Privacy notice

Who we are

Lodge Platform is provided by Glimmers Store Limited, a company registered in England and Wales (company number 16017810). Registered office: Swinford House, Albion Street, Brierley Hill DY5 3EE. In this notice, "we", "us" and "our" mean Glimmers Store Limited, which runs Lodge Platform. Our registration number with the Information Commissioner's Office (ICO) is [ICO registration number — to be confirmed].

We have two roles under UK data protection law (the UK GDPR and the Data Protection Act 2018):

• For your account — your name, email address, password and how you use the service — we decide how the information is used. We are the controller.
• For the information a lodge puts into Lodge Platform — its seating plans, guest lists and lodge details — the lodge decides what is collected and why, and we look after it on the lodge's behalf. The lodge is the controller and we are its processor, under our lodge data processing agreement. If your details are in a lodge's seating plan and you have a question about them, please ask the lodge's Secretary first. If you contact us, we will pass your request to the lodge.

Questions about this notice or your information: web@lodgeofalliance.org.

What we collect

About you, when you have an account

• your name and email address;
• your password, which we store only in a scrambled (hashed) form that can't be turned back into the password;
• the lodges you belong to on Lodge Platform and what you can do for each;
• invitations you send (the email address and name you type) and requests to join a lodge, with any message;
• which version of our terms you agreed to, and when;
• security records: when you sign in, your internet (IP) address, and your browser type;
• emails you send us, and our replies.

For a lodge

• the lodge's name, number, Province and meeting place;
• seating plans: guests' names, ranks and offices, partners, contact details, meal choices, dietary and accessibility needs (which can be health information), whether dining has been paid for, notes, and pictures such as a crest or a floor plan;
• for a lodge website: what you tell us about the lodge, any photographs and logos you upload, and the drafts we make;
• when a lodge pays: who the account holder is, the billing email address, and a record of each payment and invoice. Card payments are handled by our payment provider, Stripe; we never see or store full card numbers.

We don't use your information for advertising, we don't sell it, and we don't use it to make automated decisions about you.

Why we use it, and our legal reasons

Dietary and health information

Dietary and accessibility needs in a seating plan can reveal health information, which the law treats as especially sensitive. The lodge decides whether to record it and needs its own legal reason (we recommend asking each person's clear agreement, and our data processing agreement says more). We protect it by:

• encrypting the contents of every seating plan, and its earlier versions, on our server;
• showing a lodge's plans only to the people on that lodge's team, and to our support staff when they help — every time support staff open a lodge's plans it is recorded;
• never sending seating plans to the AI service described below.

Who we share it with

We use a small number of trusted companies to run the service. They act on our instructions and must keep your information safe.

We may also share information if the law requires it, to protect people from harm, or if the business that runs Lodge Platform is sold or reorganised (the new owner would have to follow this notice).

The lodge website tools and AI

When someone uses the lodge website tools, the details they type about the lodge (for example its history, meeting place and officers' titles) are sent to Anthropic, an AI company in the USA, to write drafts. Seating plans are never sent. Anthropic's commercial terms say it does not use this information to train its AI models; it may keep it for a short time to check for misuse. Please don't type anything private into the website tools.

Information sent outside the UK

Some of the companies above are in, or may use, the USA. Where they do, the information is protected as UK law requires: by the UK–US "data bridge" for companies certified under it, or by the UK's approved data transfer agreement (the International Data Transfer Addendum) in our contract with them.

How long we keep it

Keeping it safe

• Every page is sent over an encrypted connection (HTTPS).
• The contents of seating plans are encrypted on our server, and the key that unlocks them is not stored in our backups.
• Passwords are hashed, and invitation links are stored in a form that can't be turned back into the link.
• Only a small number of support staff can reach the server, and what they do in lodges' plans is recorded.
• We keep regular backups, so that information isn't lost if something goes wrong.

Your rights

You have the right to:

• see the information we hold about you (a "subject access request");
• have it corrected if it is wrong;
• have it deleted;
• ask us to limit how we use it, or object to how we use it;
• have a copy to take elsewhere (you can download your lodge's plans at any time);
• withdraw your agreement, where we rely on it.

Email web@lodgeofalliance.org. We will reply within one month. There is no charge.

If you are unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or 0303 123 1113.

Cookies

We use only the cookies the service needs to work, such as the one that keeps you signed in. Our cookies page lists them.

Changes to this notice

Each version of this notice has a number and a date at the top. If we make an important change we will tell account holders by email or on screen.