Privacy Policy

BLACK AND PROUD CIC – PRIVACY NOTICE 

(Effective from 21 June 2025 – replaces all previous versions) 

​

1. Purpose of this notice 

​

This privacy notice explains how Black and Proud CIC (“Black and Proud”, “we”, “our” or “us”) collects, uses, stores, shares and protects your personal information when you visit www.blackandproud.io, interact with us on social media, become a member, take part in our programmes or otherwise engage with our Community Interest Company. It also sets out your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and how you may exercise them. 

​

2. Who we are (Data Controller) 

​

Legal entity: Black and Proud CIC (company number – 15463847 available on Companies House) 

Registered office: Nottingham One, Canal St, Nottingham, NG1 7HP, United Kingdom 

Email (privacy queries): info@blackandproud.io 

Telephone: +447886641874 

 

We are the “controller” of the personal information described in this notice, meaning we decide why and how it is processed. 

​

3. What information we collect 

​

· Identity & contact data: Name, postal address, email, phone, social‑media handle, date of birth. 

· Membership & programme data: Demographic details, event attendance, feedback forms, dietary or accessibility requirements. 

· Special‑category data: Information that reveals racial or ethnic origin or other protected data (e.g. health or disability information). Collected only with explicit consent. 

· Technical & usage data: IP address, device identifiers, browser type, pages visited, referring URLs, timestamps. 

· Marketing preferences: Opt‑in/opt‑out records, cookie consent records. 

· Social‑media data: Public profile information, “likes”, messages, shared content via integrated platforms (Google, Facebook, Instagram, X, LinkedIn, YouTube, Tiktok e.t.c.). 

Special‑category data is afforded additional safeguards under Article 9 UK GDPR. We do not require you to provide it; if you choose to do so, we will request explicit consent and apply suitable policy controls. 

 

4. Cookies and similar technologies 

​

Our site uses strictly‑necessary cookies to operate, plus optional analytics and personalisation cookies. Under the Privacy and Electronic Communications Regulations (PECR) we ask for your consent before setting any non‑essential cookies. You can manage or withdraw consent at any time via us on‑site cookie banner or your browser settings. 

​

5. Our lawful bases for processing 

​

· Consent (Art 6 (1)(a)): Sending you email newsletters or processing special‑category data. 

· Contract (Art 6 (1)(b)): Providing membership benefits or fulfilling event bookings. 

· Legal obligation (Art 6 (1)(c)): Accounting, tax and CIC regulatory duties. 

· Legitimate interests (Art 6 (1)(f)): Securing our website, developing services, limited direct marketing to existing supporters. 

Where we rely on legitimate interests, we balance our interests against your rights and reasonable expectations. You can object at any time (see Section 11). 

​

6. How we use your information 

​

· Operate and improve our website, events and programmes. 

· Administer memberships and donations, including Gift Aid records. 

· Communicate with you about community initiatives, advocacy campaigns, surveys and opportunities you have asked to hear about. 

· Deliver targeted digital content on social media platforms you use. 

· Keep our services secure, detect fraud and enforce our terms. 

· Comply with law, resolve disputes and respond to lawful requests. 

We never sell your data. Automated decision‑making is not used to produce legal or similarly significant effects. 

​

7. Sharing your data

 

We share data only when necessary and subject to contractual safeguards with: 

· Service providers (e.g. cloud hosting, email, payment processors, event‑ticketing platforms). 

· Professional advisers (e.g. accountants, insurers, lawyers). 

· Regulators or law‑enforcement where required by law or to exercise/defend legal claims. 

· Successors to our CIC if we restructure or merge (you will be notified in advance). 

All processors act solely on our instructions and are bound to keep your data secure and confidential. 

​

8. International data transfers 

​

Some suppliers are located, or store data, outside the UK. When we transfer personal data internationally, we will rely on an adequacy regulation, International Data Transfer Agreement (IDTA) or Addendum to EU Standard Contractual Clauses, or another lawful mechanism and conduct transfer risk assessments where required. 

​

9. How long we keep your data 

​

We retain personal data only for as long as necessary, after which it is securely deleted or anonymised. Typical retention periods include: 

· Membership records: 6 years after last active year. 

· Financial/transaction data: 7 years (statutory limitation). 

· Cookie consent logs: 13 months. 

· Mailing‑list data: until you unsubscribe or we note inactivity for 24 months. 

We review retention schedules annually and document them internally. 

​

10. How we keep your data safe 

​

We apply industry‑standard administrative, technical and physical safeguards, including encryption in transit, pseudonymisation where feasible, access controls, staff training and incident‑response procedures. No internet transmission is ever guaranteed 100 % secure, but we continually assess and improve our defences. 

​

11. Your data‑protection rights 

​

· Access a copy of your data (Art 15). 

· Rectify inaccurate or incomplete data (Art 16). 

· Erase data (“right to be forgotten”, Art 17). 

· Restrict processing (Art 18). 

· Object to processing based on legitimate interests or direct marketing (Art 21). 

· Port data to another provider (Art 20). 

· Withdraw consent at any time for processing that relies on consent. 

· Complain to the ICO if you believe we have not handled your data lawfully (see Section 12). 

We will respond within one calendar month. Requests are free unless manifestly unfounded or excessive. 

​

12. How to complain 

​

Please email info@blackandproud.io or write to Data Privacy Lead, Black and Proud CIC, Nottingham One, Canal St, Nottingham, NG1 7HP. If you remain dissatisfied you have the right to complain to the Information Commissioner’s Office (ICO): 
Website: https://ico.org.uk/make-a-complaint/ 
Helpline: 0303 123 1113 (Mon–Fri, 9 am–5 pm) 
Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF 

​

13. Children 

​

Our services are not aimed at children under 13. We do not knowingly collect their personal data. Parents or guardians should contact us if they believe a child has provided data without consent so we can delete it. 

​

14. Changes to this notice 

​

We may update this notice to reflect changes in law or our practices. The latest version will always be posted at www.blackandproud.io/privacy-policy and, where appropriate, we will notify you by email or site banner. Previous versions are archived for reference. 

 

Version 1.0 – published 21 June 2025 

© Black and Proud CIC 2025. All rights reserved.