PMCC Privacy Policy

Effective Date: 2 July 2026

Last Updated on 1 September 2026

Privacy Policy

Plymouth Malayalee Cultural Community (PMCC) ("PMCC", "we", "our", or "us") is committed to protecting the privacy and personal information of our members, volunteers, event participants, administrators, office bearers, and website visitors.

This Privacy Policy explains how we collect, use, store, share, and protect personal information when you visit our website, become a PMCC member, participate in PMCC activities or events, volunteer with PMCC, or access authorised administrative areas of our website.

PMCC seeks to process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

1. Who We Are

Plymouth Malayalee Cultural Community (PMCC) is a non-profit community organisation based in Plymouth, United Kingdom.

Website: www.pmccuk.org
Email: info@pmccuk.org

For questions concerning this Privacy Policy or PMCC's handling of personal information, please contact us using the details above.

2. Information We Collect

The information we collect depends upon your relationship and interaction with PMCC.

We may collect:

Full name
Residential address
Email address
Mobile telephone number
Date of birth, where required
Family member details provided for family membership
Emergency contact information, where applicable
Membership details
Membership status and history
Event registration information
Volunteer information
Communications and enquiries submitted to PMCC
Photographs and videos taken during PMCC activities or events, subject to appropriate notice
Other information voluntarily provided to PMCC

When you use our website, we may also collect technical information such as:

IP address
Browser type and version
Device type and operating system
Date and time of access
Website usage information
Cookies and similar technical information
Security and access logs

PMCC aims to collect only information that is reasonably necessary for its legitimate community, membership, administrative, operational, and security purposes.

3. Administrator Login Security Information

PMCC operates additional security measures to protect restricted administrative areas of its website and the personal information accessible through those systems.

When an authorized administrator or office bearer attempts to access the PMCC administration portal, the system may request permission through the user's web browser to access the device camera.

Where the required camera permission has been granted, the system may capture a photograph at the time of the administrator login or login attempt.

The security audit record may include:

Photograph captured during the login process

Administrator username or account identifier

Date and time of the login attempt

IP address

Browser information

Device and operating-system information

Approximate geographical location derived from the IP address

Successful or unsuccessful login status

Other relevant technical security information

Camera access is subject to the permission controls provided by the user's browser and/or device.

PMCC does not use this functionality for continuous camera monitoring or video recording, nor is the feature intended to access photographs already stored on the user's device.

Passwords entered during incorrect login attempts should be stored in plaintext or included in security notifications or audit records.

4. How We Use Your Information

PMCC may use personal information to:

Process and manage membership applications
Verify membership eligibility
Maintain membership records
Issue membership cards
Communicate important community information and announcements
Organize community programmes and events
Process event registrations
Coordinate volunteers
Respond to enquiries and requests
Provide and improve member services
Operate and improve the PMCC website
Maintain website and information security
Prevent and investigate unauthorized access
Maintain appropriate administrative and security audit records
Protect PMCC members' personal information
Meet applicable legal and regulatory requirements
Establish, exercise, or defend legal claims where necessary

PMCC does not sell personal information or use members' personal information for unrelated commercial marketing.

5. Lawful Basis for Processing

Where UK data protection legislation applies, PMCC will process personal information only where an appropriate lawful basis exists.

Depending upon the circumstances, this may include:

Processing necessary for PMCC's legitimate interests, provided those interests do not override the individual's rights and freedoms
Processing necessary to provide membership or services requested by an individual
Compliance with applicable legal obligations
Consent, where consent is the appropriate lawful basis
Other lawful grounds available under applicable UK data protection legislation

For security monitoring of administrative systems, PMCC may rely upon its legitimate interests in protecting its information systems, members' personal information, authorized administrators, and community operations from unauthorized access, fraud, misuse, and other security threats, subject to the required assessment under applicable law.

Browser permission to access a device camera is a technical permission and should not automatically be treated as equivalent to consent under UK GDPR.

6. Sharing Your Information

PMCC does not sell, rent, or trade personal information.

Personal information may be shared only where reasonably necessary, including:

With authorized PMCC office bearers who require access to perform their official responsibilities
With specifically authorized personnel responsible for website administration or information security
With trusted service providers supporting PMCC operations, subject to appropriate contractual, security, and confidentiality requirements
With website hosting, technical, communication, or security providers where required to operate PMCC services
With law-enforcement authorities, regulators, courts, or other authorities where required or permitted by law
Where necessary to establish, exercise, or defend legal rights
With the individual's consent where appropriate

Access to personal information should be limited to those who reasonably require it for authorized purposes.

7. Data Security

PMCC takes appropriate technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, loss, misuse, or destruction.

Depending upon the systems involved, these measures may include:

HTTPS-encrypted website connections
Restricted administrator access
Strong authentication and password requirements
Role-based access controls
Secure server hosting
Regular software and security updates
Security logging and monitoring
Limited access to authorized office bearers
Routine security reviews
Appropriate database and application security controls
Backup and recovery procedures where applicable

PMCC may maintain security audit logs concerning access to administrative systems.

These records may contain administrator login activity, IP addresses, browser/device information, timestamps, login results, and, where the administrator has granted the necessary camera permission, a photograph captured during the login process.

Access to such security information will be restricted to specifically authorised persons.

Although no website, database, or electronic system can guarantee absolute security, PMCC takes reasonable and proportionate steps to protect the information under its control.

