Privacy Policy

Bunyaan SCIO (Scottish charity number SC055377) is committed to protecting your privacy and that of the young people we work with. This policy explains what personal information we collect, why, and what rights you have over it.

1. Who We Are

Bunyaan SCIO is the data controller for the information described in this policy. Our registered details are available on the Scottish Charity Register at oscr.org.uk. For any question about this policy or your data, contact us at info@bunyaan.org.uk.

2. What Information We Collect

Depending on how you interact with us, we may collect:

• Booking information: the participant's name and age, and the parent or guardian's name, email address, and phone/WhatsApp number.
• Payment information: payments are processed by Stripe. We do not see or store your card details.
• Health and medical information: any allergies, medical conditions, or additional support needs you tell us about, so we can look after your child safely.
• Photography and video: only where you have given separate, specific consent.
• Communications: emails, WhatsApp messages, or other correspondence you send us.

This website does not use cookies or tracking scripts. Cloudflare, our hosting provider, processes standard technical data (such as IP addresses and request information) as part of delivering and securing the website. This data is handled under Cloudflare's own privacy policy, available at cloudflare.com/privacypolicy.

3. Why We Use Your Information

• To process and confirm your booking.
• To communicate with you about sessions, changes, or anything relevant to your child's participation.
• To keep your child safe during sessions, including responding to medical or safeguarding needs.
• To meet our legal obligations, including under Scotland's PVG scheme and OSCR's charity regulations.
• Where you've agreed, to tell you about future Bunyaan sessions, events, or ways to get involved.

4. Our Legal Basis for Using Your Information

• Contract: processing your booking and delivering the session you've paid for.
• Consent: photography/video use, and any marketing communications, both of which you can withdraw at any time.
• Legal obligation: safeguarding requirements and charity regulation.

5. Who We Share Your Information With

• Stripe, to process payments securely.
• Microsoft, whose services (email, forms) we use to communicate with you and store booking information.
• Statutory bodies such as Disclosure Scotland or OSCR, where we are legally required to.

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

6. How Long We Keep Your Information

• Booking and contact information: retained for 12 months after the session, to handle any follow-up queries.
• Allergy and medical information: deleted 6 months after the session, unless there is an ongoing safeguarding reason to retain it longer.
• Photography/video consent: held until you withdraw it.

7. Children's Information

Much of the information we hold relates to children and young people. We collect this with the consent of a parent or guardian at the time of booking, and we take extra care to keep it secure and to use it only for the purposes described in this policy.

8. Your Rights

Under UK GDPR, you have the right to:

• Ask what personal information we hold about you or your child.
• Ask us to correct inaccurate information.
• Ask us to delete your information, where we're not legally required to keep it.
• Withdraw consent (for photography or marketing) at any time.
• Complain to the Information Commissioner's Office (ico.org.uk) if you're unhappy with how we've handled your data.

To exercise any of these rights, contact us at info@bunyaan.org.uk.

9. Changes to This Policy

We may update this policy from time to time. The current version will always be available at bunyaan.org.uk/privacy.