PRIVACY POLICY Holborough Lakes Social Committee Last Updated: July 2026 1. Introduction Holborough Lakes Social Committee ("we", "us" and "our") operates the Holborough Lakes Social platform. This Privacy Policy explains what personal information we collect, why we collect it, how we use it, how long we keep it and the choices available to you. We are committed to handling your information responsibly and in accordance with UK GDPR and the Data Protection Act 2018. 2. Data Controller Holborough Lakes Social Committee is the Data Controller for information collected through this platform. General enquiries: hello@holboroughlakes.social Privacy enquiries: privacy@holboroughlakes.social 3. Information We Collect • Name, email address, encrypted password and optional telephone number. • Event bookings, tickets, donations and volunteer registrations. • Gift Aid details where supplied. • Uploaded files such as vendor logos or insurance documents. • Technical information including IP address, browser, device type and security logs. • Communication preferences. 4. How We Use Your Information We use your information to: • Manage your account. • Process event bookings, tickets and donations. • Coordinate volunteers and community activities. • Send confirmations, reminders and important service emails. • Respond to enquiries. • Protect the platform against fraud, abuse and unauthorised access. • Meet legal and financial obligations. • Improve the platform and user experience. 5. Legal Basis We process your information under one or more of: • Contract • Consent • Legal obligation • Legitimate interests, including platform security, fraud prevention and service improvement. 6. Sharing Your Information We may share information with: • Stripe for payment processing. • Email delivery providers for transactional emails. • Secure hosting providers. • HMRC where required for Gift Aid or tax purposes. • Law enforcement or regulators where legally required. We never sell your personal information. 7. Data Retention We keep information only for as long as necessary. • Account information: until deleted or after 3 years inactivity. • Financial records: 7 years. • Gift Aid records: 6 years after the relevant tax year. • Event bookings and volunteer records: normally 3 years. • Cancelled bookings: 2 years. If you delete your account we anonymise personal information wherever possible. Records required by law or for fraud prevention, security and financial compliance are retained. 8. Your Rights You have the right to: • Access your information. • Correct inaccurate information. • Request deletion. • Restrict or object to processing where applicable. • Receive a copy of your information. • Withdraw consent where processing relies on consent. Registered users can log in and visit Settings → Your Data & Account to: • Download a machine-readable JSON copy of their personal information. • Delete their account. Account deletion anonymises personal information including your name, email address, telephone number, address and uploaded content where appropriate. The following records are retained where legally required: • Payment and financial records. • Booking and ticket history. • Donation and Gift Aid records. • Security audit logs. • Email delivery logs. Retained records are anonymised or pseudonymised wherever reasonably possible. 9. Data Security We protect your information using: • HTTPS encryption. • bcrypt password hashing. • Secure authentication. • Role-based access controls. • Rate limiting and brute-force protection. • Secure upload validation. • Security audit logging. • Content Security Policy and modern HTTP security headers. • Stripe PCI DSS Level 1 payment processing. • SPF, DKIM and DMARC email authentication. • Encrypted backups and restricted database access. 10. Fraud Prevention & Security Monitoring We collect limited technical information such as IP address, browser details, login activity and security events to detect suspicious activity, prevent fraud, investigate abuse and maintain platform security. 11. Cookies We use essential cookies for authentication, session management, security and user preferences. We do not use advertising cookies or sell personal information for advertising. 12. Children's Privacy Our platform is not intended for children under 13. If we become aware we have collected personal information from a child under 13 without appropriate authority we will delete it. 13. International Transfers Where information is transferred outside the UK, appropriate safeguards such as adequacy regulations or Standard Contractual Clauses are used. 14. Automated Decision Making We do not use automated decision-making or profiling that has legal or similarly significant effects. 15. Changes to this Policy We may update this Privacy Policy from time to time. Significant changes will be communicated through the platform or by email where appropriate. 16. Complaints If you have any concerns, please contact admin@holboroughlakes.social first. You also have the right to complain to the Information Commissioner's Office (ICO) at www.ico.org.uk. 17. Contact General enquiries: hello@holboroughlakes.social Privacy enquiries: privacy@holboroughlakes.social