1. Data controller
Dawat-e-Islami UK (registered charity 1110114) is the data controller for this website and personal data handled for Faizan-e-Madina Masjid & Education Centre, Nuneaton. We process personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended.
For privacy requests, write to: Data protection, Faizan-e-Madina Masjid & Education Centre, 2A Henry Street, Coton, Nuneaton, CV11 5SQ. State your request and provide enough information to identify the relevant record. We may need proportionate proof of identity.
2. Categories and sources of personal data
Enquiries: your name, email address, optional telephone number, enquiry category, message, privacy acknowledgement and submission date.
Donations: contact details supplied with a donation, amount, donation type, appeal, payment reference, frequency, payment or refund status and relevant dates. We obtain payment confirmation from the payment provider and bank-transfer information from banking records. SumUp handles card details on its hosted checkout for new online donations; Stripe handled earlier online donations. We do not collect card numbers, security codes or expiry dates in our own forms or store them in the website database.
Website security: IP address, browser and device information, request dates and security checks. Rate-limit records use a keyed hash rather than a raw IP address or email address. We receive information directly from you, from payment and banking providers, and from the operation of the website.
3. Purposes and lawful bases
We use enquiry details to respond, administer services and deal with related requests. Our lawful basis is legitimate interests under Article 6(1)(f): responding to people who approach us and administering the masjid's activities.
We use donation details to administer gifts, respect fund restrictions, provide payment support and reconcile transactions. We rely on legitimate interests for donation administration and fraud prevention, and legal obligation under Article 6(1)(c) for accounting, regulatory and tax records.
We use technical information to protect the website and prevent abuse, relying on legitimate interests in security. We use consent under Article 6(1)(a) where required for optional third-party content or communications. The enquiry acknowledgement is not marketing consent. Providing enquiry or donation details is voluntary; without the information needed for the request, we may be unable to respond or administer it.
4. Special category data
Do not include health details, religious beliefs, children's personal information or other sensitive information in a general enquiry unless necessary. We do not infer your religion from a visit or donation. Where processing special category data is necessary, we require a separate Article 9 condition, such as explicit consent or, where its requirements are met, the religious not-for-profit condition for members and people in regular contact with us. Unnecessary sensitive information is removed or restricted.
5. Recipients and disclosures
Access is limited to authorised staff, volunteers and advisers who need it for their role. Hosting and security providers, including Cloudflare where enabled, process technical information. Resend processes enquiry notifications when email delivery is enabled. SumUp, Stripe for earlier online donations, and our bank process payment information when their services are used. Google receives technical information when the embedded map loads automatically on the contact page. Providers may also act as independent controllers for their own legal and security obligations.
We may disclose information to professional advisers, auditors, regulators or authorities where necessary and lawful. We do not sell personal data or give donor details to other organisations for their marketing.
6. International data transfers
Service providers may process data outside the UK. Where a restricted transfer occurs, we use an applicable UK adequacy regulation or approved contractual safeguards, such as the UK International Data Transfer Agreement or UK Addendum, together with any required assessment. You can request information about the safeguards using the postal address above.
7. Retention
We retain enquiry information only as needed to respond, complete related actions and resolve complaints or legal issues. We review closed enquiries and delete or anonymise information that no longer serves those purposes.
Necessary donation and accounting records are retained for at least six years from the end of the relevant financial year, and longer only where a legal duty, unresolved dispute or legal claim requires it. Other donor contact information is retained only while needed for an identified, lawful supporter relationship or outstanding request; it is not retained indefinitely merely because no opt-out has been received.
Security and operational records are kept for the period needed to investigate abuse and operate the service, then deleted or anonymised. Application rate-limit entries older than 24 hours are removed during requests or scheduled maintenance. Deleted information may remain in restricted backups until those backups expire under the backup schedule.
8. Right to object and withdraw consent
You may ask us to stop optional donor communications or object to processing based on legitimate interests. We will stop direct marketing when you object. We may retain a minimal suppression record to respect your preference. This website does not enrol donors or enquirers into marketing automatically.
An opt-out or withdrawal of consent does not automatically delete records needed for accounting, legal obligations or legal claims. You may separately request erasure; we will explain any lawful reason for retaining particular information. Withdrawing consent does not affect processing already carried out lawfully.
9. Cookies and third-party content
We do not use advertising or analytics cookies in this website build. Essential session and security technologies may be used for staff login, fraud prevention and service protection. Google Maps loads automatically on the contact page and may use cookies and process your IP address and browser information under its privacy policy. You can manage cookies and third-party content through your browser settings. Provider information: https://policies.google.com/privacy, https://www.cloudflare.com/privacypolicy/, https://www.sumup.com/en-gb/privacy/, https://stripe.com/privacy and https://resend.com/legal/privacy-policy.
10. Data subject rights and complaints
Depending on the lawful basis and any applicable exemptions, you may request access, correction, erasure, restriction or portability of your personal data, object to its use, or withdraw consent. These rights are not absolute. We respond within the statutory time limits, normally one month, and explain any permitted extension or refusal. We do not make solely automated decisions with legal or similarly significant effects; automated security checks may block suspected abuse.
You may raise a concern using the postal address above or complain to the Information Commissioner's Office: https://ico.org.uk/make-a-complaint/ or 0303 123 1113. You do not have to complain to us first.
11. Changes to this notice
Last updated: 22 October 2026. We update this notice when our processing changes.