1. Introduction
Hydroscape-Group Ltd ("we", "us", "our") is the controller of the personal data described here. This notice explains what we collect, why we collect it, who receives it and how long we keep it. It covers:
- Hydroscape, the public platform at www.hydroscape-group.co.uk: the five reporting forms (cormorant sighting, biodiversity, water quality, roost & colony count, deterrent log), HydroVision AI identification, HydroLibrary, the public data map, MyHydroscape accounts, HydroReturn licence returns, licence support and the authority to act form
- Hydroscape Hub, the administrative and client site at hub.hydroscape-group.co.uk
- HydroTasks, outdoor task management and the contractor listing network at tasks.hydroscape-group.co.uk
- The Android and iOS apps, which deliver the public platform in a native wrapper (section 11)
This notice is written under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where someone outside the United Kingdom takes part in the pan-European cormorant count, the EU GDPR applies to that processing as well. Sections 5.3 and 16 say what that means.
2. Data Controller
Hydroscape-Group Ltd is the data controller for everything described in this notice.
Hydroscape-Group Ltd
Two Hoots, Main Street, Southorpe, Stamford PE9 3BX, United Kingdom
Registered in England and Wales, company number 16894053
Email: info@hydroscape-group.co.uk
We have not appointed a data protection officer. Data protection questions go to the address above.
Information Commissioner's Office registration: ZC238506
Representative in the European Union (Article 27 EU GDPR): not appointed. People in the EU should write to us at the address above, and we answer them on the same terms as everyone else. Their right to complain to their own supervisory authority is not affected (section 16).
The platform software is licensed to us by its developer. Where the developer has access to personal data in the course of building and maintaining the platform, it does so on our instructions, and it appears in section 5.1 as our software developer and hosting contractor.
3. Data We Collect
3.1 Data you give us
| Data | What it includes | When we collect it |
|---|---|---|
| Report content | Position in latitude and longitude at full precision, the what3words address for that point, date and time, the count, the species or activity or observed conditions, your notes, and a photograph. If you are signed in, your account identifier is stored on the record. | Each time you submit one of the five reporting forms |
| Audio recording | A short clip you record for identification by sound. Anyone speaking near the microphone will be on the clip. | When you use audio identification |
| Roost & colony counts | Site type, birds counted or nests counted, and the group code and group name where you are counting for an organised group. | Roost & colony count form |
| Deterrent logs | The method used, including shooting to deter, and the name of the person who carried it out. That name is also kept in your device's own storage so the form can offer it again. | Deterrent log form |
| Reporter identity | Your name and email address where you give them, and whether you asked to join the mailing list. | Cormorant, biodiversity and water quality forms |
| Newsletter sign-up | Email address, name, and which page you signed up from. | The mailing list panel on the home page and the reporting forms |
| Licence support enquiry | Name, email address, club or fishery, the waters concerned, telephone number and your message. | The licence support form |
| Authority to act | The matter, site name, site address and postcode, the body the authority is addressed to, any reference, your name, email address, telephone number, organisation and position, your typed signature, and a record of the signing that includes your browser's user agent string and the server time. | The authority to act form |
| HydroReturn, for licensed shooting returns | Shooter name and account identifier, session start and end, position and what3words, weather, birds shot and birds injured, detail of any non-target bird, carcass disposal, notes, scene and bird photographs, and for each bird its sex, weight, ring number, gut contents and its own GPS position with accuracy and capture time. A copy is held in your device's own storage so a return can be completed without a signal. | HydroReturn, which needs a signed-in account and a licence grant |
| MyHydroscape account | Email address, display name, profile photo URL from your sign-in provider, which provider you used, first and last sign-in times, any group memberships or grants, and the badges you have earned. | If you choose to create a free account |
| Push notifications | The subscription endpoint and keys issued by your browser. | If you turn notifications on in MyHydroscape |
| Contractor application, HydroTasks | Business name, contact name, title, email address, telephone number, address, company and VAT numbers, insurance documents, qualifications, and a Disclosure and Barring Service certificate where the application asks for one. A DBS certificate is criminal offence data and is treated as such. | The contractor application form |
| Hub client account | Name, email address, company, and the tools your account is given. | When we set up a client account for you |
| Payment | Handled by Stripe, for HydroTasks contractor listings only. We never see or store card numbers. No part of the cormorant or biodiversity platform is paid for. | Contractor listing payments |
3.2 Data collected automatically
| Data | Purpose |
|---|---|
| County, reverse geocoded from your coordinates | Places the record in an administrative area for regional analysis |
