Privacy Notice

1. Who We Are

Somerset Malayalee Cultural Association (SMCA Yeovil) is a not-for-profit community organisation based in Somerset, UK, serving the Malayalee (Kerala) community in the region. We organise cultural events, celebrate Kerala festivals, and support community connection among our members.

2. What Personal Data We Collect

Member profile information

• Full name, email address, phone number, home address
• Year of birth (mandatory — used to determine membership category)
• Day and month of birth (optional — only if you wish to receive a personalised birthday greeting)
• Wedding anniversary date (optional — only if you wish to receive a personalised anniversary greeting)

Membership and payment information

• Membership status and start date
• Payment records for membership fees (amounts and dates of bank transfers)
• Event booking records

Portal preferences

• Display preferences (e.g. calendar settings, notification preferences)

Members directory (optional)

Profile photo, family member names and photos, email address, and phone number — only if you choose to make these visible. Nothing appears in the directory unless you actively opt in to each field individually. If you add photos of children under 18, you are responsible for consenting on their behalf to those photos being visible to all members. Contact details you share are visible only to logged-in SMCA members, never to the public.

3. How We Use Your Personal Data

4. Who We Share Your Data With

We do not sell or share your data for marketing purposes. Your data is stored on a private self-hosted server in Germany (EU), which is recognised under UK law as providing adequate data protection. The portal is maintained by a trusted technical partner under a Data Processing Agreement with SMCA. Members directory information is visible only to logged-in SMCA members.

5. How Long We Keep Your Data

• Active member data: retained for the duration of membership.
• On leaving or requesting deletion: deleted or anonymised within 60 days.
• Payment records: retained for 6 years (HMRC requirement).
• Optional data (birthday, anniversary, directory): deleted immediately on request or on account closure.

6. Your Rights

You have the right to: access your data, correct it, request erasure, restrict processing, receive a portable copy, object to processing, and withdraw consent at any time.

To exercise any right, contact smcacrm@gmail.com. We respond within 30 days at no charge.

7. Cookies

We use only strictly necessary session cookies to keep you logged in. We do not use advertising or tracking cookies. No cookie consent banner is required.

8. Member Feedback

The portal provides an optional feedback feature that allows members to rate their experience, share thoughts on events they attended, and submit feature suggestions.

• Feedback is submitted voluntarily and is never mandatory.
• You may choose to submit feedback anonymously. When you do, no identifying information is stored — your name and member ID are genuinely omitted from the database, not merely hidden from display.
• If you submit feedback with your identity, your name and the feedback content are visible only to SMCA committee administrators.
• Feedback data is used solely to improve the portal and SMCA events. It is never shared with third parties or used for profiling.
• You may request deletion of any identifiable feedback by contacting smcacrm@gmail.com.

Lawful basis: Consent (voluntary submission).

9. Email and Push Notifications

We only send announcements and newsletters if you have opted in. You can unsubscribe via any email we send, via Profile Settings, or by emailing smcacrm@gmail.com. Push notifications require browser-level permission which you can revoke at any time.

10. How We Protect Your Data

• Private access-controlled server, not public cloud
• Role-restricted access (members see only their own data)
• Directory visible to logged-in members only, never publicly
• Regular encrypted backups
• HTTPS for all access
• Data breaches reported to ICO within 72 hours

11. Children's Data

The portal is for adult members (18+). Family members including children may be added by adult members. Where directory visibility is enabled for a child's photo, the adult member is responsible for this decision. Contact smcacrm@gmail.com if you believe a child's data has been added inappropriately.

12. Event Photography

SMCA Yeovil may photograph or video events for our records, website, and social media. When you register for an event through the portal, you will be asked to indicate your photo consent preference. You may choose to consent or decline. If you consent, you may also extend that consent to cover any children you are registering as attendees.

Your consent preference is recorded at the time of booking and is linked to that specific event registration. You may withdraw consent at any time before the event by contacting us at smcacrm@gmail.com. Where you have declined consent, we will take reasonable steps to ensure you and your children are not identifiably photographed. However, in a public event setting we cannot guarantee complete avoidance.

Event photos shared on social media or the SMCA website are processed on the basis of legitimate interest for members who consent, or explicit consent for children's images.

13. Changes to This Notice

We will notify members of significant changes via the portal and email. Continued use after notification constitutes acceptance.

14. How to Complain

Contact us first at smcacrm@gmail.com. You may also complain to the ICO: