Privacy Policy

1. Introduction

Northbrooks Mosque (“we”, “our”, or “us”) is committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Privacy Policy explains how we collect, use, store, and protect your personal information. Northbrooks Mosque (Registered Charity No. 1141413) is the data controller for the purposes of UK GDPR and the Data Protection Act 2018.

2. Information We Collect

We may collect the following types of personal information:

• Contact Information: Name, email address, phone number, and postal address when you contact us through our website.
• Communication Data: Any messages, inquiries, or feedback you send to us via our contact form or email.
• Technical Data: IP address, browser type, and device information collected automatically when you visit our website.

3. How We Use Your Information

We use your personal information for the following purposes:

• To respond to your inquiries and communicate with you
• To provide information about our services, events, and programs
• To comply with legal obligations
• To maintain the security of our website

4. Legal Basis for Processing

We process your personal data based on:

• Consent— When you submit our contact form, you provide explicit consent for us to process your contact details and message in order to respond to your enquiry. You may withdraw consent at any time by contacting us.
• Contract— When you make a donation, processing your payment information is necessary to complete the transaction.
• Legitimate Interests— We process technical data (such as server logs and IP addresses) to maintain the security and performance of our website. We have assessed that this does not override your rights and freedoms.
• Legal Obligation— We may process personal data where required to comply with applicable laws and regulations.

5. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law. Contact form submissions are typically retained for 2 years unless you request earlier deletion.

6. Information Sharing

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• With your explicit consent
• To comply with legal obligations or court orders
• To protect our rights, property, or safety, or that of others
• With service providers who assist us in operating our website (under strict confidentiality agreements), including:
  • Email delivery:Resend (resend.com) processes contact form submissions on our behalf in order to deliver them to our inbox. Resend's privacy policy is available at resend.com/legal/privacy-policy.
  • Payment processing:SumUp (sumup.com) processes donation payments on our behalf. SumUp's privacy policy is available at sumup.com/privacy.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your personal data
• Right to Restriction: Request restriction of processing
• Right to Data Portability: Receive your data in a structured format
• Right to Object: Object to processing of your personal data
• Right to Withdraw Consent: Withdraw consent at any time

To exercise any of these rights, please contact us at: bicch24@gmail.com

8. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

9. CCTV

We operate CCTV cameras on our premises for the purpose of security and the prevention of crime. CCTV footage is retained for a maximum of 31 days, after which it is automatically overwritten. Access to footage is restricted to authorised committee members only. Footage may be shared with the police or other authorities where legally required. If you wish to request access to footage in which you appear, please contact us using the details in the Contact Us section.

10. Automated Decision-Making

We do not use automated decision-making or profiling as defined under Article 22 of the UK GDPR. No decisions that produce legal or similarly significant effects are made about you using solely automated means.

11. Children's Privacy

Our website is not intended for individuals under 18 years of age. We do not knowingly collect personal information from individuals under 18. If we become aware that we have collected data from someone under 18, we will take steps to delete it.

12. International Data Transfers

Some of our service providers, including SumUp and Resend, may transfer or store personal data outside the United Kingdom. Where this occurs, we ensure that appropriate safeguards are in place in accordance with UK GDPR, such as the use of standard contractual clauses or transfers to countries with UK adequacy regulations. For further details, please refer to the privacy policies of the relevant service providers.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

14. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

15. Supervisory Authority

If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection: