directly
If you choose to email us using the address above, we will hold that correspondence for as long as is necessary to respond and retain a record of the conversation.
Client dashboard accounts
If you are given access to the Whitewater Training client dashboard, the following personal data is collected and stored:
- Account information: your name, email address, and role (admin or user). Your password is stored as an Argon2id hash and cannot be read by us.
- Task and project data: task titles, descriptions, comments, time logs, billing information, and authorisation evidence that you or your team create.
- File attachments: any files uploaded to tasks are encrypted at rest using Sodium (XSalsa20-Poly1305) before being written to disk. They are decrypted only when downloaded by an authorised user.
- Activity and audit trail: actions taken within the dashboard (logins, status changes, comments, file uploads) are logged for security and accountability.
- Session data: we use server-side sessions to keep you signed in. Session cookies are HTTP-only, secure, and SameSite. An idle timeout and absolute timeout apply.
- Preferences: your theme choice (dark or light mode) and notification preferences are stored against your account.
AI assistant
The dashboard includes an optional AI assistant powered by the Anthropic API (Claude). When used, your messages and any attached files are sent to Anthropic's servers for processing. Anthropic does not use API data for training. Chat history is encrypted at rest on our server. The AI assistant is only available to authorised administrators.
Email notifications
The dashboard sends email notifications for task updates, comments, and invitations. All outbound emails are logged as .eml files on the server. A copy of every email sent is retained for operational and audit purposes.
Information collected automatically
When you visit any page, your browser sends technical information that our hosting provider records in routine server logs. This typically includes your IP address, the page you requested, the referring page, your browser user-agent, and a timestamp. This information is used to operate the website, diagnose problems, and protect against abuse. It is not used to build a profile of you or to track you across other websites.
Google Analytics 4 (only with your consent)
If, and only if, you accept the "Analytics" category in the cookie banner, the site loads Google Analytics 4. Once loaded, Google Analytics places a small number of cookies in your browser and collects: the pages you visit, the approximate time you spend on each, your country or region (derived from an IP address that is truncated before storage), the device and browser you are using, and the source that brought you to the site (direct, search, referral, and so on). This data is aggregated on Google's servers and used by us to understand traffic patterns. We have disabled Google Signals and advertising personalisation, so this data is never combined with advertising profiles. It is not used to identify you personally. If you decline analytics, Google Analytics is never loaded and sends nothing.
Information collected by other people you meet through us
If you become a client and the work involves systems we do not own (for example, your own platforms, third-party tools, or workshop venues), the data those systems collect is governed by their own privacy notices, not this one.
03Why we hold it (lawful basis)
Under UK GDPR we must tell you the lawful basis on which we process any personal data. The bases we rely on for the limited data described above are:
- Legitimate interests for the operation, security, and integrity of the website (server logs, audit trail, session management).
- Contract for the processing of personal data necessary to provide our services through the client dashboard, including account management, task tracking, file storage, billing, and communications.
- Contract or legitimate interests for any correspondence related to a current or prospective engagement.
- Consent for Google Analytics and any future cookies or trackers in the analytics or marketing categories. We will not set those without your active consent through the cookie banner, and you can withdraw consent at any time by clicking "Cookie preferences" in the footer of any page.
04How long we keep it
Server logs are kept by our hosting provider for a short rolling window, typically up to thirty days, after which they are deleted in the ordinary course. Email correspondence is kept for as long as it remains relevant to a current or recent engagement, and then deleted in line with our internal retention practice. Records relating to invoices and contracts are retained for the period required by UK tax and company law, currently six years.
If you consent to analytics, Google Analytics retains user and event data for a maximum of fourteen months before automatically deleting it. Fourteen months is the lowest retention period available for the free tier of GA4, and is what we have configured.
05Who we share it with
We do not sell your personal data. We do not share it with third parties for marketing purposes. The only routine recipients of any personal data described in this notice are:
- Our hosting provider, which processes server logs on our behalf as a data processor.
- Our email provider, which transmits and stores any correspondence sent to or from us.
- Google LLC (Google Analytics), if you have consented to analytics. Google acts as a data processor for the raw analytics data it collects on our behalf.
- Anthropic PBC (AI assistant), when the AI chat feature is used by an administrator. Anthropic processes message content as a data processor and does not use API data for model training.
- Professional advisers (for example, our accountants) where legally necessary.
- Authorities, where we are required by law to do so.
06International transfers
Some of the providers above store data on servers outside the United Kingdom. In particular, if you consent to analytics, your data is processed by Google LLC in the United States. For this transfer we rely on the UK International Data Transfer Agreement (IDTA) and the UK extension to the EU-U.S. Data Privacy Framework as the lawful transfer mechanism required by UK GDPR. You can read about both on the Information Commissioner's Office website at ico.org.uk. You always have the right to refuse this transfer by declining the "Analytics" category in the cookie banner, or by withdrawing consent later via "Cookie preferences" in the footer.
07Your rights
Under UK GDPR you have the right to:
- Ask for a copy of any personal data we hold about you.
- Ask us to correct anything that is inaccurate.
- Ask us to delete personal data we no longer have a lawful reason to hold.
- Ask us to restrict or object to certain processing.
- Ask for a portable copy of data you have provided to us.
- Withdraw consent at any time where we are relying on consent.
To exercise any of these rights, write to [email protected]. We will respond within one calendar month. If you are unhappy with our response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
08Cookies and similar technologies
UK law (the Privacy and Electronic Communications Regulations, or PECR) requires us to tell you about any cookies or similar storage we use, and to obtain your consent before setting anything that is not strictly necessary. The only cookies this site can set are described below. None are set until you make an active choice in the cookie banner.
Strictly necessary
The following are set without requiring consent because they are necessary for the site to function:
- Cookie preference (
wwt-consent-v1in localStorage): stores your cookie banner choices. Contains no personal data. - Session cookie (
wwt_session): set when you sign into the client dashboard. HTTP-only, secure, SameSite=Lax. Expires when you close the browser or after the idle/absolute timeout. - Theme preference (
wwt_theme): remembers your light/dark mode choice. Lasts one year. Contains only the word "light" or "dark".
Analytics: Google Analytics 4 (only if you consent)
If, and only if, you accept the "Analytics" category, Google Analytics loads and sets the following cookies in your browser:
_ga(2 years) used to distinguish unique visitors._ga_165SV8J61V(2 years) session state for this specific GA4 property.
These cookies allow GA4 to count unique visitors and session behaviour. We have disabled Google Signals and advertising personalisation in our GA4 configuration, so this data is not combined with advertising profiles and is not used for remarketing. The GA4 property is configured to retain user and event data for fourteen months, the lowest available retention period.
You can withdraw consent at any time by clicking Cookie preferences in the footer. Withdrawing consent prevents Google Analytics from loading on subsequent page visits. Once GA4 is loaded on a given page it cannot be un-loaded mid-session, so withdrawing consent will take effect from your next page load onward.
Marketing: none
We do not currently set any marketing cookies and the "Marketing" category in the banner is empty. The category exists in the banner so that the consent infrastructure is ready if we ever add such tools in future. If we do, they will be described here before being activated, and the banner will reappear to ask for a fresh choice.
How to manage your choices
You can change your mind at any time by clicking Cookie preferences in the footer of any page. You can also clear the stored preference entirely through your browser's site-data settings, after which the banner will appear again on your next visit.
09Changes to this notice
We may update this notice from time to time. The version date below shows when it was last revised. Material changes will be reflected by an updated date. Where we add new tools or trackers that require consent, the cookie banner will reappear and ask you to make a fresh choice.