Privacy Policy

1. Who we are

Imam Ali Foundation London ("we", "us", "the Foundation") is a registered charity in England and Wales, Registered Charity No. 1172217, based at 65 Brondesbury Park, London NW6 7AX. We are the data controller for the personal information described in this policy. You can contact us at post@najaf.org.

2. What information we collect

• Donation details: amount, fund, date, frequency (one-off or recurring) and transaction reference.
• Contact details: your name and email address, and your postal address if you make a Gift Aid declaration.
• Gift Aid declaration: your confirmation that you are a UK taxpayer, and the date of the declaration.
• Account details: if you create a donor account, your login email and a securely hashed password, or your Google or Apple sign-in identifier.
• Technical data: basic information such as IP address and browser type, and essential cookies needed to keep you signed in and the site secure.

We do not store your card number. Card details are entered on, and processed by, Stripe.

3. How and why we use your information

Under the UK GDPR we rely on the following lawful bases:

• Contract / steps at your request: to process your donation, set up recurring giving and send you a receipt.
• Legal obligation: to keep financial records and to claim Gift Aid from HMRC. Charity and tax law requires us to keep Gift Aid records for at least six years.
• Legitimate interests: to run and secure our website, prevent fraud and understand how donations are used.
• Consent: for any optional updates or marketing, which you can withdraw at any time.

4. Who we share it with

We never sell your data. We share it only with service providers who help us run the Foundation, under contract and only as needed:

• Stripe – payment processing.
• HMRC – to claim Gift Aid on eligible donations.
• Our email delivery provider – to send receipts and account emails.
• Our website hosting and technical support providers.
• Regulators or law enforcement where we are legally required to.

Some of these providers may process data outside the UK. Where they do, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or an adequacy decision.

5. How long we keep it

Donation and Gift Aid records are kept for at least six years after the end of the tax year to which they relate, as required by law. Account information is kept while your account is active and deleted or anonymised on request, unless we must keep it for legal reasons.

6. Your rights

You have the right to access your data, correct it, have it erased (where we have no legal reason to keep it), restrict or object to our use of it, request a portable copy, and withdraw consent at any time. To exercise any of these, email post@najaf.org. We will respond within one month.

7. Cookies

We use only essential cookies, for example to keep you signed in, remember your language, and protect forms against misuse. We also store a small cookie that remembers your last Sadaqa amount on this device. We do not use advertising cookies. If you accept analytics cookies, we use Google Analytics to understand how the site is used (pages visited, device type, approximate location). This is optional: nothing is loaded unless you choose Accept, and you can change your mind by clearing this site's data in your browser.

8. Security

The site is served over HTTPS, passwords are hashed, and card payments are handled entirely by Stripe, which is certified to PCI DSS Level 1. Access to donor records is restricted to authorised staff.

9. Complaints

If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

10. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date shown above.