Privacy Policy
How we protect your personal data under the UK GDPR and the Data Protection Act 2018
Secure Data
Your information is protected with industry-standard encryption
Transparency
We clearly explain how we collect and use your data
Your Rights
You control your personal information and can request deletion
1. Who we are (data controller)
Gujarat Samaj Nottingham ("GSN", "we", "us") is a registered charity (Charity No. 513936) at 28 Handel Street, Nottingham NG3 1JE. We are the data controller for the personal information collected through this website and our membership, events, Saturday Club and communications, and we process it in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Data protection queries: info@gujaratsamajnottingham.com.
2. Information we collect
Membership: name, date of birth (optional for existing members claiming their membership), gender, email, phone, postal address and postcode, membership type and dates, GS membership number, family links (parent/guardian for members under 14), and — where you choose to provide them — a photo ID document (passport, driving licence or national ID) and a photograph for your membership card. Events and tickets: the name of each attendee, your email and phone, and ticket QR codes. Payments: amount, date and Stripe payment reference (card details go directly to Stripe and never touch our systems). Saturday Club, volunteering and enquiries: the details you give us on those forms. Communications: newsletter subscription and, for emails we send, delivery information (delivered, bounced, complained) so we stop emailing addresses that fail. Technical: IP address and basic device information in security logs and to limit abusive requests. We do not use facial recognition or any biometric processing of photographs.
3. Existing members moving to the digital system
Our existing membership records (name, contact details, membership type and expiry) have been transferred into the new digital system. Each existing member receives an individual, personal claim link by email so they can check and update their own details, optionally add a photo ID and photograph, and receive a digital membership card. Where several family members share one email address, each person receives their own separate email and link; one person’s link never gives access to another person’s record. Claim links are personal, time-limited and cannot be used to alter anyone else’s membership. These invitations are service messages about your existing membership, not marketing.
4. How we use your information and our lawful bases
To provide your membership, issue your membership number and digital card, and verify membership at events (contract). To process ticket bookings, donations and payments and send confirmations (contract). To verify identity and eligibility — e.g. reviewing a photo ID or age proof for 65+ membership — and to keep accurate records and prevent misuse (legitimate interests; you may choose not to provide documents). To send newsletters and event news you have subscribed to (consent, withdrawable at any time via the unsubscribe link). To send occasional information about our events to current members (legitimate interests, with an opt-out in every email). To keep the charity’s financial and governance records (legal obligation). To keep the site secure, prevent fraud and investigate problems (legitimate interests).
5. Children
Memberships for children under 14 are held under a parent or guardian, who provides and controls the child’s information. We ask for a parent or guardian to be linked before a child’s membership is verified. We do not knowingly collect information directly from children under 13 without a parent or guardian.
6. Automated assistance and decisions
When a photo ID is uploaded, software may read the name and date of birth from the image to pre-fill the check for our team. No decision about your membership is made solely by automated means: every verification is reviewed and approved by an authorised administrator, and you can contact us to query any outcome.
7. Who we share information with
We do not sell, trade or rent personal information. We use a small number of service providers acting on our instructions under contract: Stripe (payments); Amazon Web Services (sending our emails, hosted in the AWS London region); Ideal Postcodes and Postcodes.io (finding your address from a postcode you enter — only the postcode is sent); and our website hosting and database provider. Authorised committee members and administrators access records only for the purposes above, behind an additional database password, and their actions are recorded in an audit log. We may disclose information where required by law or to protect the charity, our members or the public.
8. International transfers
Our email is sent from within the UK (AWS London). Some providers, such as Stripe, may process data outside the UK. Where that happens we rely on the UK Government’s adequacy regulations or the ICO’s International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, so that your information receives equivalent protection.
9. How long we keep information
Membership records: for the life of the membership and up to 6 years after it ends, for charity record-keeping. Photo ID documents: reviewed for verification and then deleted under our retention schedule (currently within 6 months of upload, configurable by the committee), with access restricted to authorised staff; you may ask us to delete an ID document earlier once verification is complete. Membership card photographs: while your membership is active and for up to 12 months after it ends. Financial and donation records: 6 years, as required by UK charity and tax law. Ticket and attendee data: until after the event plus a short reconciliation period. Newsletter details: until you unsubscribe. Claim links expire after 5 days and claim sessions after 7 days. Security and audit logs: up to 12 months unless needed for an investigation.
10. Membership cards and QR codes
Your digital membership card shows your name, GS membership number, membership type and expiry, your photograph if you have provided one, and a QR code. When the QR code is scanned at an event it shows the verifier only your name, membership number, membership status and — where provided — your photograph, so that your membership can be confirmed. Ticket QR codes work the same way for the named attendee. Neither code contains your address, date of birth or documents.
11. Keeping your information secure
We use appropriate technical and organisational measures: encrypted connections (HTTPS), private storage for documents and photographs, signed and expiring links, an additional password for the member database, role-based staff access, rate-limiting and audit logs. Payment card details are handled only by Stripe. No system is completely secure; if a personal data breach is likely to result in a risk to you, we will inform you and the ICO as the law requires.
12. Your rights
Under the UK GDPR you have the right to: be informed; access a copy of your data; have inaccurate data corrected; have data erased ("right to be forgotten") where there is no legal reason to keep it; restrict or object to processing (including direct marketing, which we will always stop on request); data portability; withdraw consent at any time; and not be subject to solely automated decisions. Use the request form below or email info@gujaratsamajnottingham.com. We will respond within one month (extendable by two months for complex requests, and we will tell you if so). We may need to confirm your identity before releasing information. There is no fee unless a request is manifestly unfounded or excessive.
13. Complaints — Information Commissioner’s Office (ICO)
If you are unhappy with how we handle your personal data you have the right to complain to the UK supervisory authority: the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow SK9 5AF — ico.org.uk/make-a-complaint — 0303 123 1113. We would welcome the chance to resolve your concern first, so please contact us before approaching the ICO.
14. Cookies and similar technologies
We use only essential cookies and browser storage needed to run the website — for example to keep you signed in to the staff portal, to remember a membership claim you have started, and to protect against misuse. We do not use advertising, analytics or cross-site tracking cookies, so no cookie consent banner is required beyond the notice shown. You can clear or block cookies in your browser settings; some features may then not work.
15. Changes to this policy and how to contact us
We may update this policy when our services or the law change; the date of the current version is shown below, and significant changes will be highlighted on this page. Questions about this policy or our handling of your data: info@gujaratsamajnottingham.com, or write to Gujarat Samaj Nottingham, 28 Handel Street, Nottingham NG3 1JE.
Make a Data Request
Request a copy of your data, ask us to correct it, or ask for it to be deleted. Your request goes straight to our team and we will respond to your email within one month.
Last updated: 21 September 2026 (version 2.0)
Gujarat Samaj Nottingham - Registered Charity No. 513936