GDPR Compliance Statement

Last updated: 15 August 2026

1. Our Commitment to GDPR

Kent Sri Lankan Social Club is committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We take the privacy of our members and website visitors seriously.

2. Data Controller Information

Organisation: Kent Sri Lankan Social Club

Email: info@kentslsc.org

Address: Kent, United Kingdom

3. Data Protection Principles

We adhere to the following principles when processing personal data:

**Lawfulness, fairness and transparency**: We process data lawfully and transparently

**Purpose limitation**: Data is collected for specified, explicit, and legitimate purposes

**Data minimisation**: We only collect data that is necessary

**Accuracy**: We take reasonable steps to ensure data is accurate

**Storage limitation**: Data is kept no longer than necessary

**Integrity and confidentiality**: We use appropriate security measures

4. Lawful Bases for Processing

We rely on the following lawful bases:

| Processing Activity | Lawful Basis |

|---|---|

| Membership management | Contract |

| Event bookings | Contract |

| Financial records | Legal obligation |

| Marketing communications | Consent |

| Website analytics | Legitimate interests |

| Forum and community features | Legitimate interests |

5. Data Subject Rights

Under UK GDPR, you have the following rights:

**Right of access**: Request a copy of your personal data

**Right to rectification**: Correct inaccurate personal data

**Right to erasure**: Request deletion of your personal data

**Right to restriction**: Restrict how we process your data

**Right to data portability**: Receive your data in a portable format

**Right to object**: Object to certain types of processing

**Rights related to automated decision-making**

To exercise any of these rights, please submit a Data Subject Access Request to info@kentslsc.org. We will respond within 30 days.

6. Data Breaches

In the event of a personal data breach that poses a risk to individuals, we will:

1. Notify the Information Commissioner's Office (ICO) within 72 hours

2. Notify affected individuals without undue delay where required

7. International Transfers

We do not transfer personal data outside the UK/EEA except where appropriate safeguards are in place (e.g., Standard Contractual Clauses with our payment processor).

8. Children's Data

Our services are not directed at children under 13. We do not knowingly collect personal data from children under 13 without parental consent.

9. Changes to This Statement

We review this statement annually and update it following any significant changes to our data processing activities.

10. Complaints

If you believe your data rights have been violated, you have the right to lodge a complaint with the ICO at www.ico.org.uk.