NCI Porthole

Privacy notice

Last updated: 7 October 2026. This notice explains how personal information is used in NCI Porthole.

Who we are

J W Lockton Ltd runs NCI Porthole, a watch rota and station tools service for National Coastwatch Institution stations. Our company number is 15303847. Our registered office is:

Lockton House Business Centre
King Street
Mablethorpe
Lincolnshire
LN12 2EQ
United Kingdom

Write to that address for privacy questions about Porthole itself. For a day-to-day account question, contact your station officers. We have not appointed a data protection officer. Our ICO registration number is ZC267606.

Who decides

Your station is the controller for the records it keeps in Porthole: crew, watches, messages, recruitment, welfare, incidents, training, finance, and the other station tools. Officers decide what is entered and why.

J W Lockton Ltd is the processor for those station records. We host them and act on the station’s instructions, including the instructions in the terms of use.

We are the controller for a narrower set of activities of our own: providing the invited service, keeping you signed in, securing the platform, platform administration, and counting active members so a station can be billed fairly. Those counts are numbers, not a list of names.

People this notice covers

Members and invited crew, people who apply to join, next of kin, directory contacts, people named in an incident or a letter, and visitors to public pages. If an officer records someone who has no account, the station should tell that person about this notice when it is reasonable to do so.

What we hold

  • Account: name, email, phone, date of birth, password stored only as a hash, and optional profile photo.
  • Next of kin: name, phone, and relationship, so the station can reach someone if you are hurt.
  • Membership: station, member number, rank, posts, role, and status, including suspension, leaving, and transfer.
  • The rota: bookings, absences (including a sickness absence), cover, waitlist, availability, preferred partners, and handover notes.
  • Messages and attachments, and email sent to the station’s Porthole address, including the sender’s address.
  • Notices you opt into: reminder choices, a WhatsApp number, browser push details (including a short record of the browser), and Pushover keys if you turn that channel on.
  • Recruitment: contact and address details, date of birth, gender, a photograph, medical notes, whether you are registered disabled, and unspent convictions, when the station uses that form.
  • Welfare cases, health and safety records, and incident reports. An incident report can include a casualty’s name and address, and the names of the watch.
  • Training records, induction and acknowledgement signatures, expense claims and receipt files, letter history, and the station directory (name, organisation, email, phone, and postal address).
  • Product suggestions you send, and the page you were on. Platform administrators see these. Other crew do not.
  • A private calendar link. Anyone who has the link can see the watches it lists, so treat it as private.
  • Security logs that include an IP address, kept only long enough to slow repeated sign-in and application attempts, then deleted. We do not build a browsing profile from them.

Why we hold it

For station records, the station chooses the lawful reason. In practice that is usually one of the following.

  • Running the rota and your membership. The lawful reason is the station’s legitimate interests, or a contract with you where the station has one. Phone, date of birth, and next of kin are required before the station tools open. Without them the account cannot be used on duty.
  • Reaching someone if you are hurt. Next of kin details support the station’s legitimate interests in volunteer safety, and can also be needed to protect your vital interests.
  • Optional WhatsApp, browser notifications, and Pushover. These run only with your consent. Email notices for watches are part of running the rota. You can change channel choices on Me.
  • Recruitment. The station records your agreement on the form. You cannot submit the application without that tick.
  • Sending a report to NCI head office, a sector manager, or another body when the station has a legal or charity duty to do so.
  • Showing a public on-watch page. The station’s legitimate interests in telling the public, and HM Coastguard where the station publishes that page, who is on watch. The page shows a first name and a surname initial. It does not show email or phone.

Email and phone are shown to station officers. Other crew see them only if you leave contact sharing on.

For our own activities, the lawful reasons are legitimate interests in keeping the service secure and running it for the stations that use it, and contract where we have agreed with a station to provide Porthole. We do not sell personal data, and we do not use it for advertising.

Health and criminal offence information

Some station tools can hold information the law treats as more sensitive: medical notes, disability, sickness, welfare concerns, and unspent convictions. We store that information on the station’s instructions and limit it to the officers who need it for volunteer safety, safeguarding, or recruitment. We do not use it to market anything, and we do not use it to make an automated decision about you.

The station must have its own condition in UK law for that information. For a charity’s membership records that is often the charity’s legitimate activities, a substantial public interest such as safeguarding, or explicit consent. We do not choose that condition for the station.

