Privacy Policy - Catchment Crew

Last updated: 5 August 2026

How we use and protect your information

This policy explains how Catchment Crew collects, uses, stores, and shares personal data through the mobile app, API, and related administration platform.

1. Who We Are

Catchment Crew is a mobile application and administration platform used to support stream, river, water-quality, biodiversity, habitat, and educational recording activities. The data controller is the organisation that provides you with access to Catchment Crew or runs the programme in which you participate. For privacy requests, contact your programme organiser or the Catchment Crew project administrator using the contact details provided to you.

2. What This Policy Covers

This policy applies when you:

create or use a Catchment Crew account;
submit SSCS, SSIS, CSSI, H2O Heroes School Mode, or Community Superheroes recordings;
upload photographs or other media through the app;
use location-based recording features;
view training or compliance material;
contact us about your account or your data.

3. Personal Data We Collect

Account Data

name and email address;
password, stored in hashed form;
unique user code;
affiliated group and county/location area;
profile image, if uploaded;
account status and login/activity timestamps.

Recording Data

stream, river, site, or location name;
GPS coordinates or manually entered location details;
recording date and time;
sampler or team member codes;
test answers, scores, comments, measurements, and observations;
photographs of trays, species, habitat, pollution, biodiversity, or other environmental features;
administrator review notes, ratings, and approval details.

School Mode Data

school name, class name, and student age or age range;
river/site name and location;
test answers, scores, comments, counts, and photographs.

Technical Data

access tokens and refresh tokens;
IP address and user agent for API security and sessions;
upload metadata, app errors, server logs, and network status.

4. How We Use Personal Data

to create, manage, and secure user accounts;
to authenticate users and prevent unauthorised access;
to allow users to create, save, upload, review, and retrieve recordings;
to support offline recording and later synchronisation;
to support environmental monitoring, education, reporting, research, and programme administration;
to allow authorised administrators to review, approve, analyse, and manage submissions;
to respond to support, privacy, or account requests;
to maintain security, troubleshoot issues, and improve the app and API.

We do not sell personal data.

5. Legal Bases For Processing

Depending on the programme and the context, processing may be based on contract, legitimate interests, public interest, consent, or legal obligation. Examples include account management, service security, environmental recording, educational programme administration, quality assurance, reporting, and responding to legal or privacy requests.

6. Location Data And Photographs

The app may request access to your device location so that recordings can be linked to the correct sampling site. You may be able to enter a location manually instead. Photographs may contain personal data if they include identifiable people, vehicle registration plates, house numbers, private property, school materials, or other identifying details. Only upload photographs that are relevant to the recording and avoid including identifiable people unless you have appropriate permission.

7. Children And School Use

Some parts of Catchment Crew are intended for educational use, including H2O Heroes School Mode. School Mode is designed to avoid requiring named student accounts. Teachers, facilitators, schools, and programme organisers should ensure children are supervised appropriately, unnecessary personal data about children is not entered, photographs do not identify children unless appropriate permission has been obtained, and relevant school policies are followed.

8. Who We Share Personal Data With

authorised staff, administrators, reviewers, water officials, programme partners, or project team members;
hosting, database, storage, email, analytics, or technical service providers who help run the app and backend;
schools, teachers, facilitators, or programme partners involved in relevant educational activity;
public bodies, regulators, or legal advisers where required by law or necessary to protect rights, safety, or security;
research or reporting partners, where appropriate and preferably using anonymised or aggregated data.

9. International Transfers

Personal data may be hosted or processed outside Ireland if service providers operate in other countries. Where data is transferred outside the European Economic Area, appropriate safeguards will be used where required, such as adequacy decisions, standard contractual clauses, or equivalent protections.

10. How Long We Keep Personal Data

We keep personal data only for as long as necessary for account management, programme administration, environmental monitoring, reporting, legal compliance, dispute resolution, and security. Account data is kept while the account is active and then deleted or anonymised after account deletion unless retention is required. Environmental recordings may be retained for reporting, research integrity, audit, legal obligations, or public-interest purposes, with personal data minimised or anonymised where possible.

11. Account Deletion

Users may request account deletion through the app or by contacting the project administrator. When an account is deleted through the app, the account is disabled, active tokens are revoked, and account profile details are removed or anonymised. Some recording data may be retained where necessary for environmental reporting, research integrity, audit, legal obligations, or public-interest purposes.

12. Your Data Protection Rights

Subject to applicable law and exemptions, you may have the right to:

be informed about how your personal data is used;
access a copy of your personal data;
correct inaccurate or incomplete data;
request deletion of your data;
restrict how your data is processed;
object to certain processing;
request data portability;
withdraw consent where processing is based on consent;
lodge a complaint with a supervisory authority.

To exercise your rights, contact your programme organiser or Catchment Crew project administrator. You may also contact the Irish Data Protection Commission at dataprotection.ie.

13. Security And Offline Recording

We use technical and organisational measures intended to protect personal data, including password hashing, token-based API authentication, role-based administration access, database access controls, HTTPS where configured, audit/activity logging, and limited access based on role and need. The app can store certain recordings, images, and pending submissions locally on the device when connectivity is unavailable. Users should protect their devices with appropriate device-level security.

14. Changes To This Policy

We may update this policy from time to time. The latest version will be made available in the app, on the website, or through another appropriate channel. If changes are significant, reasonable steps will be taken to bring them to users' attention.