Privacy notice
How LCB Manchester collects, uses and protects your personal information.
1. Who we are
LCB Manchester, also known as Language and Culture of Bangladesh, is a registered charity in Greater Manchester, England. Our registered charity number is [CHARITY NUMBER]. We have operated since 2010.
Our registered address is 2 Earl Walk, Manchester M12 4HL. Our website is www.lcbmcr.co.uk. You can reach us on info@lcbmcr.co.uk.
We are the data controller for the personal information described in this notice. That means we decide why your personal information is used and how it is used.
We are a charity that handles personal information for our own members and supporters. Where our processing is only what our charitable purposes require, we do not need to pay to register with the Information Commissioner's Office. If we are registered, our registration number is [ICO REGISTRATION NUMBER]. Either way you can reach our data protection contact and ask any question about your information, and you can complain to the Information Commissioner's Office at any time.
We are not a regulated professional adviser. Nothing on this website is legal, medical, financial, immigration or welfare advice.
Our data protection contact is [TRUSTEE CONTACT]. Write to that contact at the registered address above, or email info@lcbmcr.co.uk with the subject line "Data protection request".
2. Information we collect and where it comes from
Information you give us
- Contact enquiries. The form on our contact page opens your own email application. It does not send anything to our server, it is not stored in a database on this website, and it does not set a cookie. We receive your message as an email in our mailbox, along with whatever contact details your email application includes.
- The contact box on the Donate button. When you press the Donate button on this website, it opens a small box where you choose how you want to contact us. If you choose email, your own email application opens and writes to info@lcbmcr.co.uk, exactly as the contact page does, so nothing is sent to our server and nothing is stored on this website. If you choose WhatsApp, a WhatsApp page opens in a new tab and your message travels through WhatsApp. Either way, we hold the message you send and the contact details you choose to give us.
- Membership. If you join, we hold your full name, a unique membership number in the form LCBMCR-YYYY-MM-NNNN, a membership photograph, a short internal note, your contact details, the amount and status of any membership fee, and a record of your consent for the photograph. See section 4 for how we handle the photograph.
- Donations and events. We hold the name, amount, date and any contact details you give us for a donation, a membership payment, a Gift Aid declaration, or an event booking. This website does not take payments or sell tickets itself, so those records come to us by email, by message or in person.
- Messages. We hold the content of emails, letters, telephone calls and messages you send us, along with your contact details.
Information we create
- Your membership number, and the internal note we keep about your membership.
- Records of the fees, donations and tickets you have paid for, and of any refund we have given.
- Records of the consent you have given us, with the date and the version of the form you signed.
- A cache of Community Live Hub headlines, stored in your own browser for 24 hours so the Hub can be shown without asking a third party again. It holds headlines only and nothing about you. See our cookie notice.
Information collected automatically
- Server logs. Our hosting provider keeps standard web server logs, such as the IP address, the time of the request, the page requested and the browser type. We use these to keep the site running, to investigate misuse and to defend LCB Manchester. We do not use them for analytics or marketing, and we do not use them to build a profile of you.
- Admin access logs. When a signed-in administrator uses the admin panel, we record the time, the administrator account used and whether the sign-in succeeded, so that we can investigate any unauthorised access.
Information we do not collect
We do not use analytics, advertising, tracking pixels, social media embeds or cross-site profiling. We do not collect special category data about visitors. The only special category data we hold is the membership photograph described in section 4, and the safeguarding records described in section 3.
