Privacy Policy

Last updated: 5 June 2026

1. Who we are

Regatta Exchange is a UK sole trader business operating regattaexchange.com and a WhatsApp-based AI ticket matching service. We are the data controller for personal data collected through the service.

Contact: hello@regattaexchange.com

2. What data we collect

When you use Regatta Exchange, we may collect:

• Phone number — from your WhatsApp messages or when you use our website chat
• First name — if you tell us your name during a conversation
• Messages — the content of your WhatsApp and website chat messages with our AI
• Listing and request details — days, enclosures, quantities, prices, and notes you provide when buying or selling
• Match history — records of introductions we make between buyers and sellers
• Technical data — basic website usage data such as IP address and browser type when you visit our site

We do not collect or store payment card details. We do not process payments for ticket sales.

3. How we use your data

We use your personal data to:

• Match buyers with sellers and facilitate introductions
• Run our AI service and respond to your messages on WhatsApp and our website
• Share contact details between matched buyers and sellers once a price is agreed
• Send you notifications about matches, negotiations, and follow-ups related to your listing or request
• Contact you in future about this service and similar rowing or regatta events we may run
• Improve and maintain the service
• Comply with legal obligations

4. Consent to future contact

By messaging our WhatsApp number, you consent to us contacting you in future about Regatta Exchange and similar events we operate — for example, next year's Henley ticket exchange or other regatta services.

These messages will relate to the service or similar events, not unrelated marketing. You can withdraw consent at any time by messaging us STOP on WhatsApp or emailing hello@regattaexchange.com. We will then stop future contact messages, though we may still send messages directly related to an active listing or request you have with us.

5. Legal basis for processing (UK GDPR)

• Contract: Processing necessary to provide the matching service you have asked for
• Legitimate interests: Running and improving the service, preventing misuse, and keeping records of matches
• Consent: Future contact about this service and similar events (you can withdraw at any time)
• Legal obligation: Where we are required to keep records by law

6. Who we share data with

We share data only where necessary:

• Other users: When a match is agreed, we share your WhatsApp number with the buyer or seller so you can complete the transaction directly
• Service providers: Companies that help us run the service, including cloud hosting (e.g. Supabase, Railway), WhatsApp messaging infrastructure (Meta), and AI processing (Anthropic). These providers process data on our instructions only

We do not sell, rent, or trade your personal data to third parties for their marketing.

7. How long we keep your data

We keep your data for as long as needed to provide the service and for a reasonable period afterwards so we can handle follow-ups or queries. Conversation and match records are typically kept for up to 2 years unless you ask us to delete them sooner.

We may keep certain records longer where required by law.

8. Your rights

Under UK GDPR, you have the right to:

• Access — ask for a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data ("right to be forgotten")
• Restriction — ask us to limit how we use your data
• Portability — ask for your data in a commonly used format
• Objection — object to processing based on legitimate interests
• Withdraw consent — where we rely on consent (such as future contact messages), you can withdraw it at any time

To exercise any of these rights, email hello@regattaexchange.com or message us on WhatsApp. We will respond within one month. Deleting your data will remove your contact details from our system, though we cannot delete messages already sent to another user once contact details have been shared.

9. Cookies

Our website uses only essential cookies needed to operate the site. We do not use advertising or tracking cookies.

10. Security

We take reasonable steps to protect your data, including encrypted connections (HTTPS) and secure cloud storage with access controls. No online service is completely secure, but we work to keep your information safe.

11. International transfers

Some of our service providers may process data outside the UK. Where this happens, we ensure appropriate safeguards are in place as required by UK GDPR.

12. Children

Our service is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has contacted us, please email hello@regattaexchange.com and we will delete their data.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will update the date at the top of this page. Significant changes may also be communicated via WhatsApp where appropriate.

14. Complaints

If you have a privacy concern, contact us first at hello@regattaexchange.com. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.