Privacy Policy · Sandy's Media Hub

Effective date: 14 September 2025
Data Controller: Sandy's Community Centre
In partnership with:Castlebrae High School, Community Police, Crime Prevention
To exercise any of these rights, contact us via our form and we'll respond within one month.

Who This Applies To

This policy applies to everyone who interacts with Sandy's Media Hub:

• Public users: visitors to our website who listen to episodes, submit enquiries, or book the studio
• Account holders: members, admins, and partners who have registered to use the CMS
• Participants: guests, contributors, and interviewees who appear in podcast episodes

Under UK GDPR, all individuals have the same data rights regardless of how they interact with us. The difference is what data we hold, not your rights to control it.

What Data We Process

For Public Users

• Enquiries and bookings: name, email address, phone number, organisation/group name (from contact or booking forms)
• Episode plays: anonymised play counts (IP addresses are hashed, not stored in plain text)
• Cookies: essential session cookies and consent preference (see our Cookies Policy)

For Account Holders

• Account information: name, email, role (superadmin/admin/member), partner tag, profile details
• Content you create: episode drafts, published episodes, show notes, metadata
• Communications: booking requests, contact messages, mailing list subscriptions
• Activity logs: actions taken in the CMS, IP address, timestamps, success/fail status (retained 365 days)
• Consent records: terms acceptance, marketing preferences, safeguarding agreements (from member_profiles table)

For Participants (Guests/Contributors)

• Recording consent: name, signature, date, scope of consent (record, edit, distribute, archive)
• Audio/video recordings: your voice, image, and contributions to podcast episodes
• If under 18: parent/guardian name and signature (as per Appendix B - Participator Agreement)

Purposes and Lawful Bases

• Website and CMS operation: contract / legitimate interests
• Publishing podcast episodes: consent (from participants) / legitimate interests (for partners)
• Processing enquiries and bookings: contract / legitimate interests
• Safeguarding and legal compliance: legal obligation
• Email newsletters and updates: consent (opt-in required)
• Activity logging and security: legitimate interests / legal obligation

Children and Safeguarding

We take safeguarding seriously. Where participants are under 18:

• Parental/guardian consent is obtained before any recording (signed Participator Agreement)
• Data collection is minimised to what is necessary
• All partner staff follow safeguarding policies and codes of conduct
• Recordings featuring minors are subject to additional access restrictions

Sharing and Transfers

We use service providers (hosting, email) under written contracts. All data remains within the UK. We do not sell personal data to third parties.

Within the partnership, data is accessible only to authorised personnel based on their role permissions as defined in the CMS.

Retention

• Activity logs: 365 days, then automatically pruned
• Booking and contact forms: up to 2 years (as per your documentation: "can be two weeks after booking passed ensuring time for complaint and resolve")
• Account information: retained while account is active, plus period required for audit or legal purposes
• Podcast recordings: archived indefinitely for project purposes, subject to takedown requests
• Consent records: retained for as long as the processing continues, plus any legal limitation period

Your Rights (UK GDPR)

All individuals – whether public users, account holders, or participants – have the same legal rights:

• Right to be informed: this privacy policy fulfils this right
• Right of access: request a copy of all personal data we hold about you
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure (right to be forgotten): request deletion of your data, subject to legal obligations
• Right to restrict processing: limit how we use your data
• Right to data portability: receive your data in a structured, machine-readable format
• Right to object: object to processing based on legitimate interests
• Rights related to automated decision-making: we do not use fully automated decision-making

To exercise any of these rights, contact us via our form and we'll respond within one month.

We will respond within one month as required by law. You also have the right to complain to the Information Commissioner's Office (ICO).

Security Measures

As documented in your CMS specification and implemented in the system:

• Role-based access controls (RBAC) – superadmin, admin, member permissions
• Secure session management with HttpOnly cookies
• CSRF protection on all forms
• Input validation and output escaping
• Login rate-limiting to prevent brute force attacks
• Full activity logging with audit trails (logActivity() function)
• Regular encrypted backups with off-site storage
• Secure folder structure with /https protected from direct access

Cookies

We use essential cookies for login, session management, and CSRF protection. Optional analytics cookies are only set with your consent via our cookie banner. See our Cookies Policy for full details.

Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be published on our website. Significant changes will be notified to account holders via email or CMS notification.

Last updated: 14 September 2025