Embedded Files
Privacy Policy
Bromley Lions Club CIO (“we”, “us”, “the club”) is committed to protecting your personal data and being open about how we use it. This Privacy Policy explains what information we collect, how we use it, how long we keep it, and your rights under UK data protection law.
We are a registered Lions club within Lions Clubs International (LCI). For the purposes of UK GDPR, Bromley Lions Club CIO is the Data Controller for the personal data we collect and use.
1. Contact details
Data Controller: Bromley Lions Club CIO
Address: 37 Sutherland Avenue, Biggin Hill, WESTERHAM, Kent, TN16 3HE
Email: contact@bromleylionsclub.org
Charity number: 1172827
Data Protection Lead: Dan Windust Email: bromleylions.dpo@gmail.com
Trustees oversee all data protection decisions and ensure compliance with UK GDPR, PECR, the Data Protection Act 2018, and DUAA 2025.
2. What personal data we collect and why
We collect different types of personal data depending on your relationship with the club.
A. Membership
Personal data collected:
Name, address, email, phone number
Date of birth
Emergency contact details
Photographs (e.g., ID cards)
Membership history
Donation history (if applicable)
Records of consent
Payment details (for membership fees)
Criminal offence data (DBS checks)
Health information (e.g., allergies, medical conditions)
Records of meetings and decisions
Why we collect it:
To administer membership
To issue ID cards
To manage volunteering
To ensure safety at events
To meet Lions governance requirements
To provide service/Lions updates
B. Supporters, quiz attendees, donors
Name and contact details
Email address (used for marketing only if you have opted in)
Gift Aid declarations
Payment information (processed securely by our payment provider)
Any messages or notes you include with your donation. We do not store full card details.
Records of consent (where appropriate)
Why we collect it:
To send optional updates about fundraising events, quizzes, social activities, newsletters
To invite supporters to future events
Marketing is only sent with consent (or soft opt‑in).
To process donations
To administer Gift Aid
To organise fundraising events e.g. quizzes
To meet legal and financial obligations
C. Welfare applicants
Contact details
Information about the request for help
Financial information (if needed to provide support)
Referrals from schools, social workers, or charities
Information about the request for help
Special category data (health, family circumstances, vulnerabilities)
Records of decisions
Why we collect it:
To assess welfare requests
To provide support
To maintain an audit trail
To ensure fairness and accountability
D. Photography and video
Personal data collected:
Photos and videos taken at events
Consent records
Why we collect it:
To promote club activities
To record events
To produce ID cards
We only use identifiable images with recorded consent (which can be withdrawn at any time)
E. Website and cookies
We use essential cookies and optional analytics cookies. See our Cookie Policy for details.
F. Children’s data
We occasionally work with children and young people through welfare referrals or community activities. When we collect personal data about anyone under 18, we:
· only collect the minimum information needed
· obtain information from a parent, guardian, referrer or responsible adult
· apply additional safeguards
· do not use children’s data for marketing
· delete it when it is no longer required
We treat children’s information with extra care and follow all relevant UK GDPR and safeguarding requirements.
G. Charter event attendees
Personal data collected:
Name
Contact details
Dietary requirements
Accessibility needs
Seating or table‑plan information
Any information you choose to provide when booking
Why we collect it:
To organise the Charter event
To create seating plans and manage attendance
To provide the hotel with the information they need for catering, accessibility and safety
To ensure the event runs smoothly
To communicate essential event information
3. Lawful bases for processing
Under UK GDPR, we must have a lawful basis for each type of processing.
A. Membership
Lawful basis:
Contract
Legitimate Interests (for governance and service communications)
Legitimate Interests justification: We process personal information to send essential service updates because people need timely information about activities they have signed up for, changes to events, welfare decisions, membership administration, and other operational matters. These communications are necessary for Bromley Lions to run safely and effectively. We use minimal data and apply safeguards to ensure any impact is low.
B. Donations, events, charter dinner, funding and fundraising
Lawful basis:
Consent for quiz and event marketing (or soft opt‑in for members) and for optional fundraising communications.
Legitimate Interests – for processing donations, Gift Aid, event administration and safety
Legitimate Interests justification: we process personal information to receive donations, secure funding, and organise fundraising activities because these are essential parts of Bromley Lions’ charitable purpose. Fundraising enables us to provide welfare support, run community projects, and deliver services that people expect from us. The processing is necessary because we cannot receive donations, claim Gift Aid, or organise fundraising events without using limited personal information. We minimise data, apply safeguards, and ensure any impact on individuals is low.
C. Welfare support
Lawful bases:
Legitimate Interests – for routine administration
Explicit Consent – for special category data
D. Photography
Consent
4. How we collect your information
We collect data:
Directly from you (membership forms, emails, welfare requests, event sign‑ups)
From referrers such as charities (usually anonymised unless consent is given)
Other Lions entities (membership administration only)
Welfare partners
5. Who we share information with
We only share the minimum data required.
A. Lions Clubs International (LCI) LCI is a separate Data Controller. We share only the minimum data required for membership administration. LCI uses this data under its own lawful bases and its own privacy policy.
B. District 105SE and MD105 Separate Data Controllers. They do not receive member data. If they need to communicate with members, Bromley Lions forwards the message.