| AI identification result | Species presence, a count where the image allows one, and a confidence level. Stored beside your own figure, never in place of it (section 8). |
| IP address | Recorded in our hosting and server logs. For rate limiting we also store a shortened hash of it, which is cleared daily. Your IP address reaches every third party your browser contacts when a page loads, which section 5.2 lists. |
| Your account identifier | Stored on each record you file while signed in, so your records can be grouped and shown back to you. It forms part of the published record. |
| Device storage | Language choice, cookie notice state, queued reports waiting for a signal, sign-in state and caches. Section 13 lists them in full. |
What is published. Cormorant, biodiversity and water quality records are public. Anyone can read them without signing in: the position at full precision, the count, the species, the date, your notes, the photograph, and the account identifier of whoever filed it. Roost and colony counts and deterrent logs are not public. They can be read by the person who filed them and by Hydroscape. Photographs are served from storage addresses that anyone holding the link can open. Your name and email address are not part of the published record, but they are written to it first and moved into a separate private record moments later, with a sweep twice a day for any the move missed.
3.3 Data we collect from other sources
We collect contact details that clubs, fisheries and angling organisations publish on their own websites, including committee pages: the organisation's name, a contact name, an email address and a telephone number. We use them to introduce the platform to the organisation. The basis is our legitimate interest in reaching the bodies the platform is built for. If you would rather we did not hold your details, tell us and we will delete them. This paragraph is the notice Article 14 UK GDPR requires for data we did not get from you.
3.4 Data we do not collect
We use no analytics cookies, no advertising cookies and no cross-site tracking. We do not profile you, we do not use advertising identifiers, and we do not sell, rent or share your personal data with advertisers or data brokers. We do not ask for card numbers. We do not collect contacts, messages, call logs, calendars, or health or fitness data.
4. How We Use Your Data
| Purpose | Lawful basis | Data used |
|---|---|---|
| Recording and publishing reports as an ecological evidence base | Legitimate interests: freshwater monitoring, and publishing evidence that fisheries, clubs, conservation bodies and regulators can use | Report content, including position, count, species, date, notes, photograph and account identifier |
| Being able to go back to an observer about a record | Legitimate interests: data quality and verification | Reporter name and email address, where given |
| Automated species and count checking | Legitimate interests: data quality, acted on only where you allow the photograph or recording to be sent (section 8) | Photographs and audio clips, and your answer to the permission question, which is stored on the record |
| Telling you that your own submission has been checked | Legitimate interests: keeping you informed about a record you filed | Email address, display name, and the species, county and date from your submission. Sent only to signed-in MyHydroscape users. |
| Mailing list | Consent, given by ticking the opt-in box, and withdrawable at any time | Email address, name |
| Running your MyHydroscape account | Performance of a contract: giving you the account you asked for | The account data in section 3.1 |
| Push notifications | Consent, given through your browser's permission prompt | Subscription endpoint and keys |
| Turning a position into a county | Legitimate interests: data enrichment | Latitude and longitude, sent to Google |
| Internal notification of new reports | Legitimate interests: operational monitoring | Count, county, what3words address and a link to the photograph, sent to our own Slack workspace |
| Licence support and the authority to act | Performance of a contract, or steps taken at your request before one. A signed authority is kept for six years on the basis of our legitimate interest in establishing and defending legal claims. | The enquiry and authority data in section 3.1 |
| HydroReturn licence returns | A legal obligation on the licence holder, which we support, and our legitimate interest in holding the record of it | The return data in section 3.1 |
| Contractor listing and verification | Performance of a contract. For a DBS certificate we rely on your explicit consent, and you can refuse it. | Business details, documents, and a DBS certificate where given |
| Taking payment for a contractor listing | Performance of a contract | Email address and business name, passed to Stripe |
| Rate limiting, bot protection and abuse prevention | Legitimate interests: keeping the platform usable and the data clean | A shortened hash of your IP address, and the signals Google reCAPTCHA Enterprise collects through Firebase App Check |
| Introducing the platform to clubs and fisheries | Legitimate interests: reaching the organisations the platform is built for | Published organisational contact details (section 3.3) |
| Supplying evidence for a licence application or a regulator's request | Legal obligation, or legitimate interests where there is no obligation | Records, maps and evidence packs supplied to Natural England, Defra, the Environment Agency or a local authority |
You can object to any processing we base on legitimate interests, and you can ask us for the assessment behind it. Section 9 says how.
