Privacy & security

Who is responsible?

Suleymaniye Community Association is responsible for the personal information it uses through Suleymaniye.org. In data-protection law, this makes the charity the data controller.

This notice covers this website, donations and enquiries made through it. Services such as education, employment or safeguarding may need additional privacy information when details are collected. Independent organisations linked from this website have their own privacy notices.

Information we receive

• Details you give us: your name, email address, telephone number and the contents of an enquiry, feedback or event-related message.
• Donation records: amount, donation type, frequency, payment status and transaction reference; your billing address and Gift Aid declaration where relevant.
• Photographs or videos supplied for publication about mosque activities, and publicly available review content displayed through services such as Google and Trustindex.
• An optional name if you give on behalf of someone else. Please include only the name needed, rather than private details about that person.
• Technical information received by our hosting and payment services, such as IP address, browser/device information and security or error records.

Information normally comes directly from you, from someone contacting us on your behalf, or from the payment provider confirming a transaction. Public review content comes from the relevant review platform, and media may come from people contributing it to the mosque. You do not need to give your name simply to read public pages.

How and why we use it

We use information only for relevant purposes. The lawful basis depends on what we are doing:

Where information is needed to answer your request, arrange a service or process Gift Aid, we may be unable to do that without it. We do not use this website to make solely automated decisions that have legal or similarly significant effects on you.

Sensitive information and children

Please do not put medical, safeguarding, identity-document or other sensitive details into a general enquiry. Contact the mosque first if a service needs that information.

Some information may reveal religious beliefs, health or other specially protected details. Processing it requires both a lawful basis and a relevant special-category condition under UK data-protection law. Any service that needs such details should explain the purpose and appropriate basis at collection; this notice is not blanket permission to collect them.

Parents or guardians should contact us about children’s activities. Please avoid sending unnecessary information about a child through a general website form.

Payments and service providers

Online payments are processed through Stripe’s hosted checkout. This website does not store your full payment-card number or card security code. Stripe processes payment details and may also use information for its own legal, security and fraud-prevention responsibilities.

• Wix provides the website hosting, media, content management and website-form services.
• Stripe provides payments, receipts and recurring-donation management.
• Relevant authorised staff and necessary IT or communication providers may handle enquiries and donation administration.
• HMRC receives the information needed for eligible Gift Aid claims. Information may also be disclosed where legally required to regulators, professional advisers or law-enforcement bodies.

We do not sell or rent personal information. Sharing with a service provider is limited to what is needed for its task. See Wix’s privacy notice and Stripe’s privacy notice for their own processing details.

Donor portal and email sign-in

Supabase provides email-link authentication for the donor portal and processes your email address, login session and associated security information. Google Workspace delivers the sign-in emails. Our server uses your verified email address to find matching Stripe customer records and retrieve donation history, receipts and recurring plans. Donations made under another email address, or without a matching customer record, may not appear.

Your browser stores a login session locally to keep you signed in. Signing out removes the local session; use Log out when using a shared device. Payment-card entry and card updates take place on Stripe’s secure pages. Available recurring changes depend on the plan. Any immediate charge and effective date are shown for confirmation before a change is submitted.

See Supabase’s privacy information. Contact us for help accessing or deleting portal account information; donation and accounting records may still need to be retained as described below.

Information outside the UK

Wix, Stripe and their service providers may store or process information outside the UK. Applicable arrangements may include UK adequacy regulations or approved contractual safeguards, such as standard contractual clauses with the relevant UK provisions. You can contact us for information about safeguards relevant to your data.

How long information is kept

• Enquiries and correspondence are kept for as long as needed to handle the request, related follow-up and any complaints or legal issues.
• Donation and accounting records are kept for applicable financial and tax requirements. Gift Aid records are generally needed for six years after the relevant accounting period; continuing declarations must also cover the required period after the final donation. Records may need to be kept longer during an HMRC enquiry.
• A minimal record of an opt-out may be retained so that we can honour your marketing preference.
• Technical and security records are retained according to their operational purpose and the relevant service provider’s arrangements.

Retention depends on the record, the purpose and any legal requirement. Contact us if you want to know the period relevant to a particular record.

Cookies, media and external links

Cookies and similar technologies may be used by the hosting service, secure staff sign-in, payment services and embedded features. Some are necessary for a requested function. Others may identify a device or link activity to a person; it would be misleading to describe all cookies as anonymous.

Embedded reviews, maps or videos — including Trustindex, Google services and YouTube where displayed — may receive your IP address and browser information and may use their own storage technologies. External websites and payment pages follow their own notices.

Non-essential storage or tracking requires consent unless a legal exception applies. This notice is not a substitute for that consent. You can manage stored cookies and third-party content through your browser settings; blocking essential cookies may stop sign-in or payments working. If you have questions about a particular embedded feature, contact us.

Keeping information secure

We use HTTPS and access controls for website administration, with payment processing handled by Stripe. Access to information should be limited to those who need it for their role. No website or transmission can be guaranteed completely secure.

Never send full card details, passwords or security codes by email or through a contact form. If you suspect an incorrect payment or a security issue, contact the charity promptly.

Your choices and rights

Depending on the circumstances, you can ask to access or correct information, request deletion or restriction, object to use based on legitimate interests, and receive certain information in a portable form. You can withdraw consent where we rely on it, without affecting earlier lawful processing.

You can object to direct marketing at any time. Use an unsubscribe option where provided, or contact us. Deletion is not always possible where records must be kept by law, for example donation and tax records.

Send requests to info@suleymaniye.org, call 020 7684 9900, or write to the registered address above. We may need reasonable information to verify your identity. We normally respond within one month, subject to lawful extensions or pauses; we will explain any that apply.

Questions, complaints and updates

Contact info@suleymaniye.org if you have a privacy concern. You also have the right to complain to the UK Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.

We will update this notice when relevant website practices or requirements change. The date at the top shows the latest version.