SHAF Privacy Policy

1. Who We Are The South Hams Arts Forum (SHAF) is an unincorporated association providing a forum for artists in the South Hams area of Devon. For the purposes of data protection law, we are the “Data Controller.” You can contact us at: communications@shaf.org.uk.

2. Data We Collect & Why

  • Name & Email: Collected to manage your membership and deliver our core services.
  • Postal Address: Collected to verify residency within our service area and as a backup contact method should your email fail.
  • Payment Information: Collected to process your initial and recurring subscription fees.
  • Technical Data: To protect our community from spam and unauthorized access, we collect technical data such as your IP address and browser type. 

3. Lawful Basis for Processing We process your data under the basis of Contractual Necessity. We require this information to fulfill our agreement to provide you with SHAF membership services.

4. Our Data Processors (Third Parties) We use highly secure third-party services to help run SHAF:

  • Stripe: Used to store payment methods and process transactions. SHAF does not store your full credit card details on our own servers. Stripe Privacy Policy.
  • Mailchimp: Used to deliver essential member communications. As these emails are a core part of our service, unsubscribing may result in the inability to receive the benefits you have paid for. Mailchimp Privacy Policy.
  • Security & Spam Prevention: We use automated tools to detect spam and protect the website from malicious activity. This may involve the processing of your IP address and site usage patterns to ensure the security of our members’ data. 

5. Data Retention We only keep your personal data for as long as you are an active member. Once you unsubscribe:

  • Your payment method is removed from Stripe.
  • We retain basic financial transaction records (Name, date, amount) for 6 years to comply with UK HMRC accounting requirements, after which they are deleted.

6. Your Rights Under UK GDPR, you have the right to:

  • Request a copy of the data we hold about you.
  • Request that we correct any inaccuracies.
  • Request that we delete your data (subject to our legal requirement to keep financial records).

Lodge a complaint with the Information Commissioner’s Office (ICO) if you are unhappy with how we handle your data.