PRIVACY POLICY | Hampstead Community Centre

Hampstead Community Action

Last updated: 14 July 2025

Hampstead Community Action (“HCA”, “we”, “us”, “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you use our website and related services.

Please read this policy carefully. By using our website, you agree to the terms of this policy.

1. Who We Are

Hampstead Community Action is a charity and company limited by guarantee, registered in England and Wales (Charity no. 282089 / Company no. 01270770) with a registered office at 78 Hampstead High Street, London NW3 1RE.

For the purposes of UK data protection law, we are the Data Controller of your personal data. This means we decide how and why your data is used.

2. Data We Collect

We may collect and process the following types of personal data:

Identity data: name, date of birth, gender
Contact data: email address, phone number, postal address
Technical data: IP address, browser type/version, operating system
Usage data: how you use our website, services, and communications
Financial data: payments, donations, refunds (processed via third-party providers)
Special category data (where necessary and lawful): health, disability, or allergy information, pupil premium status, ethnicity, language
Children’s data: where our services involve children, we collect only what is necessary and always with appropriate parental/guardian consent

3. How We Collect Data

We collect data in the following ways:

Directly from you – when you contact us, register, complete forms, make a payment/donation, or subscribe to updates
Automatically – when you use our website (via cookies and similar technologies)
From third parties – such as payment processors, analytics providers, or service partners

4. How We Use Your Data

We use your personal data only where we have a lawful basis. Typical purposes include:

To provide and manage our services and activities
To process payments and donations
To communicate with you (including responding to enquiries)
To send you updates or marketing (with your consent or under soft opt-in rules)
To improve our website, services, and operations
To comply with legal obligations

5. Legal Bases for Processing

We process data under the following lawful bases:

Contract – where processing is necessary to deliver services you request
Consent – e.g. sending you marketing emails (you may withdraw consent at any time)
Legal obligation – e.g. complying with HMRC or safeguarding laws
Legitimate interests – e.g. improving services or managing operations (we balance our interests against your rights)

6. Sharing Your Data

We only share your personal data where necessary and lawful. Recipients may include:

Our employees, trustees, and authorised volunteers
Service providers (e.g. IT support, website hosting, analytics, payment processors)
Professional advisers (e.g. auditors, insurers, legal advisers)
Regulators, authorities, or law enforcement (where required)

We never sell your personal data to third parties.

7. International Transfers

If your data is transferred outside the UK/EEA (e.g. where a service provider hosts data overseas), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses.

8. Data Retention

We retain personal data only for as long as necessary:

Membership/participation records – [insert timeframe]
Financial records – 6 years (HMRC requirement)
Safeguarding records – in line with legal obligations and best practice
Marketing contact details – until you unsubscribe

After these periods, data is securely deleted or anonymised.

9. Your Rights

You have the following rights under UK data protection law:

Access – to request a copy of your data
Rectification – to correct inaccurate or incomplete data
Erasure – to request deletion of your data
Restriction – to limit processing in certain cases
Portability – to request transfer of your data to another organisation
Objection – to object to processing based on legitimate interests or direct marketing
Withdraw consent – where consent was given

To exercise your rights, contact us at hello@hampsteadcommunitycentre.co.uk.

You also have the right to complain to the Information Commissioner’s Office (ICO) at https://ico.org.uk.

10. Children’s Data

Where services involve children, we:

Seek parental/guardian consent where required
Collect only what is strictly necessary
Apply additional safeguards in line with GDPR and safeguarding law

11. Cookies

Our website uses cookies and similar technologies to improve your experience.

Necessary cookies – required for website functionality
Analytics cookies – help us understand how visitors use the site
Preference cookies – remember your settings and choices
Marketing cookies – used for relevant advertising (if applicable)

On your first visit, you will be asked to set your cookie preferences. You can update or withdraw consent at any time in your browser settings. For more information, see aboutcookies.org.

12. Data Security

We use technical and organisational measures to protect your data, including secure servers, encrypted communications, and restricted access. In the event of a suspected data breach, we will notify you and the ICO where legally required.

13. Changes to This Policy

We may update this policy from time to time. Any significant changes will be communicated on our website.

14. Contact Us

If you have any questions about this policy or how we use your data, please contact us:

📧 hello@hampsteadcommunitycentre.co.uk
📍 Hampstead Community Centre, 78 Hampstead High Street, London NW3 1RE