Others we share personal information with
Others we share personal information with
Insurance companies, brokers and other intermediaries
Charities and voluntary organisations
Organisations we need to share information with for safeguarding reasons. We only share safeguarding information where required to protect individuals from harm, using the ‘vital interests’ lawful basis or other applicable exemptions
Legal bodies or authorities
Relevant regulatory authorities
External auditors or inspectors
Suppliers and service providers(e.g., ID card provider, cloud storage provider)
Welfare referrers schools, social workers, charities (and only with explicit consent)
Emergency services – where required
Hotel hosting the charter dinner. We only share what the hotel needs to deliver the event safely and effectively.
Other organisations and only with explicit consent or a Data Sharing Agreement.
We do not give these organisations permission to use your information for marketing unless you have explicitly agreed to this and they must not add you to any marketing lists without your consent.
6. International transfers
LCI is headquartered in the United States. Membership data entered into Lion Portal is transferred outside the UK.
There is no IDTA in place. LCI relies on its own safeguards under US law. We inform members of this before data is shared.
We therefore minimise what is shared, inform members of this risk and only transfer data required for membership administration.
7. How we store your data
We store data in club‑controlled email accounts, club Google Drive (restricted access) and password‑protected files
We take appropriate steps to keep your personal information secure. This includes:
Access controls – only trustees and authorised officers can access personal data, and only for their role.
Password protection – club email accounts, Google Drive folders and digital files are protected by strong passwords.
Restricted access – welfare information and special category data are stored in locked or access‑limited areas.
Secure systems – we use club‑controlled accounts rather than personal accounts wherever possible.
Minimisation – we only collect and store the information we need.
Regular reviews – we periodically check our systems and delete information that is no longer required.
8. How long we keep your data
Members
Membership records: 2 years after leaving (excluding statutory registers)
Statutory registers: permanent
Financial records: 6 years
Photos: until consent withdrawn
Supporters and quiz attendees
Email addresses: until you unsubscribe
Welfare applicants
Welfare log: 2 years
Financial records: 6 years
Special category data: deleted when no longer needed
Donations
Donation records: 6 years
Gift Aid declarations: 6 years
Emails
We delete once the matter is closed unless needed for audit/legal reasons. We regularly review email accounts and delete old correspondence.
9. Your rights - Lawful bases and data protection rights
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.
Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:
Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for.
Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
Your right to erasure - You have the right to ask us to delete your personal information.
Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.
Your right to object to processing - You have the right to object to the processing of your personal data. Read more about the right to object to processing.
Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time.
If you make a request, we must respond to you without undue delay and in any event within one month.
To make a data protection or rights request, please contact us using the contact details at the top of this notice.
10. How to complain
If you are concerned about how we use your data:
Email: bromleylions.dpo@gmail.com
Subject: Data Protection Concern
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint
11. Updates to this Privacy Policy
We update this policy when:
our systems or processes change
we introduce new tools
we change how we share data
new laws or guidance are issued
Cookie Policy
Bromley Lions CIO (“we”, “us”, “the club”) uses cookies on this website. Some cookies are essential for the site to function. Other cookies (analytics and Google preference cookies) require your consent.
This policy explains what cookies we use, why we use them, and how you can manage your choices.
1. What are cookies?
Cookies are small text files stored on your device when you visit a website. They help websites work, improve security, and provide information about how visitors use the site.
Under PECR and UK GDPR:
• essential cookies do not require consent
• non essential cookies (analytics, marketing, personalisation) require consent before they are set
2. Cookies we use
A. Strictly necessary cookies (no consent required)
These cookies are required for the website to function.
Examples include:
• session cookies
• security cookies
• Google Sites platform cookies
• cookie consent status cookie (records your choices)
These do not track you or identify you.
B. Analytics cookies (consent required)
We use Google Analytics to understand how visitors use our website. These cookies are:
Cookie Purpose Duration Domain
_ga Records a unique ID to analyse website usage 2 years .bromleylionsclub.org
ga# Distinguishes users; counts visits and sessions 2 years .bromleylionsclub.org
These cookies are not essential and will only be set if you click Accept.
C. Google preference cookies (consent required)
Google may set cookies when its services load (e.g., fonts, scripts, maps).
Cookie Purpose Duration Domain
NID Stores a unique ID to remember user preferences 182 days .google.com
This cookie is not essential and requires consent.
3. Cookie banner and consent
When you visit our website, you will see a cookie banner.
You can choose to:
• Accept all cookies
• Reject non essential cookies
• Manage cookie settings
We will not set analytics or preference cookies unless you consent.
You can change your choices at any time using the “Manage Cookies” link.
4. How to manage cookies
You can:
• change your cookie preferences using our banner
• block cookies through your browser settings
• delete cookies already stored on your device
Blocking essential cookies may affect how the website functions.
5. Changes to this policy
We will update this policy if:
• we add new cookies
• we change how cookies are used
• UK cookie law changes
The latest version will always be available on our website.
6. Contact us
If you have questions about cookies or data protection, contact:
Email: bromleylions.dpo@gmail.com
Data Protection Lead: Dan Windust
Page updated
Google Sites
Report abuse