Privacy Policy

Last Updated: September 14, 2026

East London Mosque ("we", "our", or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your personal information when you interact with our donation platform and our WhatsApp messaging services.

East London Mosque is a registered charity in England & Wales (Charity Number: 1122613), located at 82–92 Whitechapel Road, London E1 1JQ. Our official website is https://donate.eastlondonmosque.org.uk.

1. Information We Collect

1.1 Personal Information

When you make a donation through our WhatsApp-based platform, we collect the following information:

• Full Name: To identify you as a donor and for receipt purposes
• Email Address: To send donation receipts and confirmations
• Phone Number: Your WhatsApp number used to communicate with our AI assistant
• Address Information: First line of address and postcode for Gift Aid claims and record-keeping
• Donation Amount: The amount you choose to donate
• Gift Aid Declaration: Your consent to claim Gift Aid (if applicable)
• Project Preference: If you specify a particular project or cause for your donation

1.2 Payment Information

We use Stripe (a PCI-DSS compliant payment processor) to handle all payment transactions. We do not store your credit card details, bank account information, or any payment card data. All payment information is securely processed by Stripe, and we only receive confirmation of successful payments along with a payment reference number.

1.3 Communication Data

When you interact with our WhatsApp AI assistant, we store your conversation history to:

• Process your donation requests
• Provide customer support
• Improve our AI assistant's responses
• Maintain records of your interactions with us

1.4 Technical Information

We may automatically collect certain technical information, including:

• IP address
• Device information
• Browser type and version
• Date and time of access
• Pages visited on our donation platform

2. How We Use Your Information

We use your personal information for the following purposes:

2.1 Processing Donations

• To process and complete your donation transactions
• To generate and send donation receipts
• To claim Gift Aid on your behalf (if you have consented)
• To maintain accurate financial records as required by charity law

2.2 Communication

• To respond to your inquiries and provide customer support via WhatsApp
• To send you donation confirmations and receipts via email
• To send you campaign updates and information about our work (only if you have opted in)
• To send thank you messages via WhatsApp after successful donations

2.3 Legal and Regulatory Compliance

• To comply with UK charity law and regulations
• To comply with HMRC requirements for Gift Aid claims
• To maintain records as required by the Charity Commission
• To prevent fraud and ensure the security of our platform

2.4 Service Improvement

• To analyze donation patterns and improve our services
• To enhance our AI assistant's ability to help donors
• To improve the user experience of our donation platform

3. Legal Basis for Processing

Under the UK GDPR and Data Protection Act 2018, we process your personal data based on the following legal bases:

• Consent: When you opt in to receive campaign updates and communications
• Contractual Necessity: To process your donation and fulfill our obligations to you
• Legal Obligation: To comply with charity law, tax regulations, and HMRC requirements
• Legitimate Interests: To improve our services, prevent fraud, and maintain accurate records

4. Data Sharing and Third-Party Services

We share your personal information with the following third-party service providers:

4.1 WhatsApp / Meta

We use WhatsApp Business API (provided by Meta Platforms Ireland Limited) to communicate with you. When you interact with our WhatsApp service:

• Your phone number and messages are processed by Meta in accordance with their Privacy Policy
• Meta may collect technical information about your device and usage
• We only send messages to users who have explicitly opted in to receive WhatsApp communications
• You can opt out at any time by replying "STOP", "UNSUBSCRIBE", or "OPT OUT"

For more information about how Meta processes your data, please see WhatsApp's Privacy Policy and Meta's Privacy Policy.

4.2 Anthropic (AI assistant)

Our WhatsApp assistant is powered by Anthropic's Claude. When you chat with it:

• The content of your messages is sent to Anthropic to generate a reply. This can include your name, the amount you wish to give, and any address details you give us for Gift Aid.
• Anthropic acts as our data processor and does not use these messages to train its models.
• Anthropic is based in the United States, so this is an international transfer — see section 9 below.
• We send only what is needed to continue the conversation. Your card details never reach us or Anthropic — those go directly to our payment provider (see 4.3).

For more information, see Anthropic's Privacy Policy.

4.3 Stripe

We use Stripe to process all payment transactions securely. When you make a donation:

• Your payment information is processed directly by Stripe
• We share your name, email, and address with Stripe for payment processing and fraud prevention
• Stripe is PCI-DSS Level 1 certified and handles all card data securely
• We do not have access to your full payment card details

For more information, please see Stripe's Privacy Policy.

4.4 Other Service Providers

We may also share your information with:

• Email Service Providers: To send you receipts and communications
• Hosting Providers: To store and process your data securely
• Legal and Regulatory Bodies: When required by law or to comply with charity regulations

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption: All data transmitted between your device and our servers is encrypted using SSL/TLS
• Secure Storage: Personal data is stored in secure databases with access controls
• Access Controls: Only authorized staff members have access to personal data, and access is logged
• Regular Security Updates: We keep our systems and software up to date with security patches
• Payment Security: All payment processing is handled by Stripe, a PCI-DSS Level 1 certified provider
• Data Minimization: We only collect and store data that is necessary for our purposes

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee absolute security.

6. Data Retention

We retain your personal data for the following periods:

• Donation Records: Retained for at least 7 years as required by UK charity law and HMRC regulations
• Gift Aid Declarations: Retained for the duration of the declaration plus 7 years after the last donation
• Communication Records: Retained for 3 years for customer support and service improvement purposes
• Opt-out Requests: Retained indefinitely to ensure we do not contact you after you have opted out

After the retention period, we will securely delete or anonymize your personal data, unless we are required to retain it for longer by law or for legitimate business purposes.