Where it is kept

The live application and its database run in the Netherlands (Amsterdam), on Railway’s EU West hosting region. The Netherlands is in the European Economic Area. UK law treats the EEA as providing an adequate level of protection, so storing the service there is allowed.

That does not mean every related activity stays in the Netherlands. Railway’s control plane, which covers orchestration, billing, and the hosting dashboard, is operated in the United States. Railway’s data processing terms allow that transfer under the UK extension to the EU-US Data Privacy Framework where the recipient is certified, and otherwise under the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses.

Other providers process personal data when a feature needs them. They may be outside the UK and the EEA. Where they are, the transfer rests on that provider’s UK transfer safeguards (the Data Privacy Framework, where the recipient is certified, or the UK Addendum).

  • Resend, for email we send and email the station receives.
  • Your browser’s own push service, if you turn on browser notifications, and Pushover if you connect it.
  • A WhatsApp gateway, if the station enables WhatsApp. A gateway hosted with Porthole stays in the Netherlands. Delivering the message also involves WhatsApp.
  • Davis WeatherLink, if the station connects a weather station, and a language-model host if the station uses it to rewrite a short WhatsApp group greeting. That rewrite is not a decision about a person.
  • Esri map tiles, and scripts from unpkg and jsDelivr, only when someone opens the station calculator. Opening that page sends your IP address to those providers.
  • An alert destination we configure for service faults, which receives a technical report rather than a crew list.

By using Porthole, the station instructs us to make these transfers so the service can run. Card payments are not part of the service.

Who else sees it

  • Your station’s officers and, where the product allows it, other crew at that station.
  • NCI head office or a sector manager, when the station sends them a recruitment pack, an incident report, or another station report.
  • The providers listed above, as processors or as the service that delivers a message or a map.
  • Platform administrators, when they need to support a station or read a product suggestion. They are not members of the crew.

How long we keep it

  • Station messages: 30 days, then a further 7 days before the copy is removed.
  • Sent notification records: 90 days after they are sent.
  • Invitations: 30 days from the day they are created. An invitation link itself expires after 14 days.
  • Password reset links: about an hour. Sign-in lasts 30 days, or 90 days if you tick “Stay signed in on this device”.
  • Rota and crew audit records: usually 24 months. A station can set this between 6 and 60 months.
  • Filtered inbound mail: usually 30 days. A station can set this from 1 day up to a year.
  • Incident reports: a draft lasts 24 hours. A submitted report stays for 30 days.
  • Sign-in rate-limit records: a few hours, then they are deleted.
  • Recruitment files, welfare cases, member accounts, and most other station records stay until the station deletes them or the station itself is removed. Marking a member as left closes access. It does not wipe the rota history.

There is no self-service button that deletes an account. Ask your Station Manager or Deputy. They can remove access, and they decide what the rota record still needs to keep. Write to us at the registered office if the request is about our own processing, or if the station does not respond.

Your rights

Under UK GDPR you can ask to:

  • see the personal information held about you
  • correct it
  • delete it, or restrict how it is used
  • receive a portable copy of information you provided
  • object to processing based on legitimate interests, including the public on-watch page
  • withdraw consent for WhatsApp, browser notifications, or Pushover, which you can do on Me, and which does not affect processing that took place before you withdrew it

For station records, ask your station. The station is the controller, and we will help them respond. For our own processing, write to the registered office. We may ask for enough detail to be sure who you are. The usual time limit is one month. A request that is manifestly unfounded or excessive can be refused or charged for, which the law allows.

You can update display choices and notice choices yourself on Me. Officers can correct account details you cannot edit.

Awards and the watch league are calculated from the rota so the station can recognise service. They are not a decision that has a legal effect, or a similarly significant effect, on you. You can opt out of the league on Me.

Children

Porthole is for people a station has invited. It is not directed at children. A station must not record a child’s information unless the station has a lawful reason and, where the law requires it, consent from someone with parental responsibility.

Cookies and security

Cookies and similar storage are described in the cookie policy. Access to station records is limited by role. Session cookies are protected so page scripts cannot read them. Passwords are stored as hashes.

Complaints

Contact your station, or write to us at the registered office, and we will try to put things right. You can also complain to the Information Commissioner’s Office, the UK regulator for personal data, at ico.org.uk.

Changes

We will update this notice when the service changes, and we will change the date at the top. The current version is always this page.