Privacy Policy

Last updated: 28 March 2026

Mountain Rescue Operations Platform is an operations tool used by mountain rescue teams to manage equipment, track incidents, and coordinate team activity. It was developed by Wasdale Mountain Rescue Team and is made available to other mountain rescue teams. This policy explains what personal data is collected, how it is used, and your rights in relation to it.

Who we are

The platform is developed and operated by Wasdale Mountain Rescue Team, a voluntary mountain rescue organisation based in Cumbria, England. For data protection enquiries, contact: webmaster@wmrt.org.uk.

What data we collect and why

Authentication via Google Sign-In

When you sign in using your Google account, we receive the following information from Google:

• Email address — used to identify your account and verify team membership
• Display name — shown within the application to identify you to other team members
• Profile picture — displayed within the application (if provided by Google)

We do not receive your Google password. Authentication is handled entirely by Google via the OAuth 2.0 protocol. We request only the openid, email, and profile scopes.

Authentication via Microsoft (Azure AD)

Some teams authenticate via Microsoft Office 365. The same principles apply: we receive only your name, email address, and profile information from Microsoft. We do not receive your password.

Application data

In the course of using the application, we store records associated with your account, including equipment allocations, incident logs, and activity within the platform. This data is created by you or your team administrators in the course of normal operations.

Legal basis for processing

We process your personal data on the basis of legitimate interests — specifically, the operational need to identify team members within a closed, team-authorised application. Access to the application is granted only to individuals who have been enrolled by a team administrator.

How long we retain your data

Your account and associated data are retained for as long as you are an active member of a team using the platform. If your account is removed by a team administrator, your personal data is deleted immediately. Backups of the platform may retain your data for up to 30 days following deletion, after which it is permanently removed.

Who we share data with

We do not sell or share your personal data with third parties for marketing or commercial purposes. Data may be processed by the following service providers solely in order to operate the platform:

• Google — OAuth authentication (if you choose Google Sign-In)
• Microsoft — OAuth authentication (if your team uses Azure AD)

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to operational retention requirements)
• Object to processing

To exercise any of these rights, contact webmaster@wmrt.org.uk.

Cookies and session data

The application uses a session cookie to keep you signed in. No third-party tracking cookies or advertising cookies are used.

Changes to this policy

We may update this policy from time to time. The date at the top of the page indicates when it was last revised.