Privacy Policy
This page explains what information we collect, why we collect it, and how we keep it safe.
Privacy Policy
Luton Muslim Burial Association (LMBA) Last updated: July 2026
1. Who we are
The Luton Muslim Burial Association ("LMBA", "we", "us") is an unincorporated community association based in Luton. We operate a pooled mutual support fund, grounded in the Islamic principles of ta'awun (mutual cooperation) and tabarru' (voluntary contribution), to help members of our community with funeral costs.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, LMBA is the data controller of your personal information. Day-to-day responsibility for data protection rests with the LMBA Committee.
If you have any questions about this policy or how we handle your information, please contact:
Data Protection Contact, LMBA Committee Email: info@lutonmuslimburial.com
2. The information we collect
When you apply to join LMBA, and during your membership, we collect:
Identity and contact details — your name, date of birth, address, telephone number and email address. We use your date of birth to place you in the correct joining contribution age band.
Identity documents — a copy of a document such as a passport, driving licence or similar, which we use to verify your identity when you apply.
Medical declaration — the health declaration you complete as part of your application. This is health information, which the law treats as special category data and protects more strictly (see section 4).
Household and next-of-kin details — where your membership covers family members, or where you give us details of a next of kin or emergency contact. If you give us information about another person, please make sure they are aware of this policy.
Payment information — records of your joining contribution and any ongoing contributions, including the bank details shown on payments you make to our account. We do not store debit or credit card numbers.
Correspondence — records of letters, emails, forms and messages between you and the Committee.
We collect this information directly from you. We do not buy information about you from anyone else.
3. Why we use your information, and our lawful bases
UK GDPR requires us to have a lawful basis for every use of your personal information. These are the ways we use your information and the lawful basis for each:
What we do | Lawful basis (Article 6, UK GDPR) |
|---|---|
Assessing your application and administering your membership, including keeping the membership register and contacting you about your membership | Performance of a contract — the membership agreement between you and LMBA set out in our Terms and Conditions |
Verifying your identity and preventing fraud or misuse of the pooled fund | Legitimate interests — protecting the fund that all members contribute to |
Recording contributions, managing our bank account and keeping proper financial records | Legitimate interests, and legal obligation where accounting or tax rules require records to be kept |
Considering and administering discretionary support from the pooled fund | Performance of a contract, and legitimate interests in administering the fund fairly |
Sending you updates about LMBA by email, post or WhatsApp | Legitimate interests for essential membership communications; consent for anything optional — you can opt out of optional messages at any time |
Responding to your enquiries and complaints | Legitimate interests |
Where we rely on legitimate interests, we have balanced those interests against your rights and do not use your information in ways you would not reasonably expect.
4. Your medical declaration (special category data)
Your medical declaration contains information about your health. Under Article 9 of UK GDPR, we may only process health information where a specific condition applies. We rely on:
- Your explicit consent (Article 9(2)(a)) — you give this when you sign the medical declaration as part of your application; and
- Processing by a not-for-profit body (Article 9(2)(d)) — as a not-for-profit association with a religious aim, we may process this information about our own members in the course of our legitimate activities, and we do not disclose it outside LMBA without your consent.
We use your medical declaration only to assess your application and administer your membership. Access is restricted to the Committee members who need it, and it is never shared outside LMBA without your consent unless the law requires it.
You may withdraw your consent at any time by contacting us. If you do, we will explain what this means for your membership before anything changes.
5. Who we share your information with
We do not sell your information, and we do not share it for marketing. We share information only where necessary:
- Our bank (NatWest), to administer contributions and payments from the pooled fund;
- Funeral service providers, only where needed to arrange support that the Committee has agreed to provide, and only the minimum details required;
- Professional advisers (for example an accountant or solicitor), where we need their advice;
- Authorities, where the law requires us to share information.
Within LMBA, your information is seen only by Committee members who need it to carry out their role.
6. Where your information is kept
Your information is stored in the United Kingdom. We do not transfer it outside the UK. If we ever use a service provider that stores data outside the UK, we will only do so with safeguards that UK GDPR permits.
7. How long we keep your information
- Membership records and correspondence — for the duration of your membership, and for 6 years afterwards, in line with the legal limitation period.
- Financial records — for 6 years after the end of the financial year they relate to.
- Identity documents — kept securely on file for the duration of your membership, and for 6 years afterwards, alongside your membership records.
- Medical declarations — for the duration of your membership, then securely deleted within 12 months of your membership ending.
When information is no longer needed, we delete or securely destroy it.
8. How we keep your information safe
We take appropriate steps to protect your information, including restricting access to named Committee members, storing records securely, using dual authorisation on payments from our bank account, and keeping electronic records password-protected. No system is completely secure, but we review our arrangements regularly.
9. Your rights
Under UK GDPR you have the right to:
- Access the personal information we hold about you;
- Correct information that is inaccurate or incomplete;
- Erase your information in certain circumstances;
- Restrict how we use your information in certain circumstances;
- Object to processing based on legitimate interests;
- Data portability — receive certain information in a portable format;
- Withdraw consent at any time, where we rely on consent (including for your medical declaration).
To exercise any of these rights, contact us using the details in section 1. We will respond within one month. There is no charge.
10. How to complain
If you are unhappy with how we have handled your information, please contact the LMBA Committee first so we can try to put things right.
You also have the right to complain to the UK's data protection regulator:
Information Commissioner's Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 Website: ico.org.uk/make-a-complaint
11. Changes to this policy
We may update this policy from time to time. The latest version will always be published on lutonmuslimburial.com, with the date it was last updated shown at the top. If we make a significant change, we will tell members directly.