Privacy

Sutton Coldfield Muslim Association runs this website and the masjid on Anchorage Road. We are a charity registered in England and Wales, number 1198049.

The form asks for your name, your phone number, your email address, what your message is about, and the message itself.

We use those to read what you sent and answer it. We do not use them for anything else, and we never sell them or pass them to anyone for marketing.

Sending the form does two things. It saves your enquiry on our database, and it emails the masjid to say someone has written in. That email carries your name, your email address and your subject. Your phone number and the words of your message stay on the database, where the volunteer answering you reads them.

You get an email back confirming your message arrived. It repeats nothing you wrote.

The contact form runs Cloudflare Turnstile, which tells a real person apart from a bot. It works in the background and never asks you to click anything.

Turnstile loads the moment you open the contact page, so Cloudflare sees your browser and your IP address whether or not you go on to send the form. Cloudflare handles that under its Turnstile Privacy Addendum.

If you reach the form from one of our service pages, your subject travels in the web address, like /contact?subject=Janazah. That address is kept in your own browser history and in our host’s server logs. No other company sees it.

If you would rather it did not appear there, open the contact page on its own and choose the subject yourself.

Some of the subjects on the form say something personal about you. Choosing Shahada, Nikkah, Janazah or Membership tells us something about your faith or your family, and the law treats that as sensitive.

Detail like that needs clearer permission than a name and a phone number. The box you tick on the form is that permission, and it points at this page.

The sensitive part is the subject you chose and whatever you wrote about it. We ask for nothing more, and we use it to answer you. Change your mind at any point and we will delete it.

The Nikkah request form asks for more than the contact form does. We need the names, dates of birth, addresses, phone numbers and email addresses of both the bride and groom, the religion of each of you, whether the bride has been married before, the agreed Mahr and the date you would like.

The religion of both of you is sensitive under the law, and so is the rest of it taken together. The box you tick on the form is your permission, and it points at this page.

Only the team arranging your Nikkah can see the request. It does not go to everyone who works on the site.

We keep the record after the ceremony, because couples and families ask us years later to confirm a marriage took place. If you want us to remove it, get in touch.

We ask for your child’s first name, last name and date of birth, and for anything the youth team needs to keep them safe on the night: allergies, any medical condition, and anything else you want us to know.

We ask for your name, how you are related to your child, your phone number and your email address, and you can add a second parent or guardian. We take your home address, and the name and phone number of someone to ring if we cannot reach you.

We record the date you applied and whether your child has a place, is waiting for one, or has left. The youth lead can add a note to your child’s record or your family’s.

We use all of it to run the group: to know who is coming on a Friday, to ring you if your child is unwell, and to know what to do if they have an allergy.

One volunteer sees this. The person who runs the youth group holds the only account that can open these records. An admin with every other part of the site open to them sees nothing here.

Your child’s medical detail is sensitive under the law, and it needs clearer permission than a name and a phone number. The box you tick on the form is that permission, and it points at this page. If the youth lead filled the form in for you, they tick it to confirm you agreed.

We keep your child’s record for six years after they leave the group, the same period a charity keeps its financial records. If you want it removed sooner, get in touch.

The monthly fee goes through Stripe. Your card number goes to Stripe and never reaches us.

We keep your subscription with Stripe, how many places it pays for, whether it is running, and the billing address Stripe passes back.

When the youth lead opens your family’s record, we read your payment history from Stripe and show it on screen: your next payment date, what you have paid in total, your last few payments with their dates and amounts, and whether each one went through. The screen also shows the type of your card and its last four digits, which is what Stripe prints on its own receipts. We store none of it. We read it from Stripe each time and keep no copy.

If you need to change your card, we send you a link to Stripe’s own page. You type the new card there and we never see it.

Card payments go through Stripe. Your card number goes to Stripe and never reaches us.

Stripe passes back your name, your email address and your billing address. We keep those with a record of what you gave, when, and which fund it went to. If you leave a note with your donation, we keep that as well.

We email you a receipt for your donation.

You can read Stripe’s privacy notice on their own site.

Ticking Gift Aid tells us you pay UK tax and that HMRC can add 25p to every pound you give. We save the wording you agreed to and the date you agreed it, because HMRC can ask us to show it.

To make the claim, the masjid sends HMRC your first name, your surname, your house name or number, your postcode, the amount and the date.

Our database sits with Supabase, on servers in Ireland. The website runs on Vercel. Our email goes out through Resend.

So the companies that handle any part of your details are:

• Supabase, which stores them
• Vercel, which runs the site and keeps short server logs holding your IP address
• Resend, which sends our email
• Cloudflare, for the security check on the contact form
• Stripe, if you give money or pay for a youth group place
• HMRC, if you claim Gift Aid

There is nobody else. We run no advertising, no analytics and no tracking of any kind on this site.

You give us your details by choosing to write to us or to give, and you tick a box on the form to say so. That tick is what we rely on for an enquiry, and you can take it back whenever you like.

For a donation we rely on the records a charity has to keep. HMRC and the Charity Commission can both ask us to show what we received.

We keep an enquiry for as long as the masjid has a use for it, and we look through what we hold from time to time. There is no fixed date.

We keep donation records for six years after the end of the financial year they fall in, because HMRC and the Charity Commission can both ask to see them.

We keep a Nikkah request rather than clearing it on a timer, for the reason above: people ask us years later to confirm a marriage took place.

We keep a child’s youth group record for six years after they leave.

Three parts of this site store something in your browser, and each one has a job to do:

• Cloudflare’s security check on the contact form, telling a real person from a bot
• Stripe, once a donation reaches the payment step, spotting card fraud
• The masjid’s own admin area, keeping a volunteer signed in. You need an account to meet that one

Nothing else on the site stores anything. All three are needed for what you are doing, so this site has no cookie banner.

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. You can ask us to stop using it.

Write to us through the contact form or by post at the address above. We will answer within a month.

If you are unhappy with how we have handled your details, you can complain to the Information Commissioner’s Office.