The Boiler House Community Space, operating as Boiler House Spaces (“we”, “us”, “our”), is committed to protecting your personal information and using it responsibly. This notice explains what information we collect, why, and what your rights are.
We are the data controller for the information described here.
- Registered charity number: 1148931
- Company number: 07458912
- Address: The Boiler House Community Centre, George Downing Estate, Cazenove Road, London N16 6BE
- Contact: info@boilerhousespaces.com · 020 8806 8013
- ICO registration: ZA125642
This notice is effective from 27 May 2026.
1. The information we collect
Good Place membership and Pantry bookings
When you register as a Good Place member, and when you book Pantry places, we collect:
- Your name, home address and postcode
- Date of birth and gender
- Phone number and email address
- Ethnicity (optional — you can choose “prefer not to say”; see section 2)
- Whether you are registered disabled (see section 2)
- Your employment status, and — if you receive benefits — which benefits, together with any evidence of benefits or low income you upload (for example a Universal Credit award), so we can confirm eligibility
- Your housing situation, including whether you are a Southern Housing resident
- Household information — how many people live with you, and how many are under 5, under 16 or over 65
- Whether you have any allergies or dietary requirements (including Halal), and the details (see section 2)
- Whether you’d like to join the Good Place WhatsApp group
- Whether we may contact you about our services
- Whether you were referred by another organisation, and the referral details
- How you heard about us, and anything else you tell us in the additional information box
- Your weekly £2 booking payment (handled by our payment provider — see section 4)
Space and hall hire bookings
When you book one of our spaces, we collect:
- Name
- Email address
- Phone number
- Home address
- How many people will attend
- How you heard about us
- Your confirmation about bouncy castles, personal announcement and DJ systems (we ask this for safety, licensing and insurance reasons)
- Anything you tell us in the comments box
- Your hire payment (handled by our payment provider)
Donations
If you donate, we collect your name, email address and payment details. If you choose Gift Aid, we also collect your home address and your confirmation that you are a UK taxpayer, so we can claim Gift Aid from HMRC.
Volunteers and trustees
If you apply to volunteer or become a trustee, we collect the information in your application and, where relevant, references and checks needed for the role (including safeguarding checks where required).
Our website
When you use our website, our host keeps standard server logs (such as your IP address and pages visited) to keep the site secure and working. We use cookies and analytics only as described in section 9.
2. Sensitive information
Some of what we collect needs extra care — either because the law treats it as special category data, or because it concerns people in vulnerable circumstances:
- Ethnicity, disability and health/allergy information are special category data. We collect them to offer suitable support, to check eligibility, and to monitor that we reach our community fairly. Ethnicity is optional (you can choose “prefer not to say”), and you never have to give more than you want.
- Dietary requirements, including Halal, can reveal your religion, so we treat them as special category data too. They are optional.
- Allergies are health information; we use them only to keep you safe.
- Your benefits, income, housing situation and household details tell us you may be facing hardship. We use them only to confirm eligibility and provide support, store any evidence you upload securely, and never share more than we need.
- Children. We ask how many children live in your household so we can offer suitable support. We keep this to a minimum and don’t collect their names through this form.
- Additional information. Please only include what you want us to know; we’ll handle anything sensitive carefully.
Where we process special category data, we rely on a recognised condition under data protection law — typically your explicit consent, our legitimate activities as a not-for-profit, and/or equality-of-opportunity monitoring — and we keep an internal Appropriate Policy Document explaining how we protect it. You can withdraw any consent at any time.
