Draft for approval. This text was prepared for the Society and has not yet been reviewed or adopted. Passages marked [TO CONFIRM] need details only the Society can supply. It is not legal advice; if the Society handles special category data, works with children, or begins marketing by email, take proper advice before publishing.
This policy explains what the Greek-Scythian Society CIC does with personal information collected through this website, and what rights you have over it. It is written to meet the UK General Data Protection Regulation and the Data Protection Act 2018.
Who is responsible
The Greek-Scythian Society CIC is the data controller for information collected through this website. We are a community interest company registered in England and Wales, company number [TO CONFIRM: CIC company number], registered office [TO CONFIRM: registered office address].
For any question about this policy, or to exercise the rights described below, contact us at [TO CONFIRM: the email address for privacy enquiries].
[TO CONFIRM: whether the Society is registered with the Information Commissioner’s Office and, if so, its registration number. Most organisations that process personal data must pay the ICO data protection fee unless an exemption applies]
What we collect, and why
When you use the contact form
The form asks for your name, your email address, a subject and your message. We use these only to read and answer your enquiry. We also record that you ticked the consent box, and when.
Our lawful basis is your consent, which you give by ticking the box before sending. You can withdraw it at any time by contacting us; withdrawing it does not affect anything we did before you withdrew it.
Messages are stored in this website’s own database and are also sent to us by email. Both copies are covered by this policy.
When you simply read the site
You do not have to give us anything to read this website, and we do not set any cookies of our own. Our web server keeps a short technical log of requests — the IP address, the page requested, the time, and the browser’s self-description — which we use only to keep the site running and secure. Our lawful basis is our legitimate interest in the security and reliability of the site.
We do not use analytics, advertising, tracking pixels, or social media buttons. See our Cookie Policy for the detail.
How long we keep it
- Enquiries: [TO CONFIRM: a retention period — two years after the enquiry is closed is a common and defensible choice]. After that we delete them.
- Server logs: a short rolling period, [TO CONFIRM: confirm with the final hosting provider — typically 14 to 90 days].
Who else sees it
We do not sell personal information and we do not share it for marketing. It is handled by the small number of suppliers who keep the site and our email working, acting on our instructions:
- Our website hosting provider. [TO CONFIRM: the final hosting provider and the country the server is in. The draft site runs on Microsoft Azure in France; if that is where the live site stays, say so here]
- Our email provider, for the copy of your enquiry sent to us. [TO CONFIRM: the email provider]
We may also disclose information where the law requires it.
Where your information is held
Information is held on servers in [TO CONFIRM: country — France for the current draft site]. Where information leaves the United Kingdom, we rely on the UK’s adequacy regulations for the countries concerned, or on approved contractual safeguards.
Embedded material from other websites
Some pages may include video or other material hosted elsewhere. Opening such a page can let the other website see your IP address, in the same way as visiting it directly. Where we embed video from YouTube we use its no-cookie service, so no tracking cookies are placed simply because you opened the page. Videos of the Society’s own events are hosted on this website and involve no third party at all.
Your rights
Under UK data protection law you may ask us to:
- give you a copy of the personal information we hold about you
- correct anything that is wrong
- delete it, in the circumstances the law allows
- restrict or object to how we use it
- provide it in a portable form, where that right applies
- stop relying on your consent, by withdrawing it
Write to [TO CONFIRM: the email address for privacy enquiries] and we will respond within one month. There is no charge.
If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would appreciate the chance to put things right first.
Children
This website is intended for a general audience and we do not knowingly collect personal information from children through it. [TO CONFIRM: if the Society runs school visits or youth activities and collects information for them, that needs its own wording and probably parental consent]
Changes to this policy
We will update this page when our practices change, and will alter the date below. This policy was last updated on [TO CONFIRM: date of adoption].