The consent box on the reporting forms. The forms ask you to tick a box worded as explicit consent before they will submit. That box records that you have read this notice. It is not what makes the processing lawful: the record rests on the legitimate interests set out above, which is why you can object to it rather than only withdraw consent. Consent is the basis for the mailing list, for push notifications and for a DBS certificate, and for nothing else. Where the wording on a form and this notice appear to differ, this notice is the one that describes the processing.
5. Third-Party Services
5.1 Processors and recipients
These are the services and bodies that receive data because we send it to them. Each processor acting on our instructions is bound by terms requiring it to protect the data to a standard equivalent to this notice. The services in section 5.2 are different: your own browser contacts them, and they act under their own terms.
| Who | Purpose | What they receive | Where |
|---|---|---|---|
| Google Firebase and Google Cloud: Firestore, Storage, Cloud Functions | Database, file storage and server-side processing | All platform data | Configured to Google's London region, europe-west2. Firebase Authentication and App Check are global Google services and are not confined to one region. |
| Google Gemini, through the Gemini API | Automated species identification and count checking | Photographs attached to cormorant, biodiversity, roost and deterrent reports, and photographs and audio clips you submit for identification. Water quality photographs are never sent. | Google infrastructure, outside the UK |
| Google Geocoding API | Turning coordinates into a county name | Latitude and longitude only | Google infrastructure, outside the UK |
| Brevo | Mailing list and transactional email: licence support acknowledgements, verification notices and badge emails, with the signed authority PDF attached where one is produced | Email address, name, and the content of the message concerned | European Union |
| Slack | Internal notification of new reports to our own workspace | Count, county, what3words address and a link to the photograph | United States |
| Stripe | Payment for HydroTasks contractor listings | Email address, business name, payment details | European Union and United States |
| Netlify | Hosting for the three websites | We store nothing there, but Netlify's request logs record IP addresses and request details | Global content delivery network |
| Our software developer and hosting contractor | Building and maintaining the platform, which includes administrative access | Platform data, as the work in hand needs | United Kingdom |
| Natural England, Defra, the Environment Agency, local authorities | Licence applications, licence returns and regulatory requests | The records, evidence and returns concerned, including names and site addresses where the application requires them | United Kingdom |
| The push service of your browser or device vendor | Delivering a notification you asked for | The notification and your subscription endpoint | Google, Apple or Mozilla infrastructure |
Not settled, and not happening until it is. Sharing individual records under an open licence with biodiversity data aggregators such as the NBN Atlas and GBIF, and passing individual records to the organisers of the pan-European count, is not permitted by the licence you give us in section 4 of the Terms of Service. We will not do either until those terms are changed and we have told you. Aggregate figures published on the public map and in reports are not affected.
5.2 What your browser contacts
Loading a page on the public site makes your browser request files and data directly from the services below. Each receives your IP address and the standard request headers, and is listed here with anything else it receives. None of them is given your name, your email address or your account identifier.
| Service | What it is for | What else it receives |
|---|---|---|
| Google Fonts: fonts.googleapis.com, fonts.gstatic.com | The site typeface | Nothing further |
| cdnjs, unpkg and www.gstatic.com | Icon font, map library and the Firebase SDK | Nothing further |
| Google reCAPTCHA Enterprise, through Firebase App Check | Showing that the page is a real browser and not a script. It runs when a page loads, not only when you submit. | Browser and interaction signals collected by Google |
| OpenStreetMap, CARTO and Esri tile servers | Map tiles | The map area you are looking at |
| what3words | Turning your position into a three-word address | Your coordinates |
| postcodes.io | Postcode and place search on the forms | The postcode or place you typed, or your coordinates |
| Open-Meteo, the Environment Agency, and Overpass, which is hosted in Germany | Weather, river and water body context on the water quality form | Your coordinates |
| api.country.is | A country guess on the home page, used to offer a language | Nothing further |
| YouTube and Calendly | A video player and a booking page, each on one article page only | YouTube and Google set their own cookies and storage when that player loads. That is the only non-essential storage anywhere on the site. |
A browser extension that blocks these leaves the reporting forms working, except that the three-word address and the map will not appear.