3. Why we use your information and our lawful basis
| What we use it for | Lawful basis |
|---|---|
| Taking and managing your Pantry or hire booking | Performance of the service you ask us for; and our legitimate interests in running our services |
| Confirming your eligibility for the Pantry (benefits, income, housing) | Performance of the service; our legitimate interests in running it fairly |
| Offering suitable food and keeping you safe (Halal / dietary / allergies) | Your explicit consent; protecting vital interests for serious allergies (special category data) |
| Equality monitoring (ethnicity, disability) | Our legitimate interests, with the equality-of-opportunity / not-for-profit condition for special category data |
| Handling referrals to and from other organisations | Our legitimate interests |
| Contacting you about our services / WhatsApp group | Your consent |
| Taking payment | Performance of the service; legal obligation (financial records) |
| Processing donations and claiming Gift Aid | Performance of your donation; legal obligation (Gift Aid / HMRC and financial records) |
| Keeping you safe and meeting licensing/insurance requirements | Our legitimate interests and legal obligations |
| Managing volunteers and trustees, including safeguarding | Contract, legal obligation, and protecting people’s vital interests where needed |
| Understanding who we reach and reporting to funders (usually anonymised) | Our legitimate interests |
| Keeping our website secure | Our legitimate interests |
You can withdraw any consent at any time by contacting us — this won’t affect anything we did before you withdrew it.
4. Who we share your information with
We do not sell your information. We share it only where we need to:
- Our service providers, who process information on our instructions under contract — for example our booking and CRM systems (SimplyBook.me and Plinth), our donation platform (WP Charitable), our payment providers (Stripe and Square), and our website host (Pressable). If we introduce a newsletter, we will use a reputable email provider (e.g. Mailchimp or MailPoet) and update this notice. Some of these operate outside the UK; see section 6.
- Funders, usually as anonymised or aggregated numbers; we only share details that identify you where we have a lawful basis and have told you.
- Referring organisations. If another organisation referred you to us, or we refer you on for support, we share only what is necessary for that referral and with your knowledge.
- Authorities or others where we are legally required to, or to protect someone’s safety (for example a safeguarding concern).
5. How long we keep your information
We keep your information only as long as we need it:
- Good Place membership and Pantry/hire booking records: 2 years after your last contact with us
- Benefit or low-income evidence you upload (e.g. award letters): 2 years, in line with your membership record
- Volunteer and trustee records: while you are involved with us, plus 2 years
- Donation, Gift Aid, financial and payment records: 6 years plus the current year (legal / HMRC requirement)
We then securely delete or anonymise it. Full details are in our internal retention schedule.
6. Where your information is stored
Your information is stored in the UK or, where one of our providers operates elsewhere, in countries that provide proper protection. If any information is transferred outside the UK, we make sure it is protected by a recognised safeguard (such as UK adequacy or the UK International Data Transfer Agreement).
7. Your rights
You have the right to:
- be told how we use your information (this notice);
- access the information we hold about you;
- correct anything inaccurate;
- erase your information (where it applies);
- restrict or object to how we use it;
- ask us to transfer it (data portability); and
- withdraw consent at any time.
To exercise any of these, contact us using the details above. We’ll respond within one month. You don’t have to pay, and we’ll ask you to confirm your identity first.
8. Children
Some of our activities involve families and children. Where we collect a child’s information we keep it to a minimum and, where consent is the basis, we ask a parent or guardian for children under 13.
9. Cookies and analytics
We keep tracking to a minimum.
- Analytics: we use Plausible Analytics, a privacy-focused tool that works without cookies and without collecting any personal data — it doesn’t track you across sites or build a profile of you, so it needs no consent.
- Booking: our booking tool is provided by SimplyBook.me and embedded in our site. When you open and use the booking tool, SimplyBook.me sets its own cookies so the booking can work. Please see SimplyBook.me’s own privacy and cookie information for details.
- Other cookies: we otherwise use only cookies that are strictly necessary to make the website work. If we add any non-essential cookies, we will ask for your consent first.
10. Complaints
If you’re unhappy with how we’ve handled your information, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: ico.org.uk · 0303 123 1113.
11. Changes to this notice
We may update this notice from time to time. The latest version will always be on our website, and we’ll tell you about any significant changes.