1. Who we are
The Kurdistan Solidarity Forum (KSF) is an independent, non-profit, non-partisan organisation based in London. KSF is the controller of the personal information described in this policy, and decisions about it are taken by our Management Committee.
We deal with all data protection matters by email. Contact us at info@ksf.org.uk with the subject line “Data protection”. A member of the Management Committee is responsible for data protection.
2. What we collect
We collect only what we need for each activity. Most of it comes directly from you.
| Activity | Information | Source |
|---|---|---|
| Membership | Name, date of birth (to confirm you are 18 or over), email address, town or postcode, a passport-size photo for your membership ID card, membership number, fee payments, and the areas you would like to contribute to | You, through our membership form |
| Organisation members | Organisation name and registration number; name and email address of its authorised representative | The organisation |
| Enquiries | Name, email address and your message | You, by email |
| Newsletter | Name, email address and contact preferences | You |
| Events and volunteering | Name, email address, role, attendance, and any access needs you choose to share | You |
| Donations | Name, email address, amount and date | You and our payment provider |
| Photos and video | Your image at our events (section 4) | Our media team |
| Website use | IP address, browser and device type, pages visited (section 5) | Our hosting provider's server logs |
| Suggestions | Your suggestion and the topic you choose; a separate protected record of the IP address, date and time, browser and device type, and approximate country, kept to prevent abuse | You, through our suggestions form |
Being a member or supporter of KSF can reveal your political opinions and may suggest your ethnic origin. The law treats this as special category data, and we protect it accordingly.
We do not ask for your phone number, religion, political party membership, immigration status or details of family members abroad. Required fields on our forms are needed to process your application; everything else is optional. We do not knowingly collect information from children through this website.
3. How we use it and our legal basis
| Purpose | Lawful basis | Special category condition |
|---|---|---|
| Running membership: the register, ID cards and fees | Contract (your membership) | Not-for-profit body with a political aim, processing about its members (UK GDPR Article 9(2)(d)) |
| Notices of meetings, elections and votes | Contract | Article 9(2)(d) |
| Newsletters and event invitations | Consent, which you can withdraw at any time | Article 9(2)(d) |
| Answering enquiries | Legitimate interests | Article 9(2)(d), where relevant |
| Organising events and delegations | Legitimate interests | Explicit consent for any access or health needs |
| Donations and tax records | Contract; legal obligation | Not applicable |
| Website security | Legitimate interests | Not applicable |
| Reading and acting on suggestions | Legitimate interests | Article 9(2)(d) for members and regular contacts; for others, your explicit consent when you send the form |
| Preventing and investigating abuse of the suggestions form | Legitimate interests; establishing or defending legal claims | Not applicable |
Article 9(2)(d) allows us to hold this information only about members, former members and people in regular contact with us, and only if we do not disclose it outside KSF without consent. We follow that rule strictly.
We never sell or rent your information, use it for advertising, or make automated decisions about you.
Your membership ID card has a QR code. Scanning it opens a page on our website confirming that the card is valid, with the name, photo, membership ID and dates shown on the card. The page cannot be found without the code on your card, and it stops working if the card is cancelled or replaced.
4. Photos and video at events
We record our events to report on our work. We know that being identified at a Kurdish rights demonstration can put people, or their families abroad, at risk, so:
- we announce when our media team is filming and how to opt out;
- if you wear the wristband or sticker we provide, or tell a steward, we will not publish recognisable images of you;
- we favour crowd shots and ask before publishing close-ups of individuals;
- we blur or remove images of you on request, within 7 days, from our website and our own social media accounts;
- we never publish images of children without written consent from a parent or guardian, and never name people without their agreement.
We cannot control photos taken by the public, journalists or other organisations at public events.
5. Cookies and website data
This website uses no analytics, advertising or tracking cookies, and loads nothing from other companies: our fonts and images are all served from our own website.
The only cookie is a strictly necessary security cookie (ksf_sid), set when you open the membership or suggestions form. It protects the form against misuse, contains no personal information and is deleted when you close your browser. Because it is strictly necessary, the law does not require your consent for it.
Our hosting provider keeps standard server logs, including IP addresses, for security. We do not use them to identify visitors.
6. Who can see it and who we share it with
Your personal information is only accessible to the members of the Management Committee who handle membership. It is not given to volunteers, other members or anyone else, and we never give membership lists to any government, political party or other organisation.
Our website is hosted by Cloudflare, Inc. and our email is provided by Google (Google Workspace). Both act only on our instructions and may process data in the United States. Both are certified under the UK Extension to the EU-US Data Privacy Framework, which UK law recognises as giving adequate protection. Membership applications sent through our website are stored in an encrypted Cloudflare database located in Western Europe. Our membership inbox receives only a notice that a new application has arrived, not your details.
Our WhatsApp Community runs on WhatsApp, a service of Meta. Joining it is optional and separate from membership. If you join, the Community’s administrators and, depending on your settings, other members can see your phone number and name. Meta’s own privacy policy applies to your use of WhatsApp.
We share information outside KSF only with your agreement (for example, attendee names that a venue requires in advance), when the law requires it, or when someone's life or safety is at serious risk.
7. How long we keep it and how we protect it
| Information | Kept for |
|---|---|
| Membership records | While you are a member, then 2 years |
| Unsuccessful applications | 6 months |
| Newsletter list | Until you unsubscribe |
| Enquiries | 2 years after the last contact |
| Event sign-ups | 12 months after the event |
| Donation and tax records | 6 years after the end of the financial year |
| Disciplinary or complaint records | 6 years after the matter is closed |
| Suggestions | 2 years |
| Suggestions abuse record (IP address and connection details) | 30 days, or until an abuse investigation is closed |
Every page of this website, including the membership form, is protected by an encrypted (HTTPS) connection. Membership applications are kept in an encrypted database. Only the named committee members who handle membership can open it, each signing in with their own account and a one-time code; every change is logged, and access ends when a committee member leaves their role. We report serious breaches to the ICO within 72 hours and tell you if you are at high risk.
8. Your rights and how to complain
You have the right to access, correct or delete your information; to restrict or object to how we use it; to move it to another organisation; and to withdraw consent at any time. Email us at info@ksf.org.uk. It is free, and we respond within one month.
If you are unhappy with how we have handled your information, email us first with the subject line “Data protection complaint”. We will acknowledge your complaint within 30 days, investigate it and tell you the outcome.
You can also complain to the Information Commissioner's Office, the UK regulator, at ico.org.uk/make-a-complaint.
We will post any changes to this policy on this page and tell members about significant changes by email.