Privacy Policy

This website is run by the Basildon Malayalee Association (BMA), a non-profit socio-cultural organisation based in Basildon, Essex, United Kingdom. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), BMA is the data controller for the personal information described in this policy.

If you have any questions about this policy or your information, contact us at info@basildonmalayalees.com or on +44 7399 701970.

When you become a member

• Name, title, gender and age of the primary member and of each family member you add (spouse and children).
• Contact details: email address, mobile number and home address, including postcode and local area.
• Home town in India, if you choose to give it.
• Profile and family photos, if you choose to upload them.
• Your login details. Passwords are stored only in encrypted (hashed) form — we cannot see them.
• Your membership number, membership dates and the consent you give when you register.

When you book an event

• The names and ages of the people attending, the booking contact's name, email and phone number, the number of tickets in each age group, your ticket reference and whether the ticket has been used at the entrance.

When you pay

• Payments are processed by Stripe. Your card details go directly to Stripe and are never seen or stored by BMA. We receive only the payment reference, amount, status and payment method reference.

When you contact us or use the site

• The name, email, phone number and message you send through our contact form.
• A record of each login to your account (date, time and IP address), which we keep for security.

• To set up and run your family's membership, including renewals and your online member account.
• To take event bookings, work out ticket prices by age, issue your e-tickets and check you in at the door using the QR code.
• To send you service emails: registration and booking confirmations, e-tickets, renewal reminders (one week before your membership ends and when it has expired) and password reset links.
• To reply to your enquiries.
• To run the association — for example, member lists by area and attendance reports to help the committee plan events.
• To keep the website and your account secure and to prevent misuse.

We do not sell your information, and we do not use it for advertising.

• Contract — to provide the membership and event bookings you ask for.
• Legitimate interests — to run the association, keep records, keep members informed about their membership and keep the website secure.
• Consent — for optional information such as photos. You can withdraw consent at any time by contacting us or removing photos from your profile.
• Legal obligation — to keep financial records where the law requires it.

Family memberships and bookings can include children. This information is provided by a parent or guardian, and we use it only to manage the family's membership, apply the correct ticket prices by age and know who is attending our events. We do not create accounts for children or contact them directly.

We only share your information where it is needed to provide our services:

• Stripe, to process card payments securely.
• Our website hosting and email providers, who store the website and send our emails on our behalf.
• BMA committee members and volunteers who need it to run membership and events — for example, checking tickets at the entrance.
• Police, regulators or others where the law requires us to.

Photographs are often taken at BMA events and may be published in our website gallery, news and social media pages to share the life of our community. If you would prefer not to appear, please tell the photographer on the day, or contact us and we will remove a photo you appear in.

Profile and family photos you upload to your account are used only within the association's records and are not published on the public website.

We use only two essential cookies, and no advertising or analytics cookies:

• Session cookie — keeps you logged in and remembers your booking or registration form between pages. It expires after two hours of inactivity.
• Security token (XSRF-TOKEN) — protects forms against misuse by other websites.

Some pages use services from other organisations, which have their own privacy policies:

• Stripe — the payment pages load Stripe's secure card form, which may set its own cookies for fraud prevention.
• Exchange rate — the live pound-to-rupee rate at the top of the site is fetched by your browser from frankfurter.dev, which will see your IP address.
• Facebook, YouTube and WhatsApp — only if you click a link or share button to visit them.

We keep membership information while your membership is active and for as long afterwards as is reasonably needed for the association's records — for example, if you renew after a gap. Payment and booking records are kept for as long as needed for accounting; UK financial records are normally kept for six years.

You can ask us to delete your information at any time (see Your rights). We will do so unless we need to keep something for a legal reason.

• The website uses an encrypted (HTTPS) connection.
• Passwords are stored in encrypted (hashed) form only.
• Card payments are handled entirely by Stripe.
• Only authorised committee members can access the admin area.

Please keep your password private and let us know straight away if you think someone else has used your account.

Under UK data protection law you have the right to:

• Access the personal information we hold about you.
• Correct it — you can update most details yourself under Profile & family.
• Erase it, where we no longer have a reason to keep it.
• Restrict or object to how we use it.
• Receive a copy of it in a portable format.
• Withdraw consent where we rely on it.

To use any of these rights, email info@basildonmalayalees.com. We will respond within one month.

If you are unhappy with how we have handled your information, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk, telephone 0303 123 1113.

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated. If we make important changes, we will let members know by email.

See also our Terms & Conditions.