How the association handles your data.

Who we are

The Northgate Alumni Association ("the association", "we") is the data controller for the personal data described in this policy. The association is administered from Manchester, United Kingdom; correspondence to the registered office reaches the Secretary.

What we collect

We collect only what we need to operate the register of members and to convene the association. Specifically:

• Identity — full name and the years you attended, so we can list you in the register.
• Contact — email address, and optionally a postal address and phone number, so we can reach you.
• Membership — the tier you hold, the dates of your subscription, and any bursary status.
• Directory profile — any additional fields you choose to add (bio, city, employer, links). Each field carries its own visibility setting.
• Consent — a record of the version of this policy you agreed to, and when.

How we use it

To operate the register; to send you notices and administrative email; to organise events and appeals you have chosen to be told about; to publish the members' directory to signed-in members. We do not use your data for advertising and we do not build behavioural profiles.

Lawful basis

We rely on legitimate interests for the operation of the register — a member of an alumni association reasonably expects the association to hold their contact details for that purpose. For all optional communications and for any special-category data, we rely on your consent, recorded against the version of this policy in force at the time.

Who can see it

The public directory is limited to fields you have marked public. Signed-in members can see fields you have marked members-only. Fields marked private are visible only to you and to a small number of committee members with a legitimate administrative need. We do not sell or rent personal data, and we never share it with advertisers.

Retention

We keep your data for as long as you are a member and for two years thereafter, to support gift-aid administration and audit. If you request erasure, we act within thirty days.

Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict processing of, and port your personal data, and to object to processing carried out on the basis of legitimate interests. Every one of these is exercisable from your account page or by writing to the data-protection inbox.

• Access — one-click export from your profile.
• Rectify — every field you submitted is editable by you.
• Erasure — one-click deletion; thirty-day purge.

GDPR contact

Data-protection requests reach two trustees who are not on the committee, so a request the committee cannot resolve has somewhere else to go. Write to privacy@example.com.

Changes to this policy

A material change bumps the version above and, on next sign-in, asks every member to accept the updated policy. The previous versions are archived and available on request.