Kokni Community Luton (“KCL”, “we”, “our”, or “us”) is a registered charity. We are the data controller for the personal information described in this policy. We have paid the Information Commissioner’s Office (ICO) data protection fee. Our registration reference is C2042194.

This policy explains what personal information we hold about members of the community, their households, donors and visitors to kokniluton.co.uk, why we hold it, who we share it with, how long we keep it, and the rights you have under UK data protection law.

1. Information we collect

Membership records

KCL keeps a register of member households so that it can run the community, collect membership fees and offer the right membership type. The register is maintained by a small number of committee members. For each household we record:

The household’s postal address
For each person in the household: name, role in the household (head of household, adult or child), and whether they may manage the household’s membership
For adults: email address, phone number, month and year of birth (never the day), employment status and whether they are in higher education. These decide which membership type and fee apply.
For children: name, month and year of birth, recorded by the head of household. We do not collect contact details for children and children cannot hold an online account.
Sports and activity preferences, if you choose to tell us
Membership type, status, renewal date, fee and how it is paid. If you pay by card, payment details are held by Stripe, not by us.
Notes made by the committee about the household’s membership, for example a query about a fee. Committee members are instructed not to record health or other sensitive information in these notes.

Most of this information was originally given to KCL on paper or in spreadsheets when households joined. It has been transferred to a secure online register. We keep a record of which committee member made each change and when.

Signing in

When you sign in to member-only areas we receive your name, email address and a unique account identifier from our authentication provider, Auth0. Auth0 also records the IP address and browser used to sign in for security purposes.

Donations and Gift Aid

When you donate we receive your name, email address and the donation amount from Stripe. If you make a Gift Aid declaration we also record your home address, as HM Revenue & Customs requires.

Website use

We use Vercel Analytics and Speed Insights to understand how the site is used. These collect aggregated, anonymised usage data and do not use cookies to track you across sites.

2. Why we use it and our lawful basis

Running your membership — keeping the register, deciding your membership type and fee, collecting and recording payments, and contacting you about your membership. Our lawful basis is that this is necessary for the membership relationship between you and KCL (performance of a contract), and, for household members who are not the paying member, our legitimate interest in keeping an accurate record of the community we serve.
Access to member-only services — verifying that you are a member when you sign in. Lawful basis: performance of a contract and our legitimate interest in keeping the site secure.
Donations and Gift Aid — processing your donation and claiming Gift Aid where you have asked us to. Lawful basis: performance of a contract and our legal obligations to HMRC.
Safeguarding — where our safeguarding policy requires us to record a concern. Lawful basis: our legal obligations and substantial public interest in protecting children and vulnerable adults. Safeguarding records are kept separately from the membership register and are not included in routine committee access or exports.

Because KCL serves the Kokni community, being recorded as a member may indicate your ethnic origin. This is “special category” information. We process it under the condition for not-for-profit bodies with an ethnic or cultural aim, which allows us to keep records about our members and people in regular contact with us, provided we do not disclose them outside KCL without your consent.

3. Who we share it with

We do not sell, trade or rent your personal information. We share it only with the service providers that run our systems, each of which acts on our instructions under a written contract:

Neon — hosts our membership and donation database in Amazon Web Services’ London (UK) region.
Auth0 (Okta) — provides sign-in. Our Auth0 tenant is hosted in the United Kingdom.
Vercel — hosts the website. Our application runs in Vercel’s London region. Vercel’s global network may briefly process requests elsewhere to deliver pages, and its support operations may involve the United States under the UK International Data Transfer Addendum.
Stripe — processes card payments and membership subscriptions. Stripe Payments UK Ltd is our contracting entity; Stripe processes some data in the United States under the UK International Data Transfer Addendum and standard contractual clauses.
HM Revenue & Customs — receives Gift Aid declarations when we claim Gift Aid.

We will also share information where the law requires it, for example with the police or a local authority in a safeguarding matter.

4. Who at KCL can see it

Access to the membership register is limited to committee members who have been given a dedicated “Membership Admin” role, and to the trustees who administer the website. Every change to a household’s record, every time a record or the register is viewed, and every download is logged with the name of the person who did it. Committee members must not copy the register to personal devices or share it outside KCL.

5. How long we keep it

Current members: for as long as your household is a member.
Former members: when a person leaves, their record is marked as having left. 24 months after that date, an automatic weekly process removes their name, contact details, date of birth, employment details, preferences and any notes about them, leaving only an anonymous record that a person was once part of the household. You can ask us to remove your details sooner (see section 7).
Donations and Gift Aid records: six years after the end of the tax year in which the donation was made, as HMRC requires.
Lapsed households: if a household’s membership lapses and is not renewed, the same automatic process removes the household’s address, notes and every member’s personal details 24 months after the lapse date. Anonymous membership and payment history is kept for our accounts.
Sign-in accounts: until you ask us to close your account, or the account has been unused for 24 months.
Change logs: the record of who changed what is kept for the same period as the record it relates to, and is redacted when that record is anonymised or erased.

6. How we protect it

The register is held in an encrypted database, reached only over encrypted connections, and protected by sign-in with role-based access. Exports are limited to authorised committee members and are logged. Our systems do not write personal details to application logs. Committee members are asked to keep any downloaded copies in a secure location and delete them when no longer needed.

7. Your rights

Under UK data protection law you have the right to:

Access the personal information we hold about you and your household (a “subject access request”)
Correct anything that is inaccurate or incomplete
Erase your information where we no longer need it, for example after you leave the community
Restrict or object to how we use it, including where we rely on legitimate interests
Withdraw consent where consent is the basis we rely on
Complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113

To exercise any of these rights, email admin@kokniluton.co.uk. We will respond within one month. We may need to confirm your identity first. Requests about a household will be actioned with the head of household, and requests about a child with the parent or guardian who recorded them.

8. Children

We record limited information about children (name, month and year of birth, and household) because family membership covers them. This is provided by the head of household. Children do not have online accounts, we do not contact children directly, and their details are never included in routine committee exports without the rest of the household. Any safeguarding concern is handled under our safeguarding policy.

9. Changes to this policy

We may update this policy from time to time. When we do, we will update the “Effective Date” at the top of this page and, for significant changes, tell members by email.

10. Contact us

Questions about this policy or about how we handle your information should go to the trustees:

Email: admin@kokniluton.co.uk
Website: kokniluton.co.uk
ICO registration: C2042194

Privacy Policy