Introduction
Minhaj Institute Walsall ("we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you visit our website, attend our events, use our services, make a donation, or communicate with us in any way.
This policy applies to all personal information we process, whether you provide it directly to us or we collect it through your use of our website at minhajinstitutewalsall.co.uk.
We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For further information about your data protection rights, you can visit the Information Commissioner's Office (ICO).
By using our website or engaging with our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of our website and services.
Who We Are
Minhaj Institute Walsall is a registered charitable organisation based in Alumwell, Walsall. We are part of the global Minhaj-ul-Quran International network and operate as a mosque, community centre, and education provider.
For the purposes of data protection law, Minhaj Institute Walsall is the data controller. This means we are responsible for deciding how your personal data is processed and for what purposes.
| Detail | Information |
|---|---|
| Organisation | Minhaj Institute Walsall (Minhaj-ul-Quran International Walsall) |
| Address | 49 Woodwards Road, Alumwell, Walsall WS2 9RJ, United Kingdom |
| info@minhajinstitutewalsall.co.uk | |
| Phone | 01922 612 010 |
What Personal Data We Collect
The types of personal data we collect depend on how you interact with us. We may collect the following categories of information:
Information you provide directly
- Identity data — your full name, and where relevant, your title or date of birth
- Contact data — your postal address, email address, and telephone number
- Financial data — payment details when you make a donation (processed securely through our payment provider; we do not store your full card details)
- Gift Aid data — your taxpayer status and declaration, as required by HMRC for Gift Aid claims
- Event and course data — registration details for our educational programmes, events, and community activities
- Volunteer data — information provided as part of a volunteer application
- Correspondence — any enquiries or communications sent to us via email, phone, or contact forms
- Mailing list preferences — if you subscribe to our newsletter
Information collected automatically
When you visit our website, we may automatically collect your IP address, browser type, device type, pages visited, and referring website, through cookies and similar technologies. Please refer to our separate Cookie Policy for full details.
Special category data
As a faith-based organisation, some interactions may involve data relating to religious beliefs. Under Article 9 of the UK GDPR, this is classified as special category data. We only process such data where you have given explicit consent, or where processing is carried out in the course of our legitimate activities as a not-for-profit body with a religious aim, and it is not shared outside the organisation without your consent.
How We Use Your Personal Data
We use your personal data for the following purposes:
- To process and acknowledge donations, including Gift Aid claims with HMRC
- To register you for events, courses, and community programmes
- To respond to your enquiries and correspondence
- To send you newsletters, updates, and event information (only with your consent)
- To manage volunteer applications
- To administer venue and facility hire bookings
- To improve our website, services, and user experience
- To comply with legal and regulatory obligations
- To maintain safeguarding records where required
Legal Basis for Processing
Under the UK GDPR, we rely on the following lawful bases to process your personal data:
- Consent — where you have given clear consent for us to process your data for a specific purpose, such as subscribing to our mailing list or opting into Gift Aid
- Contractual necessity — where processing is necessary to fulfil a booking, registration, or service you have requested
- Legitimate interests — where processing is necessary for our legitimate interests as a charitable organisation, such as fundraising communications to existing supporters, provided this does not override your rights
- Legal obligation — where we are required by law to process your data, such as Gift Aid records for HMRC, safeguarding obligations, or financial reporting
How We Share Your Data
We do not sell, rent, or trade your personal data to any third party. We may share your data with:
- Payment processors (such as PayPal, Stripe, or JustGiving) to process donations securely
- HMRC for Gift Aid claims
- Email service providers to manage our mailing list
- Website hosting and analytics providers
- Local authorities or law enforcement where required by law or for safeguarding purposes
- Professional advisers such as auditors or legal counsel, where necessary
All third-party processors are required to handle your data in accordance with the UK GDPR and are bound by data processing agreements.
International Data Transfers
Some of our third-party service providers may process data outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or an adequacy decision recognised by the UK Government, to protect your data to the same standard as the UK GDPR.
How Long We Keep Your Data
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. Our general retention periods are:
| Data Type | Retention Period |
|---|---|
| Donation and Gift Aid records | 7 years (as required by HMRC) |
| Event and course registration data | 2 years after the event |
| Mailing list data | Until you unsubscribe |
| Website analytics data | 26 months |
| General correspondence | 3 years |
| Safeguarding records | Retained in line with statutory requirements |
After the retention period, your data is securely deleted or anonymised.
Data Security
We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it, including:
- SSL/TLS encryption across our website
- Secure payment processing through PCI-compliant third-party providers
- Password-protected access to internal systems and databases
- Regular review of data handling procedures
- Staff and volunteer awareness of data protection responsibilities
While we take all reasonable steps to protect your data, no method of transmission over the internet is completely secure. We cannot guarantee absolute security but are committed to safeguarding your information to the highest standard we can.
Your Rights
Under the UK GDPR, you have the following rights in relation to your personal data:
- Right of access — you can request a copy of the personal data we hold about you (a Subject Access Request)
- Right to rectification — you can ask us to correct any inaccurate or incomplete data
- Right to erasure — you can ask us to delete your personal data where there is no compelling reason for us to continue processing it
- Right to restrict processing — you can ask us to suspend the processing of your data in certain circumstances
- Right to data portability — you can request that we transfer your data to another organisation in a structured, commonly used format
- Right to object — you can object to processing based on legitimate interests or direct marketing at any time
- Right to withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal
To exercise any of these rights, please contact us using the details below. We will respond within one calendar month as required by law.
If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent authority for data protection, by visiting ico.org.uk or calling 0303 123 1113.
Children's Privacy
We are committed to protecting the privacy of children. We do not knowingly collect personal data from children under the age of 13 without parental or guardian consent. Where children are enrolled in our education programmes or events, consent is obtained from a parent or guardian.
Personal data relating to children is handled with additional care and is only accessible to authorised staff and volunteers. For guidance on children's data rights, visit the ICO's Children's Code.
Parents and guardians may exercise any of the data protection rights set out in this policy on behalf of their children at any time by contacting us.
Links to Other Websites
Our website may contain links to third-party websites, including JustGiving, PayPal, social media platforms, and partner organisations. We are not responsible for the privacy practices or content of these external sites.
We encourage you to read the privacy policy of every website you visit before providing any personal information.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we provide. Any changes will be posted on this page with an updated "Last updated" date at the top.
Where significant changes are made, we will take reasonable steps to notify you, such as displaying a notice on our website or sending an email to subscribers. We encourage you to review this page periodically.
Contact Us
If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have a concern about how we handle your personal data, please contact us:
Minhaj Institute Walsall — Data Protection
Address: 49 Woodwards Road, Alumwell, Walsall WS2 9RJ, United Kingdom
Email: info@minhajinstitutewalsall.co.uk
Phone: 01922 612 010
We aim to respond to all data protection enquiries within 30 days.
