Privacy Policy

Who we are

Makkah Masjid Bolton, of 100–110 Grecian Crescent, Bolton, Lancashire BL3 6QU, is the data controller for the personal information described in this notice.

Registered charity number: to be confirmed.

Questions about this notice, or about your information, should go to info@makkahmasjidbolton.co.uk or 01204 524200. The person responsible for data protection at the masjid is name and role to be confirmed.

What we collect

We only collect information you give us. This site has no analytics, no advertising and no tracking of any kind.

When you…	We collect
Send a message through the contact form	Your name, email, phone (if given), the subject and your message
Donate	Your name, email, phone (optional), the amount, the cause or appeal, whether the gift is monthly, and any message or dedication. Card details go directly to our payment provider, Stripe — we never see or store them
Make a Gift Aid declaration	Your home address and postcode. HMRC requires these to process the claim
Book a place at an event	Your name, email, phone, the tickets you choose and anything you tell us you need. Paid tickets are paid by card through Stripe
Book a stall	Your business or organisation, a contact name, email, phone and what you will be selling. Payment is by card through Stripe
Enquire about venue hire	Your name and contact details, the event type, dates, times, approximate guest numbers and any needs or notes
Submit a funeral request	Your name, phone and relationship to the deceased, together with information about the deceased needed to arrange the burial
Register for the Youth Club	The young person's name, date of birth and address; the parent or carer's name, relationship and contact details; emergency contacts; and any medical issue you tell us about. Health details are encrypted and only staff who need them can see them

Information we do not collect here

DBS check details are not collected through this website. Volunteer vetting is handled offline through the proper channel, so no criminal records information is held by the site.

Why we use it, and our lawful basis

Purpose	Lawful basis under UK GDPR
Replying to your enquiry	Legitimate interests — you asked us a question and expect an answer
Arranging a funeral, an event place, a stall or a hall booking	Performance of a contract, or steps taken at your request before entering one
Processing a donation and issuing a receipt	Performance of a contract, and legal obligation for our financial records
Claiming Gift Aid	Legal obligation — HMRC requires the donor's name and address
Running the Youth Club safely	Legitimate interests — knowing who each young person is and who to contact
Health details you choose to tell us (for example on the Youth Club form)	Explicit consent — the tick on the form — or the legitimate activities of a not-for-profit religious body

Where we rely on consent, you can withdraw it at any time by contacting us. Withdrawing consent does not affect anything done before you withdrew it.

How long we keep it

Information	Kept for
General enquiries	to be confirmed — we suggest 12 months after the matter is closed
Donation records	7 years, to meet charity accounting requirements
Gift Aid declarations	6 years after the last donation they cover, as HMRC requires
Event and stall bookings	to be confirmed
Youth Club registrations	to be confirmed — the trustees should set this alongside the safeguarding policy
Funeral records	to be confirmed

Who we share it with

We do not sell your information, and we do not share it for marketing. We share it only where we have to:

• Our payment provider, Stripe — to take card payments securely. They handle your card details; we do not.
• HMRC — name and address, where you have made a Gift Aid declaration.
• Funeral partners — the registrar, the cemetery and, where needed, the coroner, in order to arrange a burial.
• Where the law requires it — including where there is a safeguarding concern about a child or an adult at risk. See our safeguarding policy.

Our payment provider may process data outside the UK. Where that happens it is covered by the safeguards required under UK data protection law.

Your rights

You have the right to:

• Ask what we hold about you, and get a copy
• Have anything inaccurate corrected
• Ask us to delete it, where we have no continuing reason to keep it
• Object to our using it, or ask us to restrict how we use it
• Withdraw consent, where consent is what we relied on
• Ask for a copy in a portable format

Ask by email or phone. We will respond within one month and there is no charge.

Cookies

This website sets no tracking or advertising cookies. There is no analytics and no social media pixel.

The site does set a session cookie and a security cookie, which are needed for its forms to work. On the payment pages, our payment provider Stripe loads its own script, which may set cookies used to prevent fraud.

The map on the contact page is provided by Google Maps. When it loads, Google can see your IP address and may set its own cookies. Some pages also load fonts and icons from other organisations' servers, which means those organisations can see your IP address.

To be decided: whether the Google map needs a cookie notice before the site goes live. If the trustees later add analytics or anything else that sets cookies, this section must be updated and a cookie banner added first.

Complaints

If you are unhappy with how we have handled your information, please tell us first — we would rather put it right.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or 0303 123 1113. You can complain to them without telling us first.

Changes to this notice

This notice was drafted on date of adoption and should be reviewed at least every two years, or sooner if what we collect changes.