Become a Member Member Login

Privacy Notice

Nalanda Old Boys’ Association UK

Effective date: 20 August 2026
Last reviewed: 20 August 20261. ABOUT THIS PRIVACY NOTICE

Nalanda Old Boys’ Association UK (“NOBA UK”, “the Association”, “we”, “us” or “our”) is committed to protecting the privacy and personal information of its members, prospective members, supporters, volunteers, event participants and other individuals who interact with the Association.

This Privacy Notice explains what personal information we collect, why we collect it, how we use and protect it, who we may share it with, how long we retain it, and the rights individuals have in relation to their personal information.

We process personal information in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Data (Use and Access) Act 2025, as amended from time to time.

For the personal information covered by this Privacy Notice, NOBA UK will normally act as the data controller, meaning that we determine the purposes and means by which personal information is processed.

2. PERSONAL INFORMATION WE MAY COLLECT

We only collect personal information that is reasonably necessary for the activities and administration of the Association.

Depending on your relationship with NOBA UK, this may include:

  • full name;
  • email address;
  • telephone or mobile number;
  • postal address;
  • membership information;
  • Nalanda College attendance information, including relevant years or cohort/batch information;
  • information reasonably required to establish or verify eligibility for membership;
  • membership status and membership history;
  • account username and authentication information;
  • communication preferences;
  • records of correspondence with the Association;
  • event registrations and attendance;
  • committee, office-bearer, volunteer or other Association roles;
  • information relating to payments, subscriptions, donations or event fees;
  • photographs or video recordings taken at Association events, where appropriate;
  • technical information generated when you use our website or online services, such as IP address, browser information and basic website usage information; and
  • any other information you voluntarily provide to us.

We seek to collect only information that is adequate, relevant and limited to what is necessary for the purpose for which it is processed.

Payment information

Where payments are made electronically through a third-party payment provider, payment card information may be processed directly by that provider.

NOBA UK does not intentionally store complete payment card numbers, card security codes or other full payment credentials unless this is expressly required and appropriate safeguards are in place.

3. HOW WE COLLECT PERSONAL INFORMATION

We may collect personal information:

  • directly from you when you join, register, update or verify your membership details;
  • when you create or maintain an online account;
  • when you contact or correspond with us;
  • when you register for or attend an Association event or activity;
  • when you make a payment, donation or membership contribution;
  • when you volunteer or serve on the Committee or in another Association role;
  • through our website and associated systems;
  • from existing Association membership records; and
  • where reasonably necessary, from other legitimate sources for the purpose of verifying membership or maintaining accurate Association records.

Where information is obtained from another source, we will handle it in accordance with applicable data protection law.

4. WHY WE PROCESS YOUR PERSONAL INFORMATION

We may process personal information for the following purposes:

Membership administration

To:

  • establish and maintain an accurate register of NOBA UK members;
  • determine or verify eligibility for membership;
  • update and verify member information;
  • administer membership applications, renewals and membership status;
  • authenticate members and manage member accounts; and
  • maintain accurate historical and administrative records of the Association.

Association administration and governance

To:

  • administer the Association in accordance with its Constitution;
  • communicate notices, meetings, Annual General Meetings and other Association business;
  • administer elections, nominations and voting processes;
  • maintain records required for proper governance and accountability;
  • administer Committee and volunteer activities; and
  • meet applicable legal and regulatory obligations.

Communications

To:

  • communicate with members about Association activities;
  • provide administrative and membership information;
  • distribute newsletters and Association updates;
  • notify members about events, programmes, projects and activities; and
  • respond to enquiries and requests.

Events and activities

To:

  • organise and administer Association events and activities;
  • manage registrations, attendance and payments;
  • communicate with participants; and
  • maintain appropriate records relating to those activities.

Financial administration

To:

  • administer membership fees, donations, event payments and other authorised transactions;
  • maintain appropriate accounting and financial records; and
  • comply with legal, taxation, accounting and regulatory requirements.