3. Why we use your information and our lawful basis
The UK GDPR requires us to have a lawful basis for each use of your personal information. We rely on the bases below.
| What we use it for | Information used | Lawful basis |
|---|---|---|
| Running the website and keeping it secure | Server logs, admin access logs | Legitimate interests under Article 6(1)(f), so that we can keep the site available, investigate misuse and defend LCB Manchester |
| Answering enquiries and dealing with you | Contact details and the content of your message | Legitimate interests under Article 6(1)(f), and where the enquiry leads to a membership or donation, steps taken at your request before entering into a contract under Article 6(1)(b) |
| Administering your membership | Name, membership number, contact details, photograph, fee and payment record | Performance of a contract under Article 6(1)(b), and the legal duty to keep accounting records under Article 6(1)(c) |
| Keeping accounting, tax and Gift Aid records | Donation, membership and event income records and Gift Aid declarations | Legal obligation under Article 6(1)(c), under the Charities Act 2011 and tax law |
| Taking and holding your membership photograph | Member photograph | Consent under Article 6(1)(a), with explicit consent under Article 9(2)(a) for special category data. See section 4 |
| Keeping safeguarding records | Records of a concern about a child or an adult at risk | Legal obligation under Article 6(1)(c) and substantial public interest under Article 6(1)(d), with Article 9(2)(g) where personal data concerning health is involved |
| Sending you updates about our work, programmes and events | Name and email address | Consent under Article 6(1)(a), or legitimate interests under Article 6(1)(f) where you have asked us to keep in touch about our work. You can stop these messages at any time |
| Identifying and supporting our volunteers | Contact details, role, and where a role requires it, a Disclosure and Barring Service check outcome | Legal obligation under Article 6(1)(c) and legitimate interests under Article 6(1)(f) |
Where we rely on legitimate interests, we have considered your rights and ours, and we have kept the use of your information to what is necessary. You can ask us to stop, or to tell you more about the balance we have struck, at any time.
4. Membership photographs and special category data
A photograph of a person can show racial or ethnic origin. Under Article 9 of the UK GDPR that is special category data, and we may only use it where an Article 9 condition applies and we have met that condition.
The condition we rely on
We rely on your explicit consent under Article 9(2)(a). We do not rely on any other condition for membership photographs.
How consent is given and recorded
- Photograph consent is requested on a separate line of the membership application. It is not pre-ticked, and it is not covered by the general membership agreement.
- We record the fact that you consented, the date, and the version of the form you signed. We do not treat a signature on the membership form alone as consent for your photograph.
- Consent must be freely given. You can join and take part in our work without agreeing to a photograph, and you can withdraw that consent later without losing your membership or any other benefit.
How the photographs are taken
An administrator takes the photograph with a phone camera at an activity, or you upload one from your device. A membership photograph is not a passport photograph. It is not an identity document, and we do not check or verify it as proof of identity, nationality, age or address.
Where the photographs are kept and shown
Photographs are kept in a private folder that our web server refuses to serve. They are visible only to the signed-in administrator, and to you on the membership card that we print or display for you.
Our admin panel can save your membership card as a picture file. If you ask us to send you that file, for example on WhatsApp or by email, we will do it using the service you ask for. That service will then handle your photograph and your name under its own privacy terms, and the copy stays wherever you choose to keep it. Please do not send your card to anyone you do not trust, because it carries your photograph and your membership number.
Where the photographs are not used
We do not publish membership photographs on this website, and we do not use them in fundraising, publicity, press material, partner material or social media, unless you give us separate, specific consent for that particular use. That consent must be in writing or sent by email, and it must name the use. Accepting the membership application does not include it.
Withdrawing your consent
- You can withdraw consent at any time by emailing info@lcbmcr.co.uk. There is no charge and we do not ask why.
- When you withdraw consent we delete the photograph from the private store, withdraw the membership card and stop all further use of the photograph without delay. We will confirm to you when this is done.
- Withdrawal is not retrospective, so processing we carried out lawfully before you withdrew consent remains lawful. From the point of withdrawal we stop using the photograph and we delete it.
- Where the law means we must keep the membership record itself, for example the accounting records, we keep the record without the photograph.
5. Profiling and automated decision making
We do not carry out profiling and we do not use automated decision making. No decision is made about you using your personal information alone, and no decision has legal or a similarly significant effect on you.
If we ever want to use profiling or automated decision making, we will explain it here first. Where the law requires your consent, we will ask for it before we start.
