Privacy Policy

Last updated: XYZ

This Privacy Policy explains how Project SHIFA CIC (“Project SHIFA”, “we”, “us”) collects, uses and protects personal information when you use this website, contact us or register for one of our sessions. We are committed to handling your information fairly, lawfully and securely in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

1. Who we are

Project SHIFA CIC is a community interest company registered in England and Wales (company number 000), with its registered office at XYZ. We are the controller of the personal information described in this policy. You can contact us about this policy or your information at info@projectshifa.org.uk.

2. The information we collect

• Enquiry form (Contact Us page): your name, email address, the subject of your enquiry and the message you send us.
• Session registration (Register for a Session page): registration uses a Google Form. The information you enter is collected by Google on our behalf and stored in our Google account. The form explains what it asks for.
• Emails and messages: if you email us or message us on Instagram or LinkedIn, we receive your contact details and anything you choose to tell us.
• Website analytics (only if you accept): if you click “Accept analytics cookies”, Google Analytics collects information about how you use the website, such as the pages you visit, the device and browser you use and your approximate location. It does not tell us who you are.
• Technical information: like all websites, our hosting provider records basic technical information such as your IP address and browser type in server logs, to keep the website secure and working.

3. How and why we use your information

• To reply to your enquiry and keep a record of our correspondence. Our lawful basis is our legitimate interests in responding to people who contact us.
• To organise sessions you register for and to contact you about them. Our lawful basis is our legitimate interests in delivering our sessions, or consent where the registration form asks for it.
• To understand how the website is used so we can improve it. Our lawful basis is your consent, which you give by accepting analytics cookies and can withdraw at any time.
• To keep the website secure and to meet our legal obligations.

We do not sell your personal information and we do not use it for automated decision-making.

4. Cookies

Cookies are small files saved on your device. We use:

• Strictly necessary: shifa_consent remembers whether you accepted or rejected analytics cookies, for 6 months. The website cannot remember your choice without it.
• Analytics (only with your consent): Google Analytics cookies (_ga and _ga_*), which last up to 2 years.

You can change your choice at any time using the Cookie settings link at the bottom of every page. You can also block or delete cookies in your browser settings.

Some parts of our pages are provided by other services. The registration form on the Register for a Session page is provided by Google Forms, and the map on the Impact page uses OpenStreetMap. When these load, the provider receives your IP address and may set its own cookies under its own privacy policy.

5. Who we share your information with

We only share personal information with service providers who help us run Project SHIFA and who must protect it: our website hosting provider, our email provider, Google (Google Forms, Google Workspace and, with your consent, Google Analytics) and OpenStreetMap. We may also share information if the law requires it.

Some of these providers may process information outside the UK, for example in the United States. Where this happens, the transfer is protected by UK adequacy regulations or by approved safeguards such as the UK International Data Transfer Agreement or Addendum.

6. How long we keep your information

We keep enquiries and registration details for up to 000 months after our last contact with you, unless we need to keep them longer for a legal reason. Analytics information is kept for 14 months. After that, we delete it or make it anonymous.

7. Keeping your information safe

The website uses a secure (HTTPS) connection. Access to the information we hold is limited to the people who need it, and we use secure passwords and up-to-date software.

8. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information;
• ask us to restrict how we use your information, or object to how we use it;
• ask us to transfer your information to another organisation;
• withdraw your consent at any time, where we rely on consent.

To use any of these rights, email info@projectshifa.org.uk. We will reply within one month. There is usually no charge.

9. Complaints

If you are unhappy with how we have handled your information, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk.

10. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top.