Privacy Policy

1. The personal data we collect

Information you give us

• Account data — when you register or sign in: your email address and password (stored in encrypted/hashed form by our authentication provider), the date you accepted these policies, and your profile type (individual or organisation).
• Profile data — display name, optional bio, and (for organisation profiles) organisation name, description, contact email, address, website, and logo submitted for verification.
• Event submissions — when you submit an event for listing: organiser name, contact email, event details, images, and text you provide, linked to your account so you can manage your listings in your profile.
• RSVPs — when you RSVP to an event: your name and email address (taken from your account if you are signed in, or provided in the RSVP form if you are not).
• Organisation follows — when you are signed in and follow an organisation, we store which organisation pages you follow so we can show your preferences on your device.
• Enquiries — if you email us at privacy@gatherummah.com, we receive whatever information you choose to include in your message.

Information we collect automatically

• Server and security logs — our hosting provider may record technical data such as IP address, browser type, pages requested, and approximate timing of requests to keep the Platform secure and reliable.
• Cookies and similar technologies — see Section 7.

We do not intentionally collect special category data (such as data revealing religious beliefs). By its nature, Gather Ummah lists Islamic community events; if you choose to submit or RSVP to such events, you do so voluntarily and on the understanding set out in this policy.

We do not currently run third-party analytics (such as Google Analytics) on the Platform.

2. How and why we use your data (and our lawful bases)

If you subscribe to our optional email updates on the homepage, we use your email to send occasional highlights about events on Gather Ummah. You can unsubscribe from those emails at any time. This is separate from organiser emails when you opt in at RSVP.

Where we rely on legitimate interests, we have considered your rights and only rely on this basis where our interest is not overridden by your interests. You can object to this processing at any time (see Section 6).

3. When your data is shared with event organisers

Gather Ummah is a listings platform. Events are run by third-party organisers, not by us.

When you RSVP to an event, we store your name and email so we can record your attendance and prevent duplicate RSVPs. Organisers and other visitors can see only the total RSVP count and attendee names on the event listing — not email addresses.

If you opt in while RSVPing, we share your name and email with that event's organiser so they can email you about their future events through Gather Ummah. You can unsubscribe from an organiser's emails at any time using the link in each message. We do not sell your data.

If you do not opt in, organisers cannot see your email address.

When you submit an event, the organiser name and contact email you provide are displayed on the published listing so attendees can contact the organiser directly about that event.

4. Other parties we share data with

We share personal data with:

• Service providers who help us run the Platform, acting as our processors under appropriate agreements and only on our instructions.
• Authorities and advisers where we are required to by law, or to establish, exercise, or defend legal claims.
• A successor organisation if the Platform is transferred, in which case we will let you know.

We do not sell your personal data.

Our key processors currently include:

• Supabase — database, authentication, and image storage (hosted in the EU, London region)
• Vercel — website hosting and content delivery
• Resend — transactional email to site administrators when events are submitted (where configured)
• Google — web fonts served from Google's servers; embedded maps on some event pages; and site ownership verification for Google Search Console (not used to track individual visitors on our site)

5. International transfers

Your account, event, and RSVP data are primarily stored in the United Kingdom / European Economic Area through our database provider.

Some of our other processors (for example, our hosting or email providers) may store or process data outside the UK. Where they do, we make sure appropriate safeguards are in place — such as the UK government's adequacy regulations, or the International Data Transfer Agreement (IDTA) / UK Addendum to the EU Standard Contractual Clauses — so your data receives an equivalent level of protection.

6. Your rights

Under UK data protection law you have the right to:

• be informed about how we use your data (this policy);
• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data ("right to be forgotten") in certain circumstances;
• restrict our processing in certain circumstances;
• object to processing based on legitimate interests, and to direct marketing at any time;
• data portability — receive certain data in a portable format;
• withdraw consent at any time where we rely on consent; and
• not be subject to solely automated decisions with legal or similarly significant effects (we do not carry these out).

To exercise any right, email privacy@gatherummah.com. We will respond within one month. Exercising your rights is free unless a request is manifestly unfounded or excessive.

If you are unhappy with how we handle your data, you can complain to us first. You also have the right to complain to the Information Commissioner's Office (ICO) — ico.org.uk, helpline 0303 123 1113.

7. Cookies and similar technologies

We use cookies and similar technologies to make the Platform work.

• Essential cookies keep you signed in and maintain your session with our authentication provider. These are necessary for the Platform to function and do not require consent.
• Local storage may be used on your device to remember organisation follow preferences before or without signing in.
• Third-party content — some pages load resources from Google (fonts and, on certain event pages, embedded maps). Google may process technical data according to its own privacy policy. We do not currently use analytics or advertising cookies.

You can control cookies through your browser settings. Blocking essential cookies may prevent you from staying signed in.

8. How long we keep your data

We may keep some data longer where the law requires it or to defend legal claims.

9. Security

We take reasonable technical and organisational measures to protect your data — including encryption in transit (HTTPS), access controls, hashed passwords handled by our authentication provider, and restricting access to those who need it. No system is completely secure, but we work to protect your information and to respond appropriately if something goes wrong.

10. Children

The Platform is intended for adults. We do not knowingly collect personal data from children under 16 through accounts, submissions, or RSVPs. Some listed events are aimed at children and families — those are organised by third parties, and parents or guardians are responsible for supervising children's attendance and any details shared with organisers directly. If you believe a child has given us personal data, contact us at privacy@gatherummah.com and we will delete it.

11. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new "Last updated" date, and highlight significant changes where appropriate.