5.3 Transfers outside the United Kingdom
Some of the processors in section 5.1 are outside the UK, and some are outside the European Economic Area: the Gemini API, the Geocoding API, Slack in the United States, Stripe, and Netlify's content delivery network. Firebase Authentication and App Check are global services.
For each of those we rely on the transfer terms in the provider's own data processing agreement. We are completing a record that names the mechanism relied on for each one, provider by provider. That record is not finished. If you want the position for a named provider, ask, and we will tell you what we hold and say plainly where we do not yet hold it.
Data about people in the EU who take part in the European count is processed in the United Kingdom, which the European Commission has found to offer an adequate level of protection, and then reaches the same processors listed above.
6. Data Security
- Encryption at rest: data in Firestore and Storage is encrypted with AES-256 using Google-managed keys.
- Encryption in transit: every connection uses HTTPS and TLS.
- Authentication: Firebase Authentication, with Google sign-in, Apple sign-in and passwordless email links. We never see or store a password. Sessions expire and refresh.
- Access control: access is enforced by server-side rules rather than by the page in front of you, and administrative functions require a verified claim on the account. What those rules make public is set out in section 3.2: cormorant, biodiversity and water quality records are readable by anyone, roost and colony counts and deterrent logs are not, and report photographs can be opened by anyone holding the link.
- Keys: the keys for Gemini, Stripe, Brevo, Slack and Google Geocoding are held server-side in Cloud Functions and are not in the pages you download. The Firebase web configuration and the what3words key are in the page by design and are restricted by domain.
- Where data is held: Firestore, Storage and Cloud Functions are configured to Google's London region, europe-west2. Firebase Authentication and App Check are global Google services, so we claim no region for them.
- Payments: card details are handled entirely by Stripe.
- Testing: an automated audit runs against the live infrastructure and tests access control, transport security, headers, authentication and data handling. It is written and run by Hydroscape, so it is a self-assessment rather than an independent audit. The report goes to any organisation that asks for it.
7. Data Retention
| Data | Retention period | Basis |
|---|---|---|
| Report records and the photographs attached to them | Indefinite | Scientific and ecological research, UK GDPR Art. 89 |
| Roost and colony counts, deterrent logs | Indefinite | Scientific and ecological research |
| Reporter name and email address held against a record | Until you ask us to remove them, or until you delete your account | Legitimate interests |
| MyHydroscape account, badges and push subscription | Until you delete the account (section 12), or until you turn notifications off | Contract |
| Mailing list entry at Brevo | Until you unsubscribe | Consent |
| Newsletter sign-up record in our own database | No period has been set yet | Consent |
| Licence support enquiry | No period has been set yet | Contract, or steps towards one |
| Signed authority to act, and the PDF of it | Six years from the date the authority ends | Establishing and defending legal claims |
| HydroReturn returns | No period has been set yet. A return made under a licence may have to be kept for a period the licence sets. | Legal obligation on the licence holder |
| Contractor application, with insurance and qualification documents | Duration of the listing plus two years | Contract and verification trail |
| DBS certificate | No period has been set yet. It should be short, and we are setting it. | Explicit consent |
| Hub client account | Duration of the account plus one year | Contract |
| Shortened hash of your IP address, for rate limiting | Cleared daily, so between about two and twenty-six hours | Legitimate interests |
| Server, function and hosting logs | The default periods set by Google Cloud and Netlify. We have not set our own. | Legitimate interests |
| Photographs and audio clips sent for identification | Not stored by Hydroscape at all. We keep only a daily count of how many identifications were run. What the AI provider keeps is set by its own terms (section 8). | Legitimate interests |
| Contact details collected from published sources | Until you ask us to delete them | Legitimate interests |
Where this table says no period has been set, that is the position today rather than a form of words. We are fixing those periods, and until they are fixed we keep the data no longer than the purpose in section 4 needs.