8. Administrator Login Security Monitoring

To protect PMCC's administrative systems and members' personal information from unauthorized access, PMCC may operate enhanced monitoring of administrator login activity.

When an administrator attempts to access a protected administration area, the website may request permission to access the device camera.

If the required permission is granted, the system may capture a photograph during the login process and securely associate that photograph with the relevant security audit record.

Such information may be processed for purposes including:

Verifying and reviewing administrator login activity
Detecting suspected unauthorized access
Investigating failed or suspicious login attempts
Detecting account compromise
Investigating security incidents
Protecting membership and organizational information
Maintaining security audit records
Preventing fraud or misuse of PMCC systems
Supporting investigations where unauthorized access is suspected
Establishing or defending legal rights where appropriate

The photograph is intended for security auditing and incident investigation.

PMCC does not intend to use login photographs for advertising, unrelated promotional activities, or unrelated profiling.

Unless PMCC separately implements and appropriately discloses such technology, photographs captured for this purpose will not be used for automated facial recognition or biometric identification.

Administrators should receive an appropriate notice concerning the camera-based security feature before or during the permission process.

9. Data Retention

PMCC retains personal information only for as long as reasonably necessary for the purposes for which it was collected, including membership administration, community operations, security, legal obligations, dispute resolution, and record keeping.

Different categories of information may therefore have different retention periods.

Administrator security photographs and associated routine login security records should be retained only for a defined period reasonably necessary for security monitoring and investigation.

Where PMCC adopts a 90-day routine retention period, ordinary administrator login photographs should normally be securely deleted or anonymised after 90 days.

Information may be retained for longer where reasonably necessary because:

A security incident is under investigation
Unauthorized access is suspected
A legal claim or dispute exists
Law enforcement or another competent authority requires the information
A legal or regulatory obligation requires longer retention

When personal information is no longer reasonably required, PMCC will seek to securely delete or anonymize it.

10. Your Data Protection Rights

Subject to applicable UK data protection law and any relevant exemptions, individuals may have rights including:

The right to request access to personal information held about them
The right to request correction of inaccurate or incomplete information
The right to request deletion of personal information in appropriate circumstances
The right to request restriction of processing
The right to object to certain processing activities
The right to data portability where applicable
The right to withdraw consent where processing is based upon consent
Rights relating to certain automated decision-making activities where applicable

Requests concerning personal information should be submitted to:

info@pmccuk.org

PMCC may need to verify the identity of the person making a request before disclosing or modifying personal information.

Individuals may also have the right to raise a complaint with the UK Information Commissioner's Office (ICO) concerning the handling of their personal information.

11. Cookies

The PMCC website may use cookies and similar technologies for purposes including:

Essential website functionality
Maintaining secure sessions
Improving website performance
Remembering appropriate preferences
Website analytics
Protecting the website against abuse and security threats

Where required by applicable law, non-essential cookies will be used subject to appropriate consent or preference controls.

Users may also control certain cookie settings through their web browser.

12. Children's Information

PMCC may process information concerning children where required for family memberships, community programs, competitions, cultural activities, or event registrations.

Where appropriate, children's information should be provided by or collected with the involvement of a parent or legal guardian.

Such information will be used only for legitimate PMCC community and administrative purposes and should receive appropriate protection considering the age of the individuals concerned.

13. Photographs and Videos at PMCC Events

PMCC events and community programs may be photographed or recorded for legitimate community purposes, including:

Community news
Event reports
Newsletters
PMCC website
PMCC social-media channels
Community archives
Appropriate promotional material

PMCC will seek to provide reasonable notice where photography or video recording takes place.

If an individual does not wish to appear in photographs or videos, they should inform an event organiser before or during the event. PMCC will make reasonable efforts to respect such requests.

Where additional consent is legally required, PMCC will seek the appropriate permission.

14. Third-Party Services and Links

The PMCC website may use or provide links to third-party services, websites, social-media platforms, payment providers, mapping services, or other external systems.

Those third parties may process information under their own privacy policies.

PMCC encourages users to review the privacy policies of relevant third-party services before providing personal information through them.

PMCC is not responsible for the privacy practices of independent third-party websites merely because the PMCC website contains a link to them.

15. International Data Transfers

Some technology or service providers used by PMCC may process or store information outside the United Kingdom.

Where personal information is transferred internationally, PMCC will seek to ensure that appropriate safeguards required by applicable UK data protection law are in place.

16. Data Breaches

PMCC will take appropriate action if it becomes aware of a personal data breach.

Depending upon the nature and risk of the breach, this may include:

Investigating and containing the incident
Securing affected systems
Assessing the information involved
Recording the incident
Taking corrective measures
Notifying affected individuals where legally required
Reporting the breach to the Information Commissioner's Office where required by applicable law

Security incidents will be handled in accordance with applicable UK data protection requirements.

17. Contact Us

For questions, concerns, or requests relating to this Privacy Policy or PMCC's processing of personal information, please contact:

Plymouth Malayalee Cultural Community (PMCC)
Email: info@pmccuk.org
Website: www.pmccuk.org

19. Changes to This Privacy Policy

PMCC may update this Privacy Policy periodically to reflect changes in:

Legal or regulatory requirements
PMCC activities
Website functionality
Technology
Security measures
Organizational practices

The latest version of this Privacy Policy will be published on the PMCC website together with its effective date.

Last Updated: 1 September 2026