What is the TAF Hub?
The TAF Hub is a closed internal roster tool for North Cottesloe SLSC's ~45 Trainers, Assessors, and Facilitators (TAF) and ~5 admin users. It is used to sign up for teaching sessions, confirm attendance, and generate patrol-hours reports for Surfguard. It is not a public website and is not accessible to members of the public, award candidates, or unprovisioned club members.
Access is granted by the Chair of Education — you must be invited before you can sign in.
This notice supplements the NCSLSC Privacy Policy, which governs all personal information held by the club. Both documents apply to your use of the Hub. Where this notice is more specific, it takes precedence for Hub data. The Hub has no access to other NCSLSC club records, including sensitive information (health, disability, indigenous status) held by the club.
How you sign in
Enter your email address. The Hub sends a magic link — a one-time sign-in link — to that address. Click it to sign in. No password required. On your own device you stay signed in for 12 months without re-entering your email.
A signed device token (cookie) is placed on your device on sign-in. It contains only a random device identifier — not your name, email, or any personal details in readable form. If you sign in on a new device, you receive an email notification as a security alert. To sign out, use Profile → Sign out.
Google or Apple sign-in is also available as an alternative — activated when the Hub moves to hub.ncslsc.com. If you use this option, Google or Apple verifies your identity and shares your email address with the Hub. Their own privacy policies govern that part of the sign-in process.
Personal information we hold
| Data | Why we hold it |
|---|---|
| Full name + preferred name | Identify TAFs on the session board. Other TAFs see preferred name only. |
| Email address | Identity anchor, magic-link sign-in, booking confirmations, reminders. |
| Mobile number (optional) | Direct contact by admins only — not used for sign-in, not shown to other TAFs. |
| Surfguard Member ID | Links your Hub records to Surfguard for patrol-hours export. Admin-only — never disclosed TAF-to-TAF. |
| Qualifications + currency dates | Determines which sessions you are eligible to teach. |
| Sign-up, role, position, pay status | Core roster function — drives the sign-up board and Surfguard reports. |
| Attendance (confirmed, actual times, confirmer, source) | Attendance record used for Surfguard patrol-hours export. |
| Calendar feed token | Authorises your personal iCal subscription feed. Regenerable on request. |
| Reminder & notification preferences | Controls which email categories you receive and when (opt-in). |
| Web push subscription (if opted in) | Delivers in-app push notifications for waitlist promotions and slot events. |
| Waitlist / interest requests | Tracks your place in a waitlist or expression of interest for a paid role. |
| Device token hash + browser type | Powers trusted-device sign-in; triggers new-device alert emails. |
| Action log (email hash, action, timestamp) | Security audit log — reviewed only if a dispute or incident arises. |
What we do not collect & who can see your information
| Who | What they can see |
|---|---|
| Other TAFs | Per-session roster: preferred name, role code, and pay status of TAFs signed up to the same session. Contact details are not visible to other TAFs. |
| Admin users — Chair of Education + Head Trainers (~5 people) | Full roster entry, sign-up history, audit log entries. All admin actions are themselves audit-logged. |
| Chair of Education | Full access, including the audit log and the ability to onboard, edit, and offboard members. |
| Surfguard systems | The Hub exports patrol-hours data in Surfguard Patrol Log format on request only. Data is not pushed automatically. |
| Third-party processors | Resend (email delivery — receives recipient email + content; subject to Resend's privacy policy and data processing agreement); Cloudflare (host — no data persisted); Supabase (database, Sydney AU); Google or Apple (only if you use OAuth sign-in — receives your email + profile name at sign-in; their own privacy policies apply). |
How long we keep your information
| Data | Retention |
|---|---|
| Trainer Roster entry | While active. Marked inactive when you cease; removed after one further season. |
| Teaching slots + attendance records | Retained as long as required for: Surfguard patrol-hours reconciliation (the Hub is the source record for hours exported to SLSWA); dispute resolution; and club governance (training delivery history). Consistent with the club's standard 7-year policy for operational records. Contact the Chair of Education if you have concerns about a specific record. |
| Audit log | 24 months rolling; older entries purged automatically. |
| Authentication cookie | Expires after 12 months, or when you sign out. |
| Web push subscription | Until you revoke permission in your browser settings or via Profile → Notifications. |
Your data is stored in Australia (Sydney). Email delivery via Resend transits the US but is not stored there.