About this pack
This pack helps a club assess SwimNexus as a supplier. It is information, not a contract. It does not replace or change the Data Processing Agreement, the service agreement or their schedules, which are what bind the parties. Everything here describes how SwimNexus is run on the date above. It deliberately omits internal infrastructure details, credentials, private network addresses and encryption keys.
A. Business identity
| Operator | Lewis Plume trading as SwimNexus, a UK sole trader (not a limited company) |
|---|---|
| Address | 20 Talbot Close, Highbridge, Somerset, TA9 3AX, United Kingdom |
| Contact | [email protected] |
| Website | https://swimnexus.co.uk |
| Products | SwimClubOS (club operations) and SwimMeetOS (meet hosting) are available. SwimLeagueOS is planned and is not offered as an operating product. |
| Registrations | No Companies House number applies. VAT registration is not stated here. |
B. Hosting architecture
SwimNexus runs on servers that SwimNexus operates, using Windows, Apache, PHP and MariaDB. Public traffic reaches the servers through a Cloudflare Tunnel. A separate control-plane database holds organisations, user accounts, product entitlements and agreements. Each SwimClubOS club has its own operational database and private file storage.
C. Data location
The primary infrastructure is hosted in the United Kingdom. Cloudflare processes website traffic on the way in, and Microsoft and Google hold encrypted offsite backups; their service regions and international-transfer terms are being verified and are stated in the Subprocessor Schedule. This pack does not claim that all information stays in the United Kingdom.
D. Tenant isolation
SwimClubOS resolves each request to one club from a trusted registry and opens only that club's database and storage. An unknown or incomplete club is refused rather than guessed. Platform and club sessions are separate, and moving from the platform into a club uses a short-lived, single-use launch. Every product entry point checks the organisation's entitlement on the server. This is a design and testing measure; it has not been independently penetration tested.
E. Authentication and permissions
- Individual accounts with hashed passwords; passwords are never sent by email.
- Sessions use protective cookie settings, and forms that change records are protected against cross-site request forgery.
- Club administrators get only the features granted to them; members and families see only their linked records.
- Multi-factor authentication is not currently enforced on SwimNexus platform accounts.
F. Encryption
- Connections to the website are encrypted in transit.
- Backup files are encrypted on the hosting computer before upload, and the two cloud storage services also encrypt them in transit and at rest.
- Encryption of the live hosting disks and database files has not been verified, so it is not claimed.
G. Backup and disaster recovery
- An automated backup process produces encrypted backups and uploads them to Microsoft OneDrive and Google Drive.
- Both cloud accounts use multi-factor authentication.
- Restoration of data from cloud backups has been successfully tested.
- Deleted cloud backup copies may remain recoverable for up to 30 days.
- These facts are confirmed by the operator. They are not an independent audit, and no recovery-time or recovery-point commitment is made.
H. Incident management
Suspected incidents are contained, recorded in an incident register (including those that are not reported), and assessed. Where club personal data is affected, SwimNexus tells the club without undue delay and aims to give an initial notice within 24 hours of becoming aware. The club decides on notices for its own records. Report a concern to [email protected] with "Security" in the subject.
I. Data protection roles
The club is controller of its operational records and SwimNexus is its processor under the Data Processing Agreement. SwimNexus is controller for its own account, contract, support, security and business records. See who owns and controls your data.
J. Third-party services and subprocessors
Cloudflare (traffic and tunnel; may keep technical logs or cached content depending on configuration), mailbox.org (SwimNexus service email), and Microsoft and Google (encrypted backups). Services a club connects itself, such as its own payment provider or Microsoft 365 tenant, are the club's arrangements and are not SwimNexus subprocessors by default. The current list is on the subprocessors page, and customers are given advance notice of changes as the Data Processing Agreement describes.
K. Retention and deletion
The club sets retention for its records while active. On exit, active data is deleted following the club's instruction, backups are put beyond use, and contract and audit records are kept separately. See the Customer Data Export and Exit Policy.
L. Data export
Owners and administrators can request an organisation-wide export (CSV, JSON, original uploaded files and a manifest, in a ZIP) from the document centre. It is generated in the background, downloaded only by signed-in authorised users, recorded, and deleted after 7 days.
M. Provider access controls
SwimNexus can open a club's account only for a stated reason, for a limited time, within a limited scope, normally after the club approves; there is a documented emergency route with extra safeguards; and all sessions are recorded and visible to the club. Server-level access by the operator is a recognised limit. Read the Provider Access Policy.
N. Independent security assurance status
| Item | Status |
|---|---|
| ISO/IEC 27001 certification | Not held |
| Cyber Essentials / Cyber Essentials Plus | Not held |
| Independent application penetration test | None confirmed |
| Independent audit of application security | None |
| Uptime or availability commitment | None |
| Internal automated tests of access control and isolation | Run as part of development; not independent |
No system is free of risk. SwimNexus does not claim that loss of data or a breach is impossible.
O. Contact and reporting
General, security and privacy contact: [email protected]. Post: 20 Talbot Close, Highbridge, Somerset, TA9 3AX, United Kingdom. Complaints about SwimNexus as controller: the complaints form. You may also complain to the Information Commissioner's Office.
Documents that bind
The binding documents are the signed service agreement, the Data Processing Agreement, the Processing Particulars, the Technical and Organisational Measures Schedule, the Subprocessor Schedule and the Data Retention, Export and Exit Schedule. They are available in your document centre.
SwimNexus is the trading name of Lewis Plume, a UK sole trader, 20 Talbot Close, Highbridge, Somerset, TA9 3AX, United Kingdom. Contact [email protected]. Customers' signed agreements prevail over this page.