UK GDPR
Privacy Policy
Data controller
Tenda Umbanda com Esperança, based in Bournemouth, United Kingdom, is the controller of your personal data. For privacy matters, contact us via the Contact page.
Data we collect
Identification and contact data (name, email, phone/WhatsApp), date of birth, address and emergency contact; messages sent through the forms; and, for members, special category data (health and neurodiversity, orixás and entities, spiritual diary and treatments).
Purposes
To reply to enquiries, manage the community and the activities of the house, organise the sessions and roles, and ensure the safety and care of participants.
Legal basis (ordinary data)
To reply to enquiries and manage the relationship with the house: your consent and the legitimate interests of the community. Financial records: legal obligation.
Legal basis (special category: religion and health)
Religious and health data are processed with your explicit consent (Art. 9(2)(a) UK GDPR) and under the not-for-profit religious body exemption (Art. 9(2)(d)): we process only data of members and participants, with appropriate safeguards, and do not disclose it outside the house without your consent.
Special category data
Health and spiritual data are stored encrypted and accessed only by the leadership (Pai de Santo and Administration). You may withdraw consent at any time by contacting us; this does not affect processing already carried out.
Consent records
When you sign the house terms, we keep an immutable record of the acceptance (name, address, phone, IP address, date and time, and the document version). This evidence is kept to demonstrate consent and is accessed only by the Administration, the Pai de Santo and the treasury.
Cookies
We use only strictly necessary cookies (members-area authentication session and language preference). We do not use advertising cookies or analytics/tracking tools, so we do not show a consent banner. If this changes, we will ask for your consent (PECR).
Location and transfers
Data is hosted by infrastructure providers (e.g. Supabase and Vercel). Where processing occurs outside the UK/EEA, we ensure appropriate safeguards (standard clauses / IDTA).
Retention
We keep data for as long as the relationship with the house lasts. Financial records: up to 7 years (tax obligation). Contact messages: up to 24 months. After these periods data is deleted or anonymised.
Members' language directory
In the members area, each member may voluntarily declare which languages they speak, to support translations and the welcoming of visitors. That information (the name and the languages declared) is visible to other members in the members area, not to the public. You can add or remove your languages at any time; when you leave the house, it is deleted with your data.
Your rights
You have the right of access, rectification, erasure, restriction, objection and portability, and to withdraw consent. To exercise them, contact us via the Contact page; members can also request export or deletion of their data in the members area. You also have the right to complain to the ICO (ico.org.uk).
Sharing
We do not sell your data. Processors (e.g. Supabase, Vercel) process data on behalf of the house under appropriate agreements.
Images
Images are published only with care and respect; we never publish identifiable faces without authorisation.