UK GDPR // DPA 2018 Compliance

Privacy & Cookie Policy

Last Updated: September 30, 2026 • Version 2.4

King's College London Mountaineering Club (“KCLMC”, “we”, “us”, or “our”) is committed to protecting the privacy, confidentiality, and security of our members' personal data in strict compliance with the **UK General Data Protection Regulation (UK GDPR)** and the **Data Protection Act 2018 (DPA 2018)**.

1. Data Controller & Contact Information

KCLMC operates as an accredited student society under the governance of the King's College London Students' Union (KCLSU), a registered charity in England and Wales (Charity No. 1136729).

Data Controller: KCL Mountaineering Club Committee

Charity Umbrella: King's College London Students' Union (KCLSU)

Registered Address: 30 Strand, London, WC2R 2LS, UK (Bush House Hub, 300 Strand)

ICO Fee Status: Exempt under Data Protection (Charges and Information) Regulations 2018 (Not-for-Profit Exemption; operates under KCLSU Charity No. 1136729 ICO registration)

Data Protection Contact: kclmc.committee@gmail.com

2. Information We Collect

We only collect personal information that is directly necessary to verify student memberships, administer climbing trips safely, and manage club operations:

Account & Student Identity

Full name and preferred name
King's College London Student ID (e.g. K1234567)
University email address (@kcl.ac.uk)
Hashed account passwords

Safety & Emergency Beta

Climber mobile phone number (for safety, trip logistics, and duty of care)
Emergency contact (next-of-kin name and phone)
Voluntarily declared medical notes (allergies, asthma)
Accessibility, paraclimbing, or sensory accommodation preferences
Climbing experience and belay competence self-rating

Membership & Merch Orders

Membership tier (Social vs. Recreational)
KCLSU transaction IDs and purchase timestamps
Apparel pre-orders, sizing selections, and order status
(Note: Payment card details are processed by Stripe / KCLSU and never stored by KCLMC)

Technical & Security Logs

IP addresses and session timestamps
Cloudflare DDoS and bot-mitigation challenge logs
Failed authentication rate-limiting telemetry

3. Lawful Bases for Processing (UK GDPR Art. 6 & 9)

Contractual Necessity (Art. 6(1)(b)): Processing your membership pass, event signups, and club stash orders in fulfillment of your society membership contract.

Vital Interests & Duty of Care (Art. 6(1)(d)): Holding climber mobile numbers and emergency contact information under British Mountaineering Council (BMC) safety guidelines for emergency incident response, crag check-ins, or handover to Mountain Rescue / NHS personnel.

Legitimate Interests (Art. 6(1)(f)): Verifying active student status with KCLSU, preventing fraudulent pass duplication, maintaining equipment loan safety logs, and securing the platform.

Consent (Art. 6(1)(a) & Art. 9(2)(a)): Special category health data (e.g. allergies, asthma, dietary requirements) are strictly voluntary and based on freely given consent.

4. Third-Party Sub-Processors & Infrastructure

We partner with trusted infrastructure providers who adhere strictly to UK GDPR and International Data Transfer Agreements (IDTA):

Cloudflare Inc. — Edge hosting, CDN, DNS routing, and DDoS security (UK/EU edge servers).
Supabase Inc. — Encrypted PostgreSQL database and authentication engine (EU London/Ireland region, AES-256 encrypted at rest).
Resend Inc. — Transactional email dispatch for password recovery and magic links (EU delivery zone).
King's College London Students' Union (KCLSU) — Official student union roster reconciliation and membership verification.

5. Data Retention & Disposal

We adhere to strict data minimization principles:

Active Membership Passes: Retained for the duration of the academic year plus 12 months for re-enrollment continuity.
Trip Medical & Emergency Forms: Securely destroyed or purged within 30 days of the conclusion of each outdoor meet.
Merchandise Financial Records: Retained for 6 years in accordance with UK statutory accounting and tax regulations.

6. Your Rights Under UK GDPR

As a data subject, you hold the following statutory rights under the Data Protection Act 2018:

Right of Access (SAR): Request a copy of all personal records we hold about you free of charge.

Right to Rectification: Request correction of inaccurate or outdated information.

Right to Erasure (“Forgotten”): Request deletion of your account and personal profile where no statutory retention applies.

Right to Data Portability: Obtain an export of your account data in standard machine-readable JSON format.

To exercise any of these rights, email us at kclmc.committee@gmail.com. We respond to all verified requests within 30 days as required by UK law. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7. Cookie & Local Storage Policy (PECR)

In accordance with the Privacy and Electronic Communications Regulations (PECR):

✔ 100% Zero Advertising Trackers

We do not use third-party marketing cookies, ad pixels, or behavioral profiling trackers. We only utilize Strictly Necessary cookies and local storage tokens essential to authenticate your login session (sb-*-auth-token) and protect the platform against cyberattacks (Cloudflare bot defense).

Under UK law, strictly necessary functional tokens are exempt from requiring intrusive opt-in pop-up banners.

♿ Accessibility Policy→Read Terms of Service→BMC Climbing Safety Statement→← Return to Club Hub