Privacy Policy for the Skamper website

The www.skamper.com website (known as "Skamper") is owned and operated by Skamper Limited, a company registered in Scotland with company number SC742632. Registered Office: 5/12 Donaldson Crescent, Edinburgh, United Kingdom, EH12 5FB.

For the purposes of UK and EU data protection law, Skamper Limited is the data controller.

When you use Skamper we may collect the following personal information:

• Your name, email address, gender and date of birth.
• Account credentials (a securely hashed password — we never see your password in plain text).
• Ratings, written reviews and any images you submit about a course (your first name will appear publicly alongside any approved review).
• Technical information such as IP address, device type and access logs, collected by our hosting providers for security and abuse prevention.
• Route downloads, so we can show you your activity in your account.

We use this information to provide target times for your runs, calculate your Skamper Grade on completion of each run, display your results in the leaderboards, and to improve the service.

Skamper is not specifically directed at children, and we do not knowingly collect personal information from children in breach of applicable data protection laws.

We process your personal information on the following legal bases:

• Contract: where processing is necessary to provide the Skamper service and your account.
• Legitimate interests: to maintain security, prevent abuse, improve the service and moderate reviews.
• Consent: where we rely on your consent, for example for optional communications or non-essential cookies.
• Legal obligations: where we are required to comply with applicable laws.

When you submit a review of a course while signed in, your first name and review text are shown publicly once approved by our team. Your email address and surname are not shown publicly and are only visible to Skamper administrators. You can request deletion of a review at any time by contacting us, or by deleting your account.

We do not sell your personal information. We only share personal information with trusted service providers that help us operate Skamper, or where required by law. We may share information with service providers who help us operate Skamper — such as our hosting and database provider and our authentication provider — but only to the extent necessary for them to provide their services. They are required to keep your information confidential and may not use it for any other purpose. Some of our service providers may process personal information outside the United Kingdom. Where this occurs, we take appropriate safeguards to ensure your information remains protected in accordance with applicable data protection laws.

We take the security of your personal information seriously and use industry-standard measures (TLS encryption in transit, encryption at rest, hashed passwords, scoped database access policies) to protect it from unauthorised access, disclosure and alteration. However, no transmission over the internet can be guaranteed to be completely secure, so we cannot guarantee absolute security.

We only keep your personal information for as long as necessary for the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by law. When we no longer have a legitimate reason to process it we will either delete or anonymise it.

You can delete your account at any time from the account menu in the top-right of the website. Deleting your account removes your profile and login credentials, and deletes any public reviews you have submitted so your name and email are no longer associated with them.

Under UK GDPR you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Request deletion of your personal information ("right to be forgotten").
• Object to or restrict certain processing.
• Request a copy of your data in a portable format.
• Lodge a complaint with the UK Information Commissioner's Office ("ICO") if you believe your personal information has been handled unlawfully (ico.org.uk).

To exercise any of these rights please contact admin@skamper.com.

Skamper uses strictly necessary browser storage (such as localStorage) to keep you signed in. The browser storage we use is necessary for the website to function and does not require consent under applicable cookie regulations. We do not currently use advertising or third-party analytics cookies. If this changes we will update this policy and, where required, ask for your consent.

We may update this Privacy Policy from time to time. Any changes will be posted on this page, and we encourage you to review this Privacy Policy regularly. Your continued use of Skamper after any changes signifies your acceptance of the changes.

For privacy-related enquiries or to exercise your data protection rights, please contact admin@skamper.com.