Privacy Policy
Last updated: 8 November 2026
This explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it. We've tried to write it in plain English rather than legalese.
1. Who is responsible for your data
Let’s Make Stupid Decisions (“LMSD”, “we”, “us”) is the data controller for the personal data described here. You can contact us about anything in this policy at team@letsmakestupiddecisions.com or by post at 8 Queens Parade, Cleethorpes, DN35 0DF.
LMSD is run by Louis Harwood, trading as Let’s Make Stupid Decisions. Card payments for membership and shop orders are taken through Stripe. We never see or store your full card number.
2. What we collect
Account and profile
Your name, email address, phone or WhatsApp number, country and location, date of birth, and your login credentials (held by our authentication provider; we never see your password).
Training and safety
Your height and weight, skydiving and BASE experience, gear you own, emergency contact details, and your training records: jump logs, progression notes, instructor recommendations and course participation.
Health information. We ask for medical notes relevant to your safety (conditions, injuries, medication). This is “special category” data under UK GDPR and we treat it with particular care: we collect it only where it matters for your safety or someone else’s, we share it only with the instructors who need it, and we rely on your explicit consent, which you can withdraw at any time by contacting us.
Purchases and membership
Orders, order history, delivery name and address, membership status and dates, and rental or purchase requests. We do not store your card details; those go directly to Stripe.
Contact and marketing
Enquiries and messages you send us, course waitlist signups, and newsletter subscriptions (including whether you’ve opted out).
Members-only contributions
Exit records and photographs you add, confirmations you log, access requests you make and, to protect that shared information, logs of when members view or request it.
Technical
Basic request and error logs, and an administrative audit log recording significant actions taken in our admin area (who changed what, and when).
3. Why we use it, and our lawful basis
- To deliver what you’ve asked for: running courses, fulfilling orders, managing your membership and account. Lawful basis: performance of a contract.
- To keep you and others safe: assessing suitability, briefing instructors, holding emergency contacts, and keeping training records. Lawful basis: legitimate interests (safe delivery of a high-risk activity), and explicit consent for health data. In a genuine emergency we may rely on vital interests.
- To run the club: member benefits, the exit database, resources and events. Lawful basis: contract and legitimate interests.
- To protect shared information: access logs, rate limits and image watermarking that deter unauthorised sharing of sensitive exit data. Lawful basis: legitimate interests.
- To send you things you asked for: our newsletter and waitlist alerts. Lawful basis: consent, which you can withdraw at any time via the unsubscribe link or by emailing us.
- To meet our legal obligations: tax and accounting records for sales. Lawful basis: legal obligation.
We don’t sell your data, and we don’t use it for automated decision-making or profiling.
5. International transfers
Some of our providers process data outside the UK. Where that happens we rely on UK adequacy regulations or on standard contractual clauses with appropriate safeguards, so your data keeps an equivalent level of protection.
6. How long we keep it
- Account and profile data: while your account is open, and for up to 12 months after you close it.
- Training records: for up to 7 years after your last activity with us. These matter for your progression and for our safety record, and we may need them if a question arises later.
- Health information: reviewed regularly and deleted once it is no longer relevant to your participation.
- Orders and payment records: 7 years, to meet tax and accounting requirements.
- Newsletter subscriptions: until you unsubscribe; we then keep a minimal record so we don’t email you again by mistake.
- Access and audit logs: up to 24 months.
7. Your rights
Under UK GDPR you can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that’s wrong or incomplete;
- delete your data, where we don’t have an overriding reason to keep it;
- restrict or object to how we use it, including for legitimate interests;
- provide it in a portable, machine-readable format; and
- withdraw consent at any time, where consent is what we rely on.
Email team@letsmakestupiddecisions.com and we’ll respond within one month. You can also edit much of your profile yourself from your account.
If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.
9. Security
Access to your data is restricted by role and enforced at the database level, so people only see what their role allows. Traffic is encrypted in transit, passwords are hashed by our authentication provider, and significant admin actions are recorded in an audit log.
No system is perfectly secure. If a breach ever affects your rights and freedoms, we’ll tell you and the ICO as required.
10. Children
Our services are for adults. We don’t knowingly collect data about anyone under 18. If you believe we have, contact us and we’ll delete it.
11. Changes to this policy
We’ll update this page when our practices change and revise the date at the top. If a change materially affects your rights, we’ll tell you directly.
See also our Terms & Conditions.
Questions about any of this? Email team@letsmakestupiddecisions.com or use our contact form.