Igbo Union Yorkshire — How We Collect, Use, and Protect Your Data
This Privacy Policy explains how Igbo Union Yorkshire ("the Union", "we", "us", "our") collects, uses, stores, and protects personal data belonging to our members, in connection with the member portal and our wider activities as a community association based in Yorkshire, United Kingdom.
For the purposes of UK data protection law (the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018), Igbo Union Yorkshire is the data controller responsible for your personal data. You can contact us using the details in Section 16.
We collect and process the following categories of personal data about our members:
We collect personal data:
Under UK GDPR, we must have a valid lawful basis to process your personal data. The table below sets out the main purposes for which we use your data and the lawful basis we rely on for each.
| Purpose | Lawful Basis |
|---|---|
| Processing your membership application and administering your membership record | Legitimate interests (administering the Union) and, where applicable, your consent given at registration |
| Recording attendance at meetings and events | Legitimate interests (maintaining accurate membership and attendance records) |
| Recording and reminding you of membership dues and payments | Legitimate interests (administering membership obligations) |
| Operating the welfare programme and cooking group rotation | Consent (welfare submissions) and legitimate interests (cooking group administration) |
| Sending you meeting, event, dues, welfare, and administrative communications | Consent, given when you accept our Terms & Conditions at registration, and legitimate interests |
| Maintaining an activity log of actions on your account | Legitimate interests (security, accountability, and dispute resolution) |
| Using event photographs on our website or social media | Consent, as described in our Terms & Conditions |
| Complying with our legal and regulatory obligations | Legal obligation |
Where we rely on consent, you may withdraw that consent at any time by contacting us using the details in Section 16, without affecting the lawfulness of processing carried out before you withdrew consent.
Some welfare report categories — for example, illness or accident — may involve information about a person's health, which UK GDPR treats as "special category data" requiring extra protection.
We only process special category data that you or another member voluntarily provide when submitting a welfare report, and we rely on your explicit consent (given at the point of submission) as our lawful basis for processing it under Article 9 UK GDPR. This data is used solely to enable the Union's welfare officers to provide appropriate support, and is only accessible to authorised welfare officers and administrators. It is not used for any other purpose.
We send membership-related communications (meeting reminders, dues notices, welfare updates, cooking group notifications, and general Union announcements) by email, SMS/text message, phone call, or messaging platforms such as WhatsApp, as described in our Terms & Conditions. These are treated as membership administration communications rather than third-party marketing, and we do not send you marketing communications from other organisations. You may ask us to limit non-essential communications by contacting the welfare team, though we may still need to contact you about essential membership matters.
We do not sell your personal data. We share personal data only with:
We aim to store and process your data within the United Kingdom wherever possible. Where a service provider we use (for example, an email delivery service) processes data outside the UK or European Economic Area, we take steps to ensure appropriate safeguards are in place, such as relying on providers certified under recognised data protection frameworks or standard contractual clauses approved for use under UK GDPR.
We retain your personal data for as long as you remain a member of the Union, and for a reasonable period afterwards to maintain accurate historical membership, attendance, and financial records (typically up to six years, in line with common practice for financial and organisational records). Welfare data is retained only for as long as necessary to provide support and maintain a record of assistance given, after which it is deleted or anonymised. You may ask us to delete your data earlier, and we will do so unless we have a legitimate reason or legal obligation to keep it.
We use appropriate technical and organisational measures to protect your personal data, including access controls that restrict administrative and financial data to authorised executives, encrypted connections between your device and our systems, and activity logging so that changes to membership records can be traced. No system can be guaranteed completely secure, but we review our safeguards on an ongoing basis.
The member portal uses strictly necessary cookies to keep you securely signed in and to remember your session while you use the site. We do not currently use analytics or advertising cookies. If this changes, we will update this policy and, where required by the Privacy and Electronic Communications Regulations (PECR), ask for your consent first.
You have the following rights in relation to your personal data:
To exercise any of these rights, contact us using the details in Section 16. We will normally respond within one month, as required by UK GDPR.
We do not use your personal data for any automated decision-making or profiling that produces legal or similarly significant effects on you. Membership decisions (such as approval, suspension, or termination) are always made by a human member of the executive committee.
Membership of the Union is intended for adults. We do not knowingly collect personal data from children. If you believe a child's data has been provided to us without appropriate consent, please contact us so we can remove it.
We may update this Privacy Policy from time to time to reflect changes in our practices or in data protection law. The "Last updated" date at the top of this page shows when it was last revised. We encourage you to review this page periodically.
If you have questions about this Privacy Policy or wish to exercise any of your rights, please contact the welfare team at hello@igbounionyorkshire.org.
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK's data protection regulator, the Information Commissioner's Office (ICO):
This document is a general draft of Igbo Union Yorkshire's privacy practices, prepared with UK GDPR and Data Protection Act 2018 principles in mind, for internal review. It is not a substitute for formal legal advice, and the Union recommends this document be reviewed by a solicitor with UK data protection expertise before being relied upon as a final policy — particularly the treatment of welfare-related special category data and retention periods.