Privacy policy

Jewish