7. Your Rights Under GDPR

Under the UK GDPR and Data Protection Act 2018, you have the following rights:

7.1 Right of Access

You have the right to request a copy of the personal data we hold about you. This is known as a "Subject Access Request" (SAR).

7.2 Right to Rectification

You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.

7.3 Right to Erasure ("Right to be Forgotten")

You have the right to request that we delete your personal data, subject to certain exceptions (e.g., where we are required to retain it for legal or regulatory purposes).

7.4 Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances.

7.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.

7.6 Right to Object

You have the right to object to the processing of your personal data for certain purposes, including direct marketing.

7.7 Right to Withdraw Consent

Where we process your data based on consent, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing before you withdrew consent.

7.8 Right to Lodge a Complaint

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your personal data in accordance with data protection law.

To exercise any of these rights, please contact us using the details provided in Section 10 (Contact Us).

8. WhatsApp Messaging Consent (Opt-In and Opt-Out)

8.1 User Consent (Opt-In Process)

We only send WhatsApp messages to users who have explicitly opted in to receive communications from us. We never send unsolicited messages. You provide consent by:

• Initiating a conversation: When you message our WhatsApp number first, you are consenting to receive responses and related communications
• Engaging with our AI assistant: When you respond to messages and use our donation service, you consent to receive transaction-related messages
• Explicit opt-in: When you explicitly request to receive updates, campaign information, or newsletters via WhatsApp

Your consent is recorded and timestamped in our systems. We maintain records of all opt-ins to demonstrate compliance with Meta's policies and data protection regulations.

8.2 How to Opt-Out (Stop Receiving Messages)

You can opt out of receiving WhatsApp messages at any time. Simply:

• Reply with a keyword: Send "STOP", "UNSUBSCRIBE", "OPT OUT", or "CANCEL" to our WhatsApp number
• Contact us directly: Email us at imam.ammaar@darulihsaanbarking.org.uk or call 07838 586898
• Request via WhatsApp: Simply tell our AI assistant you wish to stop receiving messages

8.3 What Happens When You Opt-Out

Once you opt out:

• We will immediately stop sending you promotional and campaign messages
• Your opt-out preference is recorded and honored across all our systems
• You may still receive essential transaction-related messages (e.g., donation confirmations you specifically requested)
• You may still receive legally required communications (e.g., responses to charity regulatory inquiries)

You can opt back in at any time by messaging us again on WhatsApp or contacting us directly.

9. International Data Transfers

Some of the services we rely on are based outside the UK, which means your data is transferred there. These are the transfers that actually take place:

Service	What is transferred	Where
Meta (WhatsApp)	Your phone number and the messages you exchange with us	United States
Anthropic	The content of your assistant conversations, which may include your name, donation amount and address	United States
Stripe	Your payment details, name and email, to take the payment	United States (with UK/EEA processing)
Amazon Web Services (SES)	The emails we send you, including receipts, and your email address	United States

For each of these we rely on the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum, as the transfer mechanism. Each provider acts as our processor under a data processing agreement and may only use your data to provide the service to us.

Your payment card number is never transferred by us to anyone — it goes directly from your device to our payment provider and we never see or store it.

10. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately, and we will delete such information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Posting the updated Privacy Policy on this page
• Updating the "Last Updated" date at the top of this policy
• Sending you a notification via email or WhatsApp (if you have opted in)

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

12. Contact Us

13. Information Commissioner's Office (ICO)

If you are not satisfied with our response to your data protection concerns, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
United Kingdom

Website: https://ico.org.uk/
Phone: 0303 123 1113

14. Additional Information for Meta WhatsApp Business API

14.1 WhatsApp Business Account & API Usage

We operate a WhatsApp Business Account verified by Meta and use the WhatsApp Business API (also known as WhatsApp Cloud API) to communicate with donors and supporters. Our business account information:

• Business Name: East London Mosque
• Business Type: Registered Charity (1122613)
• Business Address: 82–92 Whitechapel Road, London E1 1JQ
• Business Website: https://donate.eastlondonmosque.org.uk
• Donation Platform: https://donate.eastlondonmosque.org.uk/

14.2 How We Use WhatsApp Business API

We use the WhatsApp Business API to:

• Receive and respond to donation inquiries from supporters
• Process charitable donations through our AI-powered assistant
• Send donation confirmations and receipts
• Provide customer support for donation-related questions
• Send campaign updates and appeals (only to opted-in users)

Important: Messages are only sent to users who have explicitly opted in by initiating a conversation with us or by responding to our communications. We never send unsolicited messages to users who have not engaged with us first.

14.3 Message Types

We send the following types of messages via WhatsApp:

• Campaign Messages: Updates about our work, appeals, and community activities (only to opted-in users)
• Transaction Messages: Donation confirmations and receipts
• Service Messages: Responses to inquiries and customer support

14.4 Data Processing Agreement

We have entered into Meta's Data Processing Terms for WhatsApp Business API, which govern how Meta processes personal data on our behalf in compliance with GDPR.

14.5 DPIA (Data Protection Impact Assessment)

We have conducted a Data Protection Impact Assessment (DPIA) that covers:

• How personal data flows through our system
• Data sharing with third parties (Meta, Stripe, Amazon Web Services, Anthropic)
• Security measures in place
• Risks and mitigation strategies
• Compliance with GDPR requirements

This DPIA is available upon request for regulatory review.

---

This Privacy Policy is effective as of September 14, 2026 and applies to all users of our donation platform and WhatsApp services.