CPAS (Common Position Awareness System) is operated by VIDEAR Ltd, registered in England and Wales (company no. 14989396). VIDEAR Ltd is the Data Controller under UK GDPR and the Data Protection Act 2018. Registered office: 32a Lansdowne Street, Hove, East Sussex, BN3 1FQ. Contact: privacy@videar.tech.
| Data | What It Is | Why We Need It |
|---|---|---|
| Name and account details | Your name and email from Apple or Google sign-in (Apple may give a private relay address), your mobile number, your CPAS ID. On the web sign-up only, date of birth is entered once to check you are 16 or over and is not stored by us. | Identify you to the people you nominate, and run your account |
| Location | GPS position, heading, speed, altitude, roughly every 30-60 seconds during an active session (in the background too) | Core safety function |
| Activity and craft | Activity type, club, vessel name or identifier, planned route and return time | Give context to your Token Holders and club officers |
| Session data | Session ID, start time, planned return time, departure place name, trip description, last known position. Each position update also carries your name, mobile number, photo links and your Token Holders' mobile numbers. | Overdue detection and alerts |
| Token Holders | Name and mobile number of each person you nominate | Alert them when you activate, extend, are overdue or trigger SOS |
| Crew and Next of Kin | Crew member names and mobile numbers, and a Next of Kin name and mobile number for each crew member. Stored in your account profile, not sent with position updates. | Crew lists and an emergency contact for each person, kept separate from Token Holders |
| Photos | Profile photo and vessel photo you choose to upload | Identification |
You are responsible for having permission from anyone whose details you enter (Token Holders, crew, Next of Kin). If a crew member is under 18, enter a parent or guardian as their Next of Kin, and add them only if you are their parent or guardian or have that person's permission.
CPAS collects your precise location, including when the app is closed or not in use, during an active session only. It starts when you tap Activate and accept the location permission. It stops when you deactivate, your session ends, or you uninstall. Your last known position and map track are cleared from the app when a session ends. Location is never used for advertising or analytics.
Separately, while the app is open and you have granted location permission, it uses your approximate location to show local weather and place names. That is sent to Open-Meteo and Mapbox and is not stored by VIDEAR outside a session. When you start a session, a place-name lookup (OpenCage) works out your area.
Location is used to:
| Purpose | Legal Basis (UK GDPR) |
|---|---|
| Share your position and alerts with your Token Holders during a session | Consent; legitimate interests (your safety) |
| Show your session to emergency responders who have your session reference | Legitimate interests (your safety); vital interests where life is at risk |
| Show your position to club officers in their area, if you are club-affiliated | Legitimate interests (club safety) |
| Provide your session history and account | Contract |
| Comply with legal obligations | Legal obligation |
We do not sell your data.
| Recipient | What They Receive | Why |
|---|---|---|
| Your Token Holders | Your name, position, session status and a tracking link, by SMS | Core safety function |
| Club officers you name for Tally Out/In | Email notice of activation and return (no tracking link) | Club record of who is out |
| Emergency responders (SAR portal) | Your name, photo, vessel details, live position, track and session details, when responders enter your session reference | Search and rescue |
| Amazon Web Services | Session, ping and profile data, held in London | Hosting |
| Google Firebase and Google Sign-In | Email, name, sign-in data, profile and photos | Authentication and profile storage |
| Apple | Sign in with Apple identifiers; we store a token so we can revoke it when you delete your account | Sign-in |
| BulkSMS | Mobile numbers and alert text | SMS delivery |
| Amazon SES | Email addresses and message text | Welcome and Tally emails |
| Open-Meteo | Coordinates while the app is open | Weather |
| Mapbox | Coordinates while the app is open | Place names and map tiles |
| OpenCage | Coordinates when you start a session | Working out your area |
| what3words | Coordinates at the moment of SOS | Location wording in SOS text |
| Revolut (web sign-up only) | Payment for the GBP 1 identity verification. We do not receive your bank details. | Verification |
Some of these providers process data outside the UK. We only use providers that publish data protection terms covering international transfers.
SAR portal (emergency responders). CPAS does not monitor users or alert the emergency services itself. If you need help, your Token Holder calls 999 and quotes your session reference and the what3words location from the SOS message. Responders who have the reference can look up your live position, track and session details on the CPAS SAR web portal; the what3words location alone only shows where the SOS was raised. Anyone who has the reference can view this information, so share it only with people helping you.
We keep your account, session and position data until you delete your account. When you delete it, we delete your profile, sessions, position history, verification record, photos and sign-in account. Copies held by others (for example an SMS already delivered to a Token Holder, or a Tally email already sent) cannot be recalled.
Our servers also keep technical request logs. For some requests these can include your position, name and mobile number. They are deleted automatically after 30 days and are separate from your account, so they are not removed at the moment you delete your account.
You have the right to access your data, correct it (you can edit it in the app), have it erased (see below), restrict processing, receive it in a portable format, and object to processing. Email privacy@videar.tech. We respond within one month. You can complain to the Information Commissioner's Office at ico.org.uk. Objecting to location tracking will prevent CPAS from working as a safety service.
In the app (fastest): Menu > Delete Account > type DELETE to confirm. If a session is active, deactivate it first.
Online, without the app (for example if you have uninstalled it): Email privacy@videar.tech from the email address on your account, with the subject "Delete my CPAS account". Include your CPAS ID (CPAS-GB-...) if you have it. We will confirm your identity and delete your account within one month.
What is deleted: your profile and sign-in account, all sessions and position history, your verification record, and your profile and vessel photos. We also revoke the Apple sign-in token if you used Sign in with Apple. Deletion cannot be undone.
What we cannot recall: SMS and emails already sent to Token Holders or club officers, and payment records held by Revolut under its own policy. Technical logs expire on their own after 30 days (see Section 06).
Data is encrypted in transit (HTTPS) and at rest by our cloud providers. We limit access to the systems that hold personal data. Report security issues to security@videar.tech.
CPAS is for people aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a child has registered, contact privacy@videar.tech and we will delete the account.
We will update the effective date and, for material changes, tell you in the app or by email. Previous versions are available on request.