Privacy Policy

Privacy Policy 

Effective Date: 10th September 2025 

1. Who we are 

We are The Langley Community Society Ltd. We are a Community Benefit Society registered with the Financial Conduct Authority (FCA) and operating under the model rules provided by the Plunkett Foundation. Our purpose is to operate and sustain a community-owned pub for the benefit of our local community. 

We are committed to protecting the privacy and personal data of our members, shareholders, pledgers, and fundraisers in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection laws. 

2. How to contact us 

If you have any questions about this privacy policy or how we handle your data, please contact us: 

Contact: Caroline Leaver (Chair) or Andrea Wright (Secretary) 

Email: savethedunny@gmail.com 

3. What information we collect 

We collect and process personal data necessary for the proper functioning and governance of the Society. This may include: 

From shareholders, pledgers and fundraisers 

• Full name 
• Contact details (address, email, phone number) 
• Amount invested and share certificate details 
• Bank account information (for dividend or interest payments, where applicable. 
• Bank/payment details (if donating or reimbursed) 

From websites and events 

• Cookies or IP addresses (if visiting our website) 
• Event attendance records (for governance, capacity planning, or access needs) 

4. How we use your data 

We will only use your personal data where the law allows us to. Most commonly, we use it for the following purposes: 

• Managing shareholder registers and fulfilling our obligations under the FCA registration 
• Administering pledges and fundraising campaigns 
• Communicating with you about Society activities, meetings, or relevant opportunities 
• Sending updates, invitations, and reports to members and stakeholders 
• Issuing share interest (if applicable) 
• Managing governance and regulatory reporting 
• Ensuring compliance with our legal obligations 

5. Legal basis for processing 

We process your data under one or more of the following legal bases: 

• Contractual necessity – to administer your shareholding or pledge 
• Legal obligation – to comply with FCA and financial regulations 
• Legitimate interest – to operate and develop the Society and keep members informed 
• Consent – where you have explicitly given us permission (e.g. for marketing communications) 

You may withdraw consent at any time where consent is the basis for processing. 

6. How we store and protect your data 

We store personal data securely; all data is electronic format only and is held securely on Microsoft SharePoint on a cloud-based server. We take reasonable steps to ensure it is protected from loss, misuse, or unauthorised access. This includes: 

• Secure cloud storage and password-protected files 
• Limiting access to personal data to authorised personnel 
• Regular data backups and software updates 

7. Data sharing 

We will not sell your personal information or share it with third parties for marketing. 

We may share your data with: 

• Plunkett Foundation (where support is being provided) 
• Our appointed accountants, legal advisors, or IT service providers 
• Regulatory bodies such as the FCA or HMRC, where required 
• Event organisers, in limited cases, where necessary for safety or planning 

All such third parties are contractually required to handle your data securely and only for the purpose intended. 

8. Data retention 

We keep your personal data only as long as necessary for our purposes, including: 

• Shareholder information: Retained for the duration of your shareholding and up to 7 years after withdrawal 
• Pledger and fundraising information: Retained until the end of the fundraising project, plus 3 years 
• Financial records: Retained for at least 7 years to meet HMRC requirements 

We will securely delete or anonymise data when it is no longer needed. 

9. Your data protection rights 

You have the following rights under the UK GDPR: 

• The right to access the personal data we hold about you 
• The right to request correction of inaccurate or incomplete data 
• The right to request erasure (“the right to be forgotten”) in certain circumstances 
• The right to restrict processing of your data 
• The right to object to processing based on legitimate interests 
• The right to data portability (in limited circumstances) 

You can exercise these rights by contacting us (see Section 2). 

If you are not satisfied with our handling of your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk. 

10. Changes to this policy 

We may update this privacy policy from time to time. When we do, we will post the updated version on our website and notify members by email or at general meetings. 

Last updated: September 2025