8. AI Processing
Some of what you submit is checked by an automated image and sound model. This section says exactly what is sent, to whom, and what happens to it. We name the provider here on purpose: it is Google Gemini, called through the Gemini API from our own Cloud Functions. Elsewhere on the platform the feature is called HydroVision AI.
8.1 What is sent, and what is not
- Photographs attached to a cormorant sighting, a biodiversity sighting, a roost & colony count or a deterrent log.
- Photographs and audio clips you submit to HydroVision AI identification.
- Water quality photographs are never sent to any AI service. Nothing on the water quality form is assessed automatically.
- Your name, your email address and your account identifier are never sent with any of it.
8.2 We ask first
Nothing leaves your device for the AI provider unless you allow it. On the reporting forms there is a permission box beside the photograph field. For identification there is a permission step before the upload. Your answer is stored with the record, and it is not remembered as a yes unless you gave one. If you say no, nothing is sent and your report is accepted exactly as it is.
8.3 Camera data in the file
A photograph attached to a report is re-encoded on your device before it is uploaded, which drops the camera metadata, including any GPS position the camera wrote into the file. A photograph or recording you send for identification is sent as it came off the camera, so any embedded camera data, including location, goes with it. If that matters to you, use the reporting form rather than the identification tool, or strip the metadata before you upload.
8.4 What comes back, and what we do with it
- A species presence reading, a count where the image allows one, and a confidence level.
- It is stored beside your own figure and shown next to it. It never overwrites what you reported.
- It is evidence about a photograph and nothing else. It is not used to make a decision about you, and there is no automated decision-making and no profiling.
- Our team can review and override any automated reading, and you can ask us to.
8.5 Retention by the provider
We do not store the photographs or clips you submit for identification. We keep only a daily count of how many identifications were run.
What the provider keeps is set by the terms of the API tier we use, which is the paid tier of the Gemini API. On that tier Google states that it does not use prompts or responses to improve its products, and that it does not use them to train its models. It keeps prompts, any contextual information and the generated output for fifty-five (55) days, for the single purpose of detecting and preventing breaches of its prohibited use policy and making any disclosure the law requires of it. Content flagged by those systems can be read by authorised Google employees. Nothing you send for identification is retained for any other purpose, and after fifty-five days it is gone from the provider as well as from us.
This is Google's published position for the paid tier, set out in its Gemini API additional terms of service and its abuse monitoring documentation. It is not a commitment we can give on Google's behalf, and Google can change it. We review it when we review this notice.
One thing worth being plain about even so. A photograph or recording you send for identification leaves our control the moment it is sent, in a way a photograph attached to a report does not. If that matters to you, use the reporting form rather than the identification tool.
If you record audio, remember that anyone speaking near the microphone will be in the clip.
9. Your Rights
Under UK GDPR, you have the following rights:
- Right of access, request a copy of the personal data we hold about you
- Right to rectification, request correction of inaccurate data
- Right to erasure, request deletion of your personal data (subject to legal retention requirements)
- Right to restrict processing, request that we limit how we use your data
- Right to data portability, request your data in a machine-readable format
- Right to object, object to processing based on legitimate interest
- Right to withdraw consent, where processing is based on consent (e.g. mailing list), you can withdraw at any time
To exercise any of these rights, contact us at info@hydroscape-group.co.uk. We will respond within 30 days.
10. Ecological Data Exception
Note on ecological data: Report records, meaning coordinates, counts, species, dates and photographs, are retained indefinitely as scientific data under UK GDPR Article 89 once they carry no observer name or email address. We will remove your personal identifiers from your records on request, and the account identifier on each one is replaced at the same time, but the records themselves stay in the dataset for conservation purposes. Section 12 says what account deletion does with them.
11. Mobile Apps
Hydroscape is delivered as this website, and as apps that wrap this same website: Hydroscape Monitoring Portal on Google Play for Android, and Hydroscape for iPhone and iPad. All data handling described in this notice applies in the same way whether you use a web browser, the Android app or the iOS app. No extra data is collected because you use an app, and neither app contains any analytics or advertising component.