Security and protection

To:

  • protect the Association’s website, membership database and other systems;
  • prevent unauthorised access, fraud or misuse;
  • verify identity where appropriate; and
  • protect the rights, property and interests of the Association and its members.

5. OUR LAWFUL BASES FOR PROCESSING

Under UK data protection law, we must have a lawful basis for processing personal information. Depending upon the particular processing activity, we may rely on one or more of the following:

Legitimate interests

We may process personal information where it is necessary for the legitimate interests of NOBA UK or its members and those interests are not overridden by the individual’s interests, rights or freedoms.

Our legitimate interests may include:

  • maintaining an accurate membership database;
  • administering and developing the Association;
  • verifying membership;
  • communicating with members about Association matters;
  • organising events and activities;
  • maintaining appropriate governance records;
  • protecting Association systems and information;
  • preventing fraud, misuse or unauthorised access; and
  • promoting participation in the legitimate activities and objects of the Association.

Where we rely on legitimate interests, we will consider the necessity and proportionality of the processing and the impact upon the individuals concerned.

Contract

We may process information where this is necessary to perform a contract with you or to take steps at your request before entering into a contract.

Legal obligation

We may process personal information where this is necessary to comply with a legal or regulatory obligation to which the Association is subject.

Consent

Where appropriate, we may rely upon your consent. Where processing is based upon consent, you may withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing undertaken before consent was withdrawn.

Vital interests

In exceptional circumstances, we may process personal information where necessary to protect someone’s life or vital interests.

Different lawful bases may apply to different processing activities.

6. MARKETING AND ASSOCIATION COMMUNICATIONS

We may communicate with members about the administration, governance, events, activities and purposes of NOBA UK where we have an appropriate lawful basis for doing so.

Where a communication constitutes direct marketing, we will comply with applicable data protection and electronic communications requirements.

Where required, we will obtain consent before sending marketing communications.

You may opt out of marketing communications at any time by using an unsubscribe facility provided in the communication, where available, or by contacting us.

Opting out of marketing communications will not necessarily prevent us from sending essential administrative, governance, membership or service-related communications where we have another lawful basis for doing so.

7. COOKIES AND WEBSITE INFORMATION

Our website may use cookies and similar technologies that are necessary for its operation, security and functionality.

Where non-essential cookies, analytics or similar technologies are used, we will provide appropriate information and obtain consent where required by law.

Further information may be provided through a separate Cookie Notice or cookie-management facility on our website.

8. SHARING PERSONAL INFORMATION

NOBA UK does not sell members’ personal information.

We may share personal information only where reasonably necessary and where there is an appropriate lawful basis.

This may include sharing information with:

  • authorised Committee members, office-bearers or volunteers who require access for legitimate Association purposes;
  • organisations providing website hosting, membership management, email, IT, payment, event-management or other services to the Association;
  • professional advisers such as accountants, auditors, insurers or legal advisers;
  • banks and payment service providers;
  • government departments, regulators, courts, law-enforcement bodies or other authorities where disclosure is required or permitted by law; and
  • other parties where you have specifically authorised the disclosure.

Where third-party service providers process personal information on our behalf, we will take reasonable steps to ensure that appropriate contractual, confidentiality and data-protection arrangements are in place.

Access to membership information will be limited, so far as reasonably practicable, to those who require it for legitimate Association purposes.

9. INTERNATIONAL TRANSFERS

Some service providers used by the Association may process or store personal information outside the United Kingdom.

Where personal information is transferred outside the UK, we will take appropriate steps to ensure that the transfer complies with applicable UK data protection law.

This may include relying upon UK adequacy regulations or using approved contractual safeguards or another lawful transfer mechanism.

10. HOW LONG WE KEEP PERSONAL INFORMATION

We will not retain personal information for longer than reasonably necessary for the purposes for which it was collected.

Retention periods may vary according to the type of information and the reason for processing it.

