Privacy Notice

Soza Health Ltd. · effective 2026-05-07

This notice tells you what personal data we hold about you, why we hold it, who we share it with, how long we keep it, and what your rights are. We wrote it in plain English. If anything is unclear, please contact us using the details at the bottom of this page.

Who we are

What data we hold and why

Activity	Why we hold the data	How long we keep it
Membership profile	To identify you as an authorised member of the organisation, to contact you about club activities, and to cater for events you attend. UK GDPR Art. 6(1)(b) — performance of your membership agreement; and Art. 9(2)(a) — explicit consent for dietary information (special-category data).	For the duration of your active membership, plus 12 months after you leave for handover purposes. Then archived or deleted on request.
Notices	Public notices that you authored or were named as a contact on. These are visible to all members of the organisation. UK GDPR Art. 6(1)(f) — legitimate interests in keeping members informed about activities, events and contact points.	Retained while the notice remains relevant; cleared when superseded. Historical notices may be kept for organisational record-keeping.
Soza Heart & Stress self-assessments	To run the Soza Heart and Stress self-assessments: to calculate and show each respondent their own result; to keep the answers, score, and a coarse age band and gender in anonymous form for aggregated service-improvement and research statistics; and, only where the respondent has opted in, to let them view their report again in the future and see how their results change over time (they authenticate with a one-time code sent to their email), to let a Soza adviser contact them about the result, and to tell them about other Soza services. Explicit consent. UK GDPR Art. 9(2)(a) for the health-related answers and score, and Art. 6(1)(a) for the age band and gender, for storing contact details, and for marketing. UAE PDPL (Federal Decree-Law 45/2021) consent and India DPDP Act 2023 consent for respondents in those countries. Each of the three consents is recorded separately and its exact wording is snapshotted onto the response.	Where the respondent gave an email address, their identifiable details (name, date of birth, phone, email) and their report are kept until they ask us to remove them or withdraw consent — this is what lets them return to their report and build a record over time. Where they gave contact details but no email, those details are deleted 365 days after submission by purge_survey_responses. The respondent can erase their details at any time, either by asking us or self-serve from the report page (verified by a one-time email code). The anonymous answers, score, age band and gender are kept indefinitely for aggregated statistics with no identity attached. One-time access codes are deleted once they expire.
Breakfast orders	To cater for breakfast events you attended or signed up to. UK GDPR Art. 6(1)(b) — performance of a contract for the meal; Art. 9(2)(a) — explicit consent for any dietary/allergy notes.	Retained for 12 months after the event for accounting and dispute handling, then anonymised.
Breakfast visitors book (guest sign-in)	To keep an attendance register of visitors to club meetings, as a club record and so the club can answer who was on its premises if its insurer asks. UK GDPR Art. 6(1)(f) — legitimate interests. The club has a legitimate interest in an accurate record of who attended its meetings, for its own records and for insurance and liability purposes. This is NOT consent: there is no tick-box and the record cannot be withdrawn, because a register a visitor could remove themselves from would not serve the purpose it is kept for. A handwritten signature image is ordinary personal data — it would only be special-category biometric data under Art. 9 if it were processed by technical means for unique identification (e.g. stroke-dynamics analysis), which it is not.	Six years from the date of the meeting, matching the Limitation Act 1980 contract period, after which the signature image and the attendance record are deleted.
Document library activity	To support the document library workflow — recording who uploaded each file, who has it checked out, and an access audit log. UK GDPR Art. 6(1)(f) — legitimate interests in the secure operation of a members-only document library, including audit.	Audit events retained for 12 months; checkout records retained for the life of the document; uploaded files retained indefinitely as organisational records (you may request specific deletions).
Course enrolments and progress	To deliver a course you enrolled on and issue a completion certificate. UK GDPR Art. 6(1)(b) — performance of the course-delivery agreement.	Retained while the course is offered; certificates retained as record of completion.
Communications and devices	Email and push notifications sent to you about club activities, plus the device tokens we use to deliver push notifications. UK GDPR Art. 6(1)(f) — legitimate interest in informing members; Art. 6(1)(a) — consent (you opted in via the mobile app).	Message dispatch log retained for 12 months. Device tokens retained while the device remains registered.
Audit and access trail	Records of actions you took on the platform (sign-in, view, export) and changes you made to data, retained as a security audit trail. UK GDPR Art. 6(1)(c) and 6(1)(f) — legal obligation and legitimate interest in maintaining a security audit log.	Action log retained for 12 months. django-auditlog model-change entries retained for 7 years to support accountability.
Game purchases (Spot The Splat + Duck Race)	Records of game-grid squares or race ducks you purchased, including the contact details you supplied at checkout so we can reach you if you win or to handle a dispute. UK GDPR Art. 6(1)(b) — performance of the purchase contract.	Retained for 7 years for accounting and HMRC purposes (UK retention requirement for transactional records).
Furniture deliveries (recipient records)	If you have received a furniture donation, we hold contact + address details so we can deliver and follow up. UK GDPR Art. 6(1)(f) — legitimate interest in coordinating donations to vulnerable recipients via referring charities.	Retained for 24 months after the last delivery, then anonymised.
Roles, positions and group memberships	To track which committee positions and groups you are part of, by year — used to derive the leadership team display. UK GDPR Art. 6(1)(f) — legitimate interest in maintaining an organisational record of officers and committee members.	Retained as part of the organisation's permanent record.
Authentication and sessions	Sign-in identifiers (Google email, Apple subject ID, Django username) and active mobile session tokens used to keep you signed in on the app. UK GDPR Art. 6(1)(b) — performance of the membership login flow.	Mobile sessions persist while the device is registered; tokens are rotated when you sign out.

