Privacy

This draft describes information SOOCH uses to run a member’s own SOOCH record and, when applications are open, SOOCH Community Membership. It is not approved. The organisation’s legal name, address, and the person responsible for data protection have not been confirmed.

When someone creates an account, SOOCH keeps the details they provide for that record, such as their name and contact details, so they can sign in and keep their own information up to date.

A member may record next of kin, and family or dependants they look after. SOOCH uses that information so the member’s record is useful if the family later needs practical help.

Recording a family member or dependant does not create an account for them and does not let them see the member’s private record.

A member may record personal preferences, including wishes about burial, cremation, or repatriation. If they choose to record a faith or belief, SOOCH keeps it so the family and SOOCH can understand what mattered to the member.

Faith or belief information is especially sensitive. This draft does not decide the legal basis for recording it. That must be confirmed before the notice is approved.

A member may add important information they want available to their family. The current record does not ask for an NHS number. SOOCH does not provide medical care.

If an NHS number was saved before this change, it is kept and is not shown in the member record. Asking for it again would need a separate decision. That decision has not been made.

A member may store private documents with their record. SOOCH uses them so the member, and later the people helping their family, can find papers that the member chose to keep. Documents are not a public page.

When membership applications are open, SOOCH will keep the membership status, membership number, the dates of the paid period, and a record of each confirmed £100 payment. The contribution supports SOOCH’s community services. It is not held as a personal funeral balance.

Card payments are taken by Stripe on Stripe’s own page. SOOCH does not ask for the card number or card security code, and does not store them. Stripe’s own privacy notice applies to the payment page.

The contact form keeps the name, email address, topic, and message so SOOCH can reply. It should not be used for a SOOCH record, identity documents, or a detailed account of a death.

SOOCH keeps a limited record of important changes to a member’s information, and of security events needed to look after the service. Those records are used to protect the account and to understand what changed. They are not a public profile.

The information is used to provide the member’s SOOCH record, to operate community membership once applications are open, to support a family with practical arrangements after a death, to take and record the annual contribution, and to reply to messages.

The lawful basis for each use has not been confirmed in this draft, especially where the information is a faith, belief, or other sensitive detail.

Stripe receives the payment details needed to take the annual contribution. During bereavement support, SOOCH may contact an organisation the member or family has asked it to speak with, such as a funeral director or another provider. Those organisations are independent.

SOOCH does not sell member information. Other providers, and any transfer of information outside the United Kingdom, must be confirmed before this notice is approved.

A member’s account and SOOCH record remain when a membership ends, so the member can still sign in and look after their information. Retention periods for each kind of information have not been set in this draft and need legal confirmation.

A member can see and correct their own record while they are signed in. They can also ask SOOCH about their information using the contact page. The precise legal rights, and any limit on them, must be confirmed before this notice is approved. This draft does not state a statutory right that has not been checked.

Before this notice can be approved, a reviewer needs to confirm the data controller’s identity and address, whether a data-protection lead is required, the lawful basis for each purpose, the condition for faith or belief information, how long each kind of information is kept, and whether Stripe or another provider moves information outside the United Kingdom.