Privacy notice
How Walk4Sahibzaade CIC uses personal data, and your rights under UK GDPR.
Last updated 9 November 2026.
Last updated: 9 November 2026
Who we are
Walk4Sahibzaade CIC is a community interest company based in London, United Kingdom. We organise Walk 4 Sahibzaade, the annual walk held from 22 to 27 December that commemorates the martyrdom of the four Sahibzaade, the sons of Guru Gobind Singh Ji. We are the data controller for the personal data described in this notice. Registration details will be added here once Companies House confirms them.
If you have a question about your personal data, email [email protected]. For anything else, email [email protected].
What this notice covers
This notice explains what personal data we collect through walk4sahibzaade.com, why we collect it, how long we keep it and what your rights are. It covers the contact form, the Kadam app waitlist, merch pre-order registration and the Gurdwara or organisation interest form. It does not cover the Kadam app itself, which will have its own privacy notice when it launches, and it does not cover what social media platforms do with your data when you post with #Walk4Sahibzaade or choose to load their embedded content on our pages.
What we collect and why
| Activity | Data | Lawful basis | Kept for |
|---|---|---|---|
| Contact form | Name, email address, phone number, your message | Taking steps at your request before any agreement, and our legitimate interest in answering enquiries | 12 months from the last message in the conversation |
| Kadam app waitlist | Email address, optional name, preferred platform (iOS, Android or both), consent record (the wording you agreed to, the time, and a hashed version of your IP address) | Consent, which you can withdraw at any time | Until the app launches plus 6 months, or until you unsubscribe, whichever is sooner |
| Merch pre-order registration | Name, email address, optional phone number, items and sizes requested, delivery preference, notes, optional consent to receive updates | Taking steps at your request before a contract; consent for any updates emails | 12 months after the order is fulfilled or cancelled |
| Gurdwara or organisation interest | Same as the waitlist: email address, optional name or organisation, consent record | Consent | Until the following year's walk plus 6 months, or until you unsubscribe |
| Security and anti-spam | Hashed IP address, time of request, form submitted. We do not store the raw IP address. | Legitimate interest in keeping the site working and free of spam | 30 days |
| Backups | Copies of the above | Legitimate interest in being able to restore the service | 14 days, rolling |
We do not take payments on this website. If you register a pre-order, we will email you a payment link later. The payment itself is handled by the payment provider named in that email, under its own terms and privacy notice.
Our web analytics are provided by Cloudflare and are cookieless. They show us how many people visit each page and which country they are in. They do not identify you.
Marketing emails and consent
We only send marketing emails, such as news about the Kadam app or the walk, if you have asked for them. When you sign up we send one confirmation email first. Nothing further is sent until you click the link in that email (this is called double opt-in). Every marketing email contains an unsubscribe link, and you can also email [email protected] to be removed.
Some emails are service emails rather than marketing: the confirmation email itself, the acknowledgement of a contact form message, and pre-order confirmations and payment links. We send these because you asked us to do something, and they do not need separate consent.
Who we share data with
We use a small number of service providers (processors) who handle data on our instructions. We do not sell personal data and we do not share it for advertising.
| Provider | What they do for us | Where data is processed |
|---|---|---|
| Hostinger International Ltd | Hosts our web server and database | United Kingdom data centre |
| Cloudflare Inc | DNS, content delivery, security filtering, cookieless web analytics | Its global network, including the EU and US, under the UK Addendum to the EU Standard Contractual Clauses |
| Resend Inc | Sends our emails (confirmations, acknowledgements, pre-order emails) | EU region (Ireland) |
| Google LLC | Provides the Gmail mailbox where contact messages and notifications are read by our volunteers | United States, under the UK Addendum and the International Data Transfer Agreement |
Embedded content from YouTube, Instagram, Facebook and X only loads if you allow "embedded media" in our cookie settings. When you do, those platforms receive your IP address and may set their own cookies. They act as independent controllers for that processing, and their own privacy notices apply.
We may also disclose data if the law requires it, for example to a court or regulator.
International transfers
Our server and database are in the United Kingdom. Some providers listed above process data outside the UK. Where that happens we rely on the UK Addendum to the EU Standard Contractual Clauses or the UK International Data Transfer Agreement, which are the safeguards recognised under UK data protection law.
Security
The site is served over HTTPS only. Forms are protected against automated abuse by rate limiting and hidden checks rather than tracking. Passwords for our systems are stored as one-way hashes. Access to the database and the admin area is restricted to named volunteers. Backups are taken daily and kept for 14 days. No system is perfectly secure, and if a breach ever affected your data we would tell you and the Information Commissioner's Office as the law requires.
Your rights
Under the UK General Data Protection Regulation you have the right to:
- ask for a copy of the personal data we hold about you (access);
- have inaccurate data corrected (rectification);
- have your data deleted where there is no good reason for us to keep it (erasure);
- ask us to limit how we use your data while a question is resolved (restriction);
- receive the data you gave us in a machine-readable format (portability);
- object to processing based on our legitimate interests (objection);
- withdraw consent at any time, without affecting what was done before you withdrew it.
To exercise any of these rights, email [email protected]. We will respond within one month. We may ask you to confirm your identity first.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or by phone on 0303 123 1113. We would appreciate the chance to put things right first.
Children
The forms on this website are for people aged 16 and over. If you are under 16, please ask a parent or guardian to sign up or get in touch for you. Children are very welcome to walk with their families during the walk itself. The Kadam app will have its own privacy notice and a parental consent process designed for younger users.
Changes
We will update this notice when our practices change, for example when the Kadam app launches or when Companies House confirms our registration. The date at the top shows when it was last changed. Significant changes will be announced on the website.
Contact
Walk4Sahibzaade CIC, London, United Kingdom. Privacy questions: [email protected]. General enquiries: [email protected]. Registration details will be added here once Companies House confirms them.