Who we share data with

We share your data only with the people and services we need to run the platform on your behalf:

• Investcope Ltd — Platform processor (runs the SpotTheSplat platform)
• Cloudflare R2 — Object storage (member-uploaded files, DSAR bundles, backups)
• Resend — Transactional email (notifications, magic links, DSAR bundles)
• Stripe Payments Europe Ltd — Payment processing (Spot The Splat, Duck Race, repeat-DSAR fees)
• Fly.io — Application hosting
• Neon — Managed Postgres database
• Firebase Cloud Messaging (Google LLC) — Push notifications to mobile app
• Apple Sign In — Identity provider for mobile + WordPress sign-in
• Google Sign In — Identity provider for mobile + WordPress sign-in

We process your data in the UK and EEA. Some service providers operate globally; we rely on UK adequacy decisions and the International Data Transfer Agreement (IDTA) / Standard Contractual Clauses where applicable.

How we keep your data safe

Your data is encrypted in transit and at rest. Access is restricted to authorised members and administrators of your organisation. We keep an audit trail of access and changes.

Automated decision-making

We do not make solely automated decisions about you that have legal or similarly significant effects.

Your rights

Right to be informed

We tell you how your data is used. That's what this notice is for.

Right of access

You can ask for a copy of the data we hold about you. We'll respond within 30 days of confirming it's really you asking.

Right to rectification

If anything we hold is wrong, ask us to fix it.

Right to erasure

Ask us to delete your data. We will, except where we're legally required to keep certain records (audit logs, finance records) — we'll tell you what stays and why.

Right to restrict processing

Ask us to stop using your data for a particular purpose while we sort out a complaint or correction.

Right to data portability

Ask for a machine-readable copy of your data so you can take it to another service.

Right to object

Object to processing we do under 'legitimate interests' — for example, stop receiving emails about events.

Rights related to automated decision-making and profiling

We don't make solely-automated decisions about you that have legal or similarly significant effects.

Other things you should know

Soza Heart & Stress self-assessments. We only collect anything if you complete an assessment — if you don't finish one, nothing is stored. If you complete an assessment we keep your answers and the risk score they produce (health data), with no name or contact details attached, for anonymous statistics. Only if you tick “store my results” do we also keep your name, date of birth, phone, email and gender, linked to that result, so a Soza adviser can follow up and email you your report; and only if you additionally tick the marketing option do we use those details to tell you about other Soza services. Our lawful basis is your explicit consent — UK GDPR Article 9(2)(a) for the health data and Article 6(1)(a) for storing your contact details and for marketing. Your report is currently emailed to you as a PDF; access via the Soza Portal and the Soza mobile app is being added. We keep the identifiable records and the emailed report for 365 days and then delete them; the anonymous statistics are kept indefinitely. You can ask for access, correction or erasure, or withdraw consent, at dpo@sozahealth.com, and you can complain to the Information Commissioner's Office (ICO).

Your assessment data is stored and processed in the United Kingdom.

Contact us

If you would like a copy of the data we hold about you, want us to correct or delete something, or have any other concern about how we use your data, please contact us using the details above. You also have the right to complain to the Information Commissioner's Office at https://ico.org.uk/ — telephone 0303 123 1113.