The Heron Island Residents Association (“HIRA”, “we”, “us”) is a small, volunteer-run association for the residents of Heron Island, Caversham. We respect your privacy and collect as little information as we can. This policy explains what we hold, why, and what you can do about it.
For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), the data controller is the Heron Island Residents Association. You can reach us at committee@heronisland.org.uk.
Our approach in short
- We do not use any website analytics, advertising, or visitor-tracking tools.
- We do not sell, rent, or trade your personal information to anyone, ever, and we do not use it for marketing.
- The website sets only one cookie, and only if you choose to sign in to the members area.
- We only collect what we genuinely need to run the association and its members area.
What we collect and why
Members area sign-in
The members area uses a passwordless login. We hold a list of the email addresses of residents who are entitled to access it. When you ask to sign in, you enter your email address and we email you a one-time link. To make this work we briefly process:
- Your email address — to check it against our members list and to send your login link.
- A temporary login token — a random code tied to your request, which expires after 30 minutes and can be used only once.
- Your IP address, very briefly — used only to limit repeated login attempts (a simple anti-abuse measure). It is not stored beyond that short window and is not used to identify or track you.
Our lawful basis for this is our legitimate interest in administering the association and providing a secure members area to entitled residents.
Contacting us
If you email the committee, we will see your email address and whatever you choose to put in your message. We use this only to respond to you and to deal with the matter you raised. We keep correspondence only for as long as it is useful, then delete it.
Our WhatsApp group (optional)
We run an optional WhatsApp group for residents who would like a quick, informal way to stay in touch about island matters. Joining is entirely voluntary — there is no obligation to take part, and you can leave whenever you wish. Our lawful basis for the group is your consent, given when you choose to join.
If you take part, please be aware that:
- Your mobile number, and your WhatsApp profile name and photo, will be visible to the other members of the group, and anything you post can be seen by everyone in it.
- WhatsApp is provided by Meta, which processes your information under its own terms and privacy policy, and may process it outside the UK. We have no control over how WhatsApp handles your data.
- The group’s administrators (committee volunteers) can see who is in the group and may add or remove members. We use the group only for community and association matters, never for marketing.
- You can leave the group yourself at any time, or ask an administrator to remove you. Please also be considerate and avoid sharing other people’s personal information in the group.
Committee details
The members area shows the names, roles and contact details of committee members. These are published with each member’s agreement so that residents can get in touch, and can be removed on request.
Website logs (handled by our host)
Like virtually all websites, our hosting provider keeps standard server logs that may record information such as IP addresses, browser type, and the pages requested. These are generated automatically by the web server for security and troubleshooting, are retained by our host for a limited period, and are not used by us for analytics or tracking.
Cookies
A cookie is a small file a website can store on your device. This site uses only strictly necessary cookies — the kind needed to make a feature work — and no analytics, advertising, or tracking cookies. Because of this, no cookie-consent banner is required, although we explain our cookies here for transparency.
- hira_member — set only if you sign in to the members area. It keeps you signed in for up to 30 days and contains your email address with a security signature. It is “HttpOnly” (not readable by scripts) and is removed when you log out.
- WordPress administration cookies — set only for the committee members who log in to manage the website. These are standard WordPress functional cookies needed to keep them signed in to the admin area. Ordinary visitors and members never receive them.
WordPress itself sets no tracking cookies for ordinary visitors, and we use no Google Analytics, no Google Tag Manager, and no advertising or social-media tracking pixels.
Who we share information with
We do not sell or share your personal information for any commercial purpose. The only third parties who may process data on our behalf are the service providers that make the website run:
- Our website host (Krystal Hosting), which stores the website and its data and keeps the server logs described above.
- The email service used to send members’ login links, which handles the delivery of those emails.
These providers act on our instructions and are not permitted to use your information for their own purposes. We may also disclose information if we are legally required to do so.
Where your information is kept
We aim to keep personal information on services located in the UK or European Economic Area. Where a provider processes data elsewhere, they do so under safeguards required by UK data protection law.
How long we keep it
- Members’ email addresses: for as long as you are a resident or member, or until you ask us to remove you.
- Login tokens: 30 minutes, then automatically deleted.
- The hira_member sign-in cookie: up to 30 days, or until you log out.
- Email correspondence: only as long as needed to deal with your enquiry.
- Server logs: for the limited period set by our host.
Your rights
Under UK data protection law you have the right to ask us to: confirm what information we hold about you and give you a copy; correct anything that is wrong; delete your information; restrict or object to how we use it; and, where relevant, provide it in a portable format. To exercise any of these, email committee@heronisland.org.uk and we will respond within one month.
Complaints
If you are unhappy with how we have handled your information, please contact us first so we can put things right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk or on 0303 123 1113.
Children
This website is intended for adult residents of Heron Island and is not directed at children. We do not knowingly collect information about children.
Links to other websites
Our site links to external websites (for example local councils and the Environment Agency). We are not responsible for their content or privacy practices, and we encourage you to read the privacy policy of any site you visit.
Changes to this policy
We may update this policy from time to time. Any changes will be posted on this page with a revised date below.
Last updated: June 2026.