In determining an appropriate retention period, we may consider:

  • the continuing membership or relationship with the Association;
  • the purposes for which the information is held;
  • legal, accounting, taxation and regulatory requirements;
  • the Association’s governance and historical record-keeping requirements;
  • the establishment, exercise or defence of legal claims; and
  • security, fraud-prevention and dispute-resolution requirements.

When personal information is no longer required, we will take reasonable steps to securely delete, destroy or anonymise it.

Certain basic historical membership or governance records may be retained for longer periods where there is a legitimate and proportionate reason for doing so.

11. SECURITY OF PERSONAL INFORMATION

We take reasonable and appropriate technical and organisational measures to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures may include, as appropriate:

  • restricting access to authorised persons;
  • password and account controls;
  • appropriate authentication procedures;
  • secure hosting and storage arrangements;
  • access controls for membership records;
  • backups and system-security measures; and
  • appropriate confidentiality requirements for persons handling member information.

No internet-based or electronic system can be guaranteed to be completely secure. However, we will take reasonable steps appropriate to the nature and risk of the information we process.

12. PERSONAL DATA BREACHES

Where we become aware of a personal data breach, we will assess and manage the incident in accordance with applicable data protection law.

Where legally required, we will notify the Information Commissioner’s Office (“ICO”) and, where applicable, affected individuals within the periods prescribed by law.

13. CHILDREN’S INFORMATION

NOBA UK is principally an alumni and membership organisation.

We do not knowingly create ordinary membership accounts for children unless membership or participation is permitted under the Association’s Constitution or rules and the processing is lawful and appropriate.

Children may nevertheless attend family, sporting, educational, cultural or community events organised or supported by the Association.

Where we need to process children’s personal information in connection with such activities, we will take particular care to protect their rights and interests and will obtain parental or guardian consent where this is required or appropriate.

14. YOUR DATA PROTECTION RIGHTS

Depending upon the circumstances and the lawful basis relied upon, you may have rights under UK data protection law including:

  • the right of access to your personal information;
  • the right to rectification of inaccurate or incomplete information;
  • the right to erasure in certain circumstances;
  • the right to restrict processing in certain circumstances;
  • the right to data portability where applicable;
  • the right to object to certain processing;
  • rights relating to certain automated decision-making; and
  • the right to withdraw consent where processing is based upon consent.

These rights are not absolute and may be subject to exemptions or limitations provided by law.

YOUR RIGHT TO OBJECT

Where we process your personal information on the basis of legitimate interests, you have the right to object to that processing in certain circumstances.

Where personal information is processed for direct marketing purposes, you have the right to object to that processing at any time.

To exercise any of your rights, please contact us using the details below.

We may need to verify your identity before acting upon a request.

15. DATA PROTECTION COMPLAINTS

If you have a concern or complaint about how NOBA UK has collected or used your personal information, please contact us in the first instance.

We will provide an appropriate means for individuals to make data protection complaints and will handle complaints in accordance with applicable legal requirements.

We will acknowledge a data protection complaint within the period required by law, investigate it appropriately and communicate the outcome to the complainant.

You also have the right to raise concerns with the UK’s independent data protection regulator:

Information Commissioner’s Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113

Making a complaint to NOBA UK does not affect your right to complain to the ICO.

16. CONTACTING US

For questions concerning this Privacy Notice, your personal information, the exercise of your data protection rights, or to make a data protection complaint, please contact:

Nalanda Old Boys’ Association UK

Email: admin@oldnalandians.co.uk

Alternative email: oldnalandiansuk@gmail.com

Website: www.oldnalandians.co.uk

If the Association appoints a Data Protection Officer or other designated data protection contact, their details will be published here.

17. CHANGES TO THIS PRIVACY NOTICE

We may amend this Privacy Notice from time to time to reflect changes in our activities, systems, practices or legal and regulatory requirements.

The latest version will be published on our website and will show the date on which it was last updated.

Where a change materially affects how we use personal information, we will take reasonable steps to bring the change to the attention of affected individuals where required or appropriate.

Last updated: 20 August 2026

Register Login