This Privacy Notice is published by Moreton & Cresswell Gardens Limited, a private not-for-profit company limited by guarantee, incorporated in England and Wales under company number 05579173, with its registered office at 3 Cresswell Gardens, London, England, SW5 0BJ (the “Company”, “we”, “us”, “our”).
The Company is the not-for-profit entity that exists to maintain and manage the Moreton and Cresswell Gardens (the “Garden”) on behalf of the residents of the qualifying dwellings under the Kensington Improvement Act 1851 (as amended).
For the purposes of the UK General Data Protection Regulation (the “UK GDPR”) and the Data Protection Act 2018, the Company is the data controller in respect of the personal data described in this Notice.
The Garden Committee, through its Garden Committee Admins (the Chairperson, the Secretary and the Treasurer), administers the Members’ Area on behalf of the Company.
The Members’ Area is both:
(a) the official register of households entitled to use the Moreton and Cresswell Gardens. Inclusion in the register is the basis on which the Garden Committee issues a Garden key (one per household, as required by the Garden Bye-Laws); and
(b) the Garden Committee’s advisory consultation tool, used to ask residents what they think about garden-related questions before the Committee takes formal decisions.
Polls held in the Members’ Area are advisory only. They are not formal votes of the Garden Committee under the Kensington Improvement Act 1851; the Garden Committee continues to take its formal decisions at meetings convened in the ordinary way.
Both purposes — register maintenance and consultation — are activities the Garden Committee ordinarily carries out under the Bye-Laws (made under section 45 of the Kensington Improvement Act 1851). The Company’s lawful basis for processing your data is consent (when you apply and accept this Notice) together with legitimate interests (in running an organised register and consultation tool among the residents the Company exists to serve).
This Notice applies to applicants for the Members’ Area; members of the Members’ Area; and visitors to https://members.mandcgardens.org. It does not apply to the public website at https://mandcgardens.org, which has its own arrangements.
You also send one item of documentary evidence of your eligibility (a Council Tax bill, tenancy agreement, registered title or current utility bill — see the Application Requirements for the full list) directly to the Garden Committee Secretary, by email to info@mandcgardens.org or in person. This evidence is not uploaded through the website and is not stored in the Members’ Area database.
The Secretary holds your evidence separately from the website. The Secretary keeps it only for as long as needed to verify your eligibility — typically until your application is decided, and in any event no longer than ninety (90) days after the decision (or, for active members, in the Garden Committee’s separate register-of-evidence file, until you cease to be a member, then no more than one year). You are asked to redact information that is not strictly needed for verification (for example bank or sort-code details on utility bills) before you send.
| Purpose | Lawful basis |
|---|---|
| To decide on your application | Article 6(1)(b) — necessary to take steps at your request prior to entering into a contract |
| To maintain the official register of households entitled to use the Garden, and to administer the issuing of Garden keys (one per household) | Article 6(1)(f) — legitimate interests (the Garden Committee carrying out its ordinary administrative duties under the Bye-Laws made under section 45 of the Kensington Improvement Act 1851) |
| To maintain the list of members and to reach you | Article 6(1)(f) — legitimate interests (running an organised consultation tool for the benefit of the Garden’s residents) |
| To enable you to sign in and to record and review your consultation responses | Article 6(1)(b) — necessary for the service you have asked for |
| To send you transactional emails (sign-in codes, consultation invitations, reminders, application-status updates) | Article 6(1)(f) — legitimate interests |
| To detect and prevent fraud, abuse or misuse | Article 6(1)(f) — legitimate interests |
| To meet our obligations to keep accurate records and to respond to data-subject rights requests | Article 6(1)(c) — compliance with a legal obligation |
We have considered the balance of the Company’s legitimate interests against your rights and freedoms and are satisfied that processing for these purposes is necessary and proportionate. You have the right to object to processing based on legitimate interests; see section 9.
We share your personal data only with the following recipients, all of whom act as data processors under written contracts with the Company:
| Recipient | Purpose | Country |
|---|---|---|
| Supabase Inc. | Hosting our database; authenticating sign-in; sending sign-in emails | UK or European Economic Area |
| Resend Inc. | Delivering Members’ Area emails to you | United States (we rely on the UK International Data Transfer Agreement) |
| IONOS SE | Hosting the Members’ Area website | Germany |
| Garden Committee Admins | Application review, member management, viewing the audit log | United Kingdom |
We do not sell or rent your personal data and we do not share it for marketing purposes.
In rare circumstances we may also share your personal data with our professional advisers (e.g. solicitor or accountant) where necessary; or with law-enforcement, regulators or other public authorities where we are required to do so by law or court order, or where disclosure is necessary to protect the safety of any person.
Our email provider (Resend Inc.) is in the United States. Where personal data is transferred to a country that is not the subject of UK adequacy regulations, we rely on the United Kingdom International Data Transfer Agreement (or the European Commission’s Standard Contractual Clauses together with the UK Addendum) to ensure your personal data continues to receive an essentially equivalent level of protection. Copies are available on request.
We may keep personal data longer than the above if we are required to do so by law or where there is an ongoing dispute or investigation.
Under the UK GDPR you have the rights set out below. To exercise any of them, contact us using the details in section 12.
Exercising your rights is free of charge. We may charge a reasonable fee or refuse to act on a request that is manifestly unfounded, excessive or repetitive.
The Members’ Area uses the following technically necessary cookies, which do not require your consent under the Privacy and Electronic Communications (EC Directive) Regulations 2003:
| Name | Purpose | Expiry |
|---|---|---|
sb-access-token | Keeps you signed in for the duration of your session | Up to 7 days (your choice) |
sb-refresh-token | Allows your session to be refreshed without you re-entering a code | Up to 7 days |
We do not use cookies for analytics, marketing or behavioural advertising.
The Company has assessed its position under the Data Protection (Charges and Information) Regulations 2018. Based on the Company’s not-for-profit status and the limited purposes for which it processes personal data, the Company considers that it qualifies for the not-for-profit exemption from the obligation to pay the annual data-protection fee to the Information Commissioner. The Company will keep this position under review and pay the fee if and when the exemption ceases to apply.
Moreton & Cresswell Gardens Limited
Company number: 05579173
Registered office: 3 Cresswell Gardens, London, England, SW5 0BJ
Email: info@mandcgardens.org
You may also raise a concern with the United Kingdom Information Commissioner’s Office, online: https://ico.org.uk/make-a-complaint/, by post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or by telephone: 0303 123 1113.
We may update this Notice from time to time. Where the changes are material, we will notify you by email at least fourteen (14) days before they take effect, and we will publish a tracked-changes version on the Members’ Area. Where the changes are minor, we will publish the updated version with the new date at the top.