Privacy notice

Version: DRAFT, awaiting committee approval. TODO: add the approval date here once agreed.

Who we are

SEABA is a volunteer-run riders' group covering Stockport, affiliated to the British Horse Society. SEABA is the "data controller" for the information described here. If you have any questions, email our membership secretary at seaba.membership@gmail.com.

What we collect and why

• When you join: your name, email, address, postcode, home telephone and mobile (phones are optional), how you plan to pay, and your agreement to our aims, code of conduct, storage of your details and this notice. We use this to run your membership: to welcome you, match your payment, keep our member list, and contact you about SEABA's work, meetings and renewals.
• Payment records: the date you paid and when your membership runs out. We do not see or store your bank card or account details; payments go directly to SEABA's NatWest account.
• Notes: the committee may add short notes, for example "paid by cheque" or "prefers post".
• When you use our contact form: your name, email and message are emailed to SEABA so we can reply. They are not stored on this website.

Our lawful basis is your membership with us (to run it) and SEABA's legitimate interest in keeping members informed about our work. You agree to us storing your details when you join, and you can change your mind at any time.

Renewal reminder emails

If you are a current member and we have your email address, our website sends you up to three short reminders before your membership runs out: about one month, two weeks and two days before. If you renew, the reminders stop until next year. We only ever send one reminder at a time. Reminders contain only your first name, your renewal date and how to pay. They never include your address or phone numbers.

Updating your details

Each reminder includes a private "Update your details" link that works once and expires after 30 days. The form behind the link is always blank: it never shows the details we hold, so nobody who sees your email can read them. Anything you send is checked by our membership secretary before your record is changed. You can also simply email us with any changes.

Who can see your information

• Only SEABA's membership secretary and committee admin can see member details. They use a private admin area protected by a strong password and a second security step (a code from an authenticator app).
• Every time someone views, changes, exports or deletes a member record, it is written to a security log.
• We do not sell or share your information with anyone else, and we do not use it for advertising.
• Our website is run by a hosting company (Hostinger) who store the data for us under contract and cannot use it for anything else. Data is stored on secure servers in the EU (Netherlands).
• SEABA's email inboxes are provided by Google (Gmail). Notifications about new applications and detail changes do not contain your personal details; contact form messages do, as that is how we reply.

How long we keep it

• Member details: while you are a member. If your membership lapses, we review your record and delete it once it is more than 24 months past its expiry date, unless you rejoin.
• If you resign or ask us to delete your details, we erase them, including your reminder history and any update requests.
• Update links: work for 30 days and are deleted automatically 90 days after they were created.
• Detail-change requests: deleted automatically 90 days after they are approved or rejected.
• Security log of admin activity (no personal details, just record numbers and shortened internet addresses): 12 months.
• Security records of login and form attempts (scrambled internet addresses, used to block abuse): 30 days for logins, 2 days for forms.
• Contact form emails: kept in our inbox only as long as needed to deal with your message.
• Backups made by our hosting company are kept for a short period and then overwritten. Daily backups are kept for up to 7 days and weekly backups for up to 6 weeks, then deleted automatically.

Cookies and tracking

Our public website uses no cookies, no analytics and no tracking. Fonts and images are served from our own site, so visiting does not share your details with other companies.

Your rights

Under UK data protection law (UK GDPR) you have the right to:

• see the information we hold about you (a "subject access request"),
• correct anything that is wrong or out of date,
• have it erased, and to object to how we use it or ask us to limit it,
• withdraw your agreement to us storing your details at any time.

To ask, just email seaba.membership@gmail.com. We will reply within one month. There is no charge.

If you are unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

Keeping it safe

Information travels to and from our website over an encrypted (HTTPS) connection. The admin area needs a password and an authenticator code, logs people out after 30 minutes of inactivity, and records all activity. We keep the amount we collect to a minimum.

Changes to this notice

We will update this page if anything changes and tell members about important changes.