6. Who we share your information with
We share your personal information only for the reasons set out below. We do not sell personal information. We do not share it for marketing, and we do not pass it to anyone for their own commercial use.
- Our hosting provider. InterServer provides our cPanel hosting and runs the Apache web server that holds the website and the member records. It processes information on our instructions under a written contract.
- Our bank and any payment service you choose to use. This website does not take card payments itself. If you pay us by bank transfer, the information reaches your bank and ours, and we keep the payment record needed for our accounts. If you choose to pay through a payment service, that service acts as its own controller for the card details it collects. We never receive or store your card number.
- Our email provider. Our email provider carries our email account and the messages you send to us.
- WhatsApp, only if you choose it. If you choose WhatsApp from the contact box on this website, your browser opens a WhatsApp page in a new tab and the message goes through WhatsApp, which handles it under its own privacy terms. Nothing is sent to WhatsApp unless you press that button, and this website sets no WhatsApp cookie of its own.
- Google. If you accept cookies, the site asks Google for the font files (Cormorant Garamond, Inter and Noto Sans Bengali). Your browser sends your IP address and technical details to Google when it does this. Google acts as its own controller for that transfer. We do not use any other Google service on this site. In particular we do not load Google favicons, maps, videos or analytics, and the small letter badge shown beside each Live Hub headline is drawn on your own screen rather than loaded from anywhere.
- A public RSS proxy service. If you accept cookies, the site asks a public RSS proxy service to fetch public RSS and Atom feeds so that the Community Live Hub can show headlines. The proxy service and the publishers receive the request. We do not send them any information about you.
- Partner and community organisations. Where you ask to take part in an event or activity with another partner organisation, we share only what that activity needs.
- Our trustees, administrator and volunteers. Access is limited to the people who need it for their role, and everyone is bound by a duty of confidentiality, by these terms and by our safeguarding policy.
- Regulators and public bodies. We may disclose information to the Charity Commission, to HM Revenue and Customs, and to any other regulator we are required to report to.
- Law enforcement and courts. We disclose information where we are legally required to do so, where a court orders it, and where it is necessary to protect children, vulnerable adults or other people from harm.
We do not provide lists of members, photographs or contact details to partners, sponsors or the media.
7. International transfers
Most of the information we hold is processed in the United Kingdom. Some of our providers may process information outside the UK, for example where an email or hosting provider stores mail or backups in another country.
Where information is transferred outside the UK, we make sure the transfer is covered by an adequacy regulation for the country concerned, or by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. We carry out a transfer risk assessment for each of those transfers and we put in place any additional measures the assessment shows we need. Where a provider offers a choice of UK storage, we choose UK storage.
When you accept cookies, the requests to Google Fonts and to the RSS proxy service go to those providers' own servers at that moment, and each provider acts as its own controller for that request. If you decline cookies, no request of either kind is made at all.
8. How long we keep your information
| Record | How long we keep it |
|---|---|
| Enquiries and correspondence | 24 months from the last message, then deleted |
| Membership record (name, membership number, contact details, fee record) | For the length of your membership and 6 years after your last renewal, so that we can meet our accounting and tax duties and defend any claim |
| Membership photograph | For as long as we keep the membership record, unless you withdraw consent, when we delete the photograph without delay and record the withdrawal |
| Internal membership note | For the length of the membership record |
| Donation, membership payment and Gift Aid records | 6 years from the end of the financial year they relate to |
| Event booking and ticket records | 6 years, as part of our accounting records |
| Safeguarding records | For the period set out in our safeguarding policy and the guidance that applies to the activity. These records are kept separately from your membership record. |
| Server logs | For as long as our hosting provider keeps them for security and legal reasons. We ask for them to be deleted within 12 months. |
| Admin access logs | The most recent 2,000 entries, after which the oldest are removed automatically |
| Community Live Hub headline cache | 24 hours in your browser |
At the end of each period we delete the record, or we delete it in an anonymised form so that it can no longer be linked to you.
