Privacy Policy

Who we are

The Shabba website at www.shabba.co.uk is operated by the Shabba Society. The Shabba Society is the data controller responsible for your personal data in connection with this website. For any privacy question or request, contact us at privacy@shabba.co.uk.

What data we collect

When you join the Shabba Club we collect only what is needed to send you club emails: the email address you submit, the sequential membership number we assign, and the timestamp of your consent. We do not collect additional personal information about you through this website.

When you use the Shabba feeling meter, the only record is the total count per feeling; this does not identify you personally.

Basic technical information may be processed by our service providers as needed to keep the site working and secure.

When you use the Shabba Club signup form, we use Google reCAPTCHA to help protect against automated abuse and spam. As part of this protection, Google may process technical information required to provide the service, which can include your IP address, browser and device information, and interaction or service information. Google's processing is governed by its own privacy policy and terms, which you can review at policies.google.com/privacy and policies.google.com/terms.

How and why we use your data

We use your data only for the following purposes:

• Sending Shabba Club emails. We use your email address and membership number to deliver the dispatches you signed up for.
• Running the feeling meter. Aggregate feeling counts are kept so the live meter can display totals for every visitor.
• Security and service operation. Limited technical processing helps protect the site from abuse and keep it available.

Legal bases

Under the UK GDPR we rely on the following lawful bases:

• Consent. We send Shabba Club emails on the basis of the consent you give when you tick the box and join. You can withdraw this consent at any time.
• Legitimate interests. We rely on our legitimate interests to operate the site securely and keep the service running, for example protecting against abuse.
• Legal obligation. Where a legal obligation applies, such as keeping consent records where required, we retain the relevant records to meet that obligation.

Service providers

We use trusted service providers to operate the site. These are:

• Macaly for hosting the website and platform.
• Convex as the data backend for the live feeling meter and club records.
• A built-in transactional email service used to deliver Shabba Club emails.
• Google Fonts for the display and body typefaces used on the site.
• Google reCAPTCHA to help protect the Shabba Club signup form against automated abuse. Google may process technical information (such as IP address and browser or device information) for this purpose under its own privacy policy and terms of service.

We do not make unverified claims about the exact hosting countries or contracts of these providers. They act as processors under our instructions where they process personal data on our behalf.

How long we keep your data

We keep your Shabba Club subscription information until you unsubscribe. After you unsubscribe we delete or anonymise your data unless a legal obligation requires us to retain it for longer. Aggregate feeling-meter counts are kept for as long as the meter is offered.

Your data rights

Under the UK GDPR you have rights including access to your data, correction, deletion, restriction, objection, and data portability. To exercise any right, email us at privacy@shabba.co.uk. We will respond within one month, and may ask for information to confirm your identity.

Withdrawing your email consent

You can withdraw your consent for Shabba Club emails at any time. Use the unsubscribe link in any club email, or email privacy@shabba.co.uk. Withdrawing consent does not affect processing carried out before you withdrew.

International transfers

Some of our service providers may process data outside the United Kingdom. Where this happens we rely on appropriate safeguards or other lawful transfer mechanisms as required under the UK GDPR. We do not claim specific knowledge of each provider's hosting location or contractual terms beyond what is stated here.

Security

We take reasonable measures to protect your data, including limiting collection to what is needed and using trusted service providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date above shows when it was last revised. Material changes will be reflected here.