International Ahmadiyya Muslim Law Association (collectively referred to as “IAMLA”, “we”, “us” or “our” in this privacy notice) is a strongly committed to protecting personal data. This privacy notice describes why, how and when we process personal data. It also provides information about individuals’ rights. This notice applies to personal data provided to us, either by data subjects themselves or by others.

Personal data is any information relating to an identified or identifiable living person. IAMALA processes personal data. The following matters will vary according to the purpose for which data was collected: the means of collection; the lawful basis for processing; the disclosure of data; and the periods for which data is retained.

This Privacy Notice tells you how we look after your personal data when you visit our website, and at other points at which we collect your personal data. It tells you about your privacy rights and how the law protects you.

We may use personal data provided to us for any of the purposes described in this privacy notice or as otherwise stated at the point of collection. This document may also be described as a Fair Processing Notice.

Contact details of the Controller

Email address:                                                 [email protected]

Postal address:                                                22 Deer Park Rd, London, SW19 3TL, United Kingdom

Telephone number:                                       0208 544 7606

 

Changes to this privacy notice

We recognise that transparency is an ongoing responsibility so we will keep this privacy notice under regular review. This privacy notice was last updated on 09^TH December 2023.

 

The types of personal data that we collect and use

When we refer to collecting or using personal data, or personal information, we are referring to any information about an individual from which that person can be identified. It does not include data where the identity of the data subject has been removed (anonymous data).

 

Types of personal data that we collect, store, use and transfer

We may collect, use, store and transfer different types of personal data about yourself, including the following:

• Identity Data:    This includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth, gender, and membership number (if applicable)
• Contact Data:     This includes billing address, delivery address, email address and telephone numbers.
• Technical Data: This includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website.
• Profile Data: This includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
• Usage Data: This includes information about how you use our website.
• Events Data: This includes your preferences in receiving information about (or invites to) events and your communication preferences.

 

How we collect personal data

We collect your personal data when you visit our websites or services, contribute to IAMALA or when you interact with us. We will only collect your personal data in line with applicable laws. We collect your personal data in various ways:

• directly from you, when you sign up for our services and when you browse our sites/apps
• personal data we generate about you, e.g. personal data we use to authenticate you,
• personal data we collect from third parties, e.g. personal data that helps us to combat fraud or which we collect, with your permission, when you interact with your social media accounts

 

We may also collect, use and share Anonymous Data, such as statistical or demographic data, for any purpose. Anonymous Data may be derived from your personal data but is not considered personal data in law as it does not reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Anonymous Data with your personal data, so that it can directly or indirectly identify you, we treat the combined data as personal data. Such data will then be used in accordance with this privacy notice.

 

How your personal data is collected

We use different methods to collect data from and about you. We have set this out in the table below:

 

Direct Interactions

You may provide us with your personal data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:

• send us letters, emails, faxes, or other correspondence via social media;
• subscribe to publications;
• request that details of events be sent to you;
• give us some feedback;
• apply for our products or services;
• attend our events.

 

Automated technologies or interactions.            

As you interact with some of our websites, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies.

 

How we use your personal data

We will only use your personal data when the law allows us to. We must have a “legal basis” in order to process your personal data. The relevant legal bases are set out in the current UK data protection legislation (UK-GDPR, DPA 2018). Most commonly, we will use your personal data in the following circumstances:

• Where we have your consent to do so.
• Where we need to perform a contract which we are about to enter into, or have entered into, with you.
• Where we need to comply with a legal or regulatory obligation.
• Where it is necessary for our legitimate interests (or those of a third party), and your interests and fundamental rights do not override our interests.
• Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data.

 

Purposes for which we use your personal data

We use your personal data when undertaking the following activities.

Purpose Description:

• To communicate with, and send correspondence to you;
• For internal administrative purposes related to when you use our services - such as our accounting and records - and to make you aware of any changes to our services;

• If you are going to one of our events hosted by an event partner, we may share your personal data with that partner for event administration purposes;
• If we receive a letter, email or another form of communication from you that we consider to be significant to the history of IAMALA, we may decide to share this with the Archive department for historic and archiving purposes; or
• We may also need to keep your personal data for accounting purposes, for example, where you have purchased a subscription.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another purpose. This new purpose must be compatible with the original purpose for which we collected your data. If you have any questions concerning this matter, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

 

Disclosing your personal data to others

IAMALA may need to share your personal data with the parties set out below. Our purposes for doing so are set out in the above table entitled: ‘Types of personal data that we collect, store, use and transfer’.

