Privacy Policy

Twyford Village Hall (referred to as “we”, “us”, or “the Hall” in this policy) is the data controller for the personal data we hold about you.

Address: Twyford Village Hall, The Knob, Twyford, Buckingham, Buckinghamshire, MK18 4EG
Email: hello@twyfordvillagehall.co.uk
Registered charity number: 275201 (England & Wales)

We are a registered charity managed by a voluntary committee of local trustees. You can view our entry on the Charity Commission public register.

Depending on how you interact with us, we may collect the following categories of personal data:

• Identity data: First name, last name, company name
• Contact data: Email address, postal address, telephone number
• Account data: Username (email), encrypted password hash, account type
• Booking data: Booking dates and times, room selections, event details, payment terms
• Financial data: Payment amounts, Stripe payment references (we do not store full card details - these are handled securely by Stripe)
• Communications: Messages sent to us via our contact form or the secure messaging system on this website
• Technical data: IP address, browser type, pages visited, session identifiers (see Cookie Policy)
• Business data: Company registration number, VAT number (where applicable)

We collect personal data in the following ways:

• Directly from you when you create an account, make a booking enquiry, submit a contact form, or send us a message
• Automatically through your use of our website (cookies and server logs - see our Cookie Policy)
• From third parties - Stripe (our payment processor) notifies us of payment events; Google reCAPTCHA processes your browser data to verify you are not a bot

If you make a donation and choose to add Gift Aid, we collect the additional information HMRC requires for a valid Gift Aid declaration: your title, full name, your home address including postcode, and your confirmation that you are a UK taxpayer.

We use this information solely to claim Gift Aid on your donation from HM Revenue & Customs (HMRC), who are the recipient of the declaration. Our lawful basis is compliance with a legal obligation. We retain Gift Aid declaration records for six years after the end of the tax year to which the claim relates, as required by HMRC, after which they are securely deleted.

We use your personal data for the following purposes and on the following lawful bases:

We will never sell your personal data or share it for marketing purposes.

We take the security of your personal data seriously and employ the following technical measures:

• Encryption at rest: All personally identifiable information (names, addresses, contact details, messages) stored in our database is encrypted using AES-256-GCM encryption with unique per-user data encryption keys
• Encrypted transmission: All data is transmitted over HTTPS using TLS encryption
• Password security: Passwords are never stored in plain text - we use industry-standard hashing (bcrypt)
• Access controls: Access to our systems is restricted to authorised administrators only
• Payment security: Card payments are processed by Stripe, which is PCI DSS compliant. We do not store card details on our servers

Despite our best efforts, no system is completely immune to attack. In the unlikely event of a data breach likely to result in a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) as required by law.

We share your personal data with the following third parties only where necessary:

• Stripe Inc. - our payment processor. Card payment data is handled directly by Stripe. See stripe.com/gb/privacy
• Zoho Corporation - our accounting software, used to maintain financial records. Data processed is limited to invoice and payment information. See zoho.com/privacy.html
• Google - reCAPTCHA v3 is used on forms to prevent spam. See Google's Privacy Policy
• IONOS SE - our email and website hosting provider, used to deliver transactional emails (booking confirmations, invoices, and similar) and to host this website. See ionos.co.uk privacy policy

We do not share your data with any other third parties without your explicit consent, unless required to do so by law.

We retain personal data only for as long as necessary for the purposes for which it was collected:

• Account data: Retained while your account is active and for up to 3 years after the account is closed or the last booking, whichever is later
• Booking and financial records: Retained for 7 years from the date of the transaction to comply with HMRC financial record-keeping requirements
• Contact form messages: Retained for up to 2 years
• Server access logs: Retained for up to 6 months for security monitoring purposes

Under the UK GDPR you have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you
• Right to rectification: You can ask us to correct inaccurate data. You can update most personal details directly in your account profile
• Right to erasure: You can ask us to delete your personal data, subject to certain legal exceptions
• Right to restriction: You can ask us to restrict processing of your data in certain circumstances
• Right to data portability: You can request your data in a structured, machine-readable format
• Right to object: You can object to processing based on legitimate interests
• Right to withdraw consent: Where we rely on your consent, you can withdraw it at any time

To exercise any of these rights, please contact us. We will respond within one calendar month. There is no charge for making a request.

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

We use cookies on this website. Please see our Cookie Policy for full details of what cookies we use and why.

Our website is intended for use by adults aged 18 and over. We do not knowingly collect personal data from children under the age of 13 without parental consent. If you believe we have inadvertently collected data from a child, please contact us immediately.

We may update this Privacy Policy from time to time. The current version will always be available on this page with the date of the most recent update shown at the top. We will notify registered users of significant changes by email where appropriate.

For any questions about this Privacy Policy, please contact us:

Twyford Village Hall Management Committee
The Knob, Twyford, Buckingham, Buckinghamshire, MK18 4EG
Email: hello@twyfordvillagehall.co.uk
Registered charity number: 275201

You can also view our public record on the Charity Commission register.