The iOS app has not been released yet. This notice is written to cover it from the day it is.
The following device permissions may be requested on either platform, at the point you use a specific feature:
| Permission | Why Requested | When Prompted |
|---|---|---|
| Camera | To take a photograph of a species, water-quality sample, or deterrent when submitting a report. Captured images are stored only when you choose to submit the form. | When you tap "Take photo" on any reporting form, or use the HydroVision AI species identifier. |
| Microphone | To record a short audio sample for HydroVision AI audio-based species identification (e.g. bird calls). | When you tap the microphone button inside the HydroVision AI feature. Not used anywhere else. |
| Precise location (GPS) | To pin the exact location of a sighting, roost, water-quality sample, or deterrent deployment. Precise location is essential for ecological data quality, the platform is valueless without accurate coordinates. | When you tap "Use my location" on a reporting form, or when the form auto-pins on open. You can always decline and enter a location manually. |
| Storage / Photos | To attach an existing photograph from your device gallery to a report. | When you tap "Choose from gallery" on any reporting form. |
| Internet | Required for all submissions, updates, and synchronisation. | Granted automatically; core app functionality depends on it. |
You can revoke any permission at any time. On Android, via Settings → Apps → Hydroscape Monitoring Portal → Permissions. On iOS, via Settings → Privacy & Security, where Location Services, Camera, Microphone and Photos each list the apps that have asked, or from the Hydroscape entry in the main Settings list. Revoking a permission will disable the relevant feature but will not affect submissions you have already made.
Neither app accesses contacts, SMS, call logs, calendar, device identifiers for advertising, or any health or fitness data. Neither contains third-party advertising SDKs. Neither tracks you across other apps or websites, and no data is shared with data brokers.
12. Requesting Data Deletion
If you have a MyHydroscape account, there is a Delete account button in the Account section of MyHydroscape. It asks you to confirm, because it cannot be undone.
Deleting the account erases: the sign-in account itself, your profile, your badges, your push subscription, your mailing list entry, and the private copies of your name and email address held against each of your records.
It keeps, with the link to you removed: the records themselves, which is the counts, dates, positions, notes and photographs. They stay as scientific observations under Article 89 UK GDPR, with no name, no email address and no account behind them, and the reporter identifier on each one is replaced. Removing historic observations would corrupt a dataset other people rely on, which is why they stay.
You do not need an account to ask. Email info@hydroscape-group.co.uk with the subject line "Data deletion request" and the email address you used with Hydroscape. We will action it within 30 days and confirm in writing. The same applies to any other right in section 9.
13. Cookies
We set no advertising or analytics cookies. What the site does store on your device is listed in full, with its lifetime, in the Cookie Policy. In summary it is:
- Local storage: your language choice, the state of the cookie notice, the queues that hold a report (including its photograph and any email address on it) until a signal returns, and the observer name the deterrent log offers you again.
- Session storage: the group code for a counting session, and two flags that remember what a page has already done.
- Local databases: your Firebase sign-in state, the Firebase App Check and heartbeat databases, and a copy of a HydroReturn in progress.
- During an email-link sign-in: the email address you typed, held until the link is used.
- Service worker cache: the pages and files that let the site open with no signal.
- Set by Google, not by us: the reCAPTCHA Enterprise cookie and the two storage keys its frame writes, used to tell a browser from a script.
Everything in that list is needed for the site to work or to stay secure, except the storage the embedded video player on one article page writes when it loads, which is covered in section 5.2 and in the Cookie Policy.
14. Children
Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it promptly.
15. Changes to This Policy
We may update this policy from time to time. The "Last Updated" date at the top of this page will reflect the most recent revision. Material changes will be communicated via email to registered users where possible.
16. Complaints
If you are not satisfied with our handling of your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113
If you are in the European Union or the European Economic Area, you can complain instead to the supervisory authority for the country you live or work in, or where the thing you are complaining about happened. The list is published by the European Data Protection Board at edpb.europa.eu. Our Article 27 representative is the point of contact for that, once appointed (section 2).