 

External third parties

 

Type of professional advisers acting as processors or joint controllers	Country in which company is based	Service provided / need for disclosure
Lawyers	United Kingdom	Legal services
Bankers	United Kingdom	Banking services
Accountants	United Kingdom	Accounting services
Auditors	United Kingdom	Accountancy services
Insurers	United Kingdom	Insurance services
HM Revenue & Customs, regulators and other authorities acting as processors or joint controllers	United Kingdom	Require reporting of processing activities in certain circumstances

 

We require all third parties to respect the security of your personal data. They must to treat your data in accordance with the law, and our own strict security requirements. We do not allow the above third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes, and in accordance with our instructions. In the event that IAMALA sells, transfers, or merges parts of our operation or assets with a third-party organisation, the new owners or operators must use your personal data in the manner set out in this privacy notice.

 

International data transfers

Some of our external third parties may be based outside the European Economic Area (EEA). Therefore, their processing of your personal data will involve a transfer of data outside of the EEA.

Whenever we transfer your personal data out of the EEA, we ensure a similar degree of protection is afforded by ensuring at least one of the following safeguards is implemented:

We transfer your personal data to countries that have been deemed, by the European Commission, to provide an adequate level of protection of personal data. For further details, see European Commission: ‘Adequacy of the protection of personal data in non-EU countries’.

Where we use service providers in countries that have not been deemed to provide an adequate level of protection, we will use specific contracts approved by the European Commission which give personal data the same degree protection which it is afforded within the EEA. For further details, see European Commission: ‘Model contracts for the transfer of personal data to third countries’.

Please contact us if you wish to receive further information on the specific mechanisms which we use when transferring personal data outside of the EEA.

 

Data security

We have put in place appropriate technical security measures to prevent your personal data from being accidentally lost, altered, disclosed and/or processed. In addition, we ensure your personal data is only processed by those employees, agents, contractors or other third parties, who are authorised to do so, on a ‘need to know’ basis. They will only process your personal data in accordance with our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach. We will notify you, and any relevant supervisory authorities, if a data breach occurs, where we are legally required to do so.

 

Data retention

We will only retain your personal data for as long as necessary to fulfil the purposes for which we collected it. This includes the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the following criterion: the amount, nature, and sensitivity of the personal data; the potential risk of harm from unauthorised use or disclosure of the personal data; the purposes for which we process the personal data; and whether we can achieve those purposes through other means.

Details of our retention periods for different types of personal data are available in our retention policy. Please contact us if you would like to receive a copy.

In some circumstances, you can ask us to delete your data: see ‘Request Erasure’ below for further information.

In some circumstances, we may anonymise your personal data (so that you can no longer be identified through the data) for research or statistical purposes. According to the law, anonymous data is not classed as personal data, as the data cannot be used to identify any given individual. As such, we are permitted by law to use anonymous data indefinitely without further notice to any data subject.

 

Exercising your legal rights

You have a number of rights with regard to the personal data that we hold about you and you can contact us with regard to the following rights in relation to your personal data:

• You have the right to receive a copy of the personal data we hold about you;
• You have the right to correct the personal data we hold about you;
• Where applicable, you may also have a right to receive a machine-readable copy of your personal data;
• You also have the right to ask us to delete your personal data or restrict how it is used, consistent with the UK-GDPR. There may be exceptions to the right to erasure for specific legal reasons which, if applicable, we will set out for you in response to your request;
• Where applicable, you have the right to object to processing of your personal data for certain purposes;
• Where you have provided us with consent to use your personal data, you can withdraw this at any time;
• If you would like to unsubscribe from any email newsletter you can also click on the ‘unsubscribe’ button at the bottom of the email newsletter. It may take up to 30 days for this to take place.

 

Making a complaint

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns, and would invite you to contact us in the first instance.