Privacy policy

We collect only the information we need to run the Flag Institute and look after our members. We never sell your information.

Who we are

The Flag Institute is a charitable incorporated organisation registered in England and Wales, number 1152496. We are the controller of the personal information described here. You can contact us about this policy at info@flaginstitute.org.

What we collect

If you are a member: your name, email address, postal address, telephone number, membership type, member number, payment and renewal history, and your sign-in details for the Members' Area. If you choose to Gift Aid your subscription, we also keep your Gift Aid declaration.

If you contact us: your name, email address and anything you tell us in your message.

If you attend our meetings or events: your name and booking details.

If you visit our website: technical information such as your IP address, which our security systems use to protect the site. With your permission, we also collect information about how you use the site through Google Analytics. Our cookie policy explains this in full.

We do not see or store your card details. Payments are handled by Stripe on its own secure pages.

How we use it

We use your information to:

• run your membership, send you Flagmaster and other member publications, and give you access to the Members' Area
• take payments and send renewal reminders
• claim Gift Aid from HMRC where you have asked us to
• reply to your enquiries
• organise meetings, conferences and other events
• keep our website secure and understand how it is used
• keep our own records and meet our legal duties as a charity

Our legal reasons

Data protection law requires us to have a lawful basis for using your information. We rely on:

• contract, to provide the membership you have joined
• legal obligation, for Gift Aid, accounting and charity records
• legitimate interests, to run the charity, keep the website secure and tell members about our work
• consent, for analytics cookies and for any messages you have asked to receive. You can withdraw consent at any time.

Who we share it with

We share your information only with trusted organisations that help us run the Flag Institute, and only for that purpose. They include our website host, our payment provider (Stripe), our email and office services (Google Workspace), our membership records system (Beacon), our website security service (Cloudflare) and, with your permission, Google Analytics. We share Gift Aid information with HMRC. We do not share your information with anyone else unless the law requires us to.

Some of these providers store information outside the UK. Where they do, the transfer is protected by safeguards approved under UK data protection law.

How long we keep it

We keep member information while you are a member and for up to six years after your membership ends, so that we can meet our accounting and Gift Aid duties. Enquiries are kept for up to two years. After that, we delete your information or make it anonymous.

How we protect it

Your information is held on secure systems with restricted access. Our website uses encryption, a security firewall and protected sign-in for staff.

Your rights

You have the right to ask for a copy of the information we hold about you, and to ask us to correct it, delete it, or stop or limit how we use it. You can also object to us using it, and ask us to transfer it to another organisation.

To make a request, email info@flaginstitute.org. We will reply within one month.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes to this policy

We review this policy regularly and will update this page when anything changes.