9. How we protect your information
- This website is served over an encrypted connection, so the information travelling between your browser and our server is protected in transit. Please tell us if you ever see the site being served without that protection.
- Member records and membership photographs are stored in a private folder that our web server refuses to serve. The files cannot be reached by typing an address into a browser and are not indexed by search engines.
- The admin panel has a single administrator account, protected by a password that is not shared. Only that administrator and the trustees can reach the member records.
- The panel signs an administrator out by itself after 60 minutes of inactivity, and it locks the sign in after repeated wrong passwords from the same address.
- This website does not take card payments, so we never receive or store your card number. If you pay us by bank transfer we keep only the payment record our accounts need.
- Every photograph consent, and every withdrawal of one, is written into the panel's own audit log with the date, so the record of your consent survives even if a member record is deleted.
- Access to your information is limited to the people who need it for their role, and volunteers do not see member personal data unless their role requires it.
- We review who can reach the admin panel and we remove access when it is no longer needed.
No system is completely secure. If a personal data breach happens that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours where the law requires it, and we will tell affected members where that is appropriate.
10. Your rights
You have the right to:
- Ask for a copy of the personal information we hold about you (access).
- Ask us to correct it if it is wrong or incomplete (rectification).
- Ask us to delete it where we no longer need it (erasure).
- Ask us to pause the use of it while a dispute is resolved (restriction).
- Receive it in a portable format and pass it to another organisation (portability).
- Object to a use we have based on legitimate interests, and to direct marketing at you.
- Withdraw your consent at any time where we are relying on consent. See section 4 for membership photographs.
- Not be subject to a decision made by automated means alone.
- Complain to the Information Commissioner's Office.
To use any of these rights, email info@lcbmcr.co.uk with the subject line "Data protection request", or write to us at 2 Earl Walk, Manchester M12 4HL. We do not charge. If we are not sure who you are, we may ask for some identification, and we will tell you why. We usually respond within one month. If we need longer, we can take up to two months more, and we will tell you within the first month and explain why.
You can complain to the Information Commissioner's Office at any time, without needing our permission. The Information Commissioner's Office can be contacted at www.ico.org.uk or on 0303 123 1113.
11. Children and young people
We do not knowingly collect personal information from anyone under 16 through this website, and we do not use the website to gather information from children. If you are under 16 and you would like to take part in our work, please ask a parent or guardian to contact us.
Our activities include children and vulnerable adults, so our safeguarding policies apply. We do not publish information about children. Photographs of children are only taken and used with the consent of the appropriate adult, and they are handled under our safeguarding policy rather than under this website.
12. Complaints
If you are unhappy with how we have handled your personal information, please tell us first. Email info@lcbmcr.co.uk or write to us at 2 Earl Walk, Manchester M12 4HL. We aim to acknowledge a complaint within 10 working days and to resolve it within 8 weeks. If you are not satisfied with our response, you can complain to the Information Commissioner's Office as set out in section 10.
13. Changes to this notice
We review this notice regularly and we update it when the way we use your information changes. The date at the foot of this page shows when it was last updated. If we make a change that affects you, we will tell you by email or by putting a notice on this website. The version published on this page is the version that applies.
14. Cookies
This website uses a small number of cookies and similar technologies, and nothing more. There is no analytics, no advertising and no tracking. Read our cookie notice for the full list, for what happens if you say no, and for how to change your choice.
15. How to contact us
- LCB Manchester, also known as Language and Culture of Bangladesh
- Registered address: 2 Earl Walk, Manchester M12 4HL
- Email: info@lcbmcr.co.uk
- Website: www.lcbmcr.co.uk
- Registered charity number: [CHARITY NUMBER]
- Information Commissioner's Office registration number: [ICO REGISTRATION NUMBER]
- Data protection contact: [TRUSTEE CONTACT]
Our terms of use for this website are published on the Terms and Conditions page. Where we refer to those terms in this notice and in our cookie notice, we call them "these terms".
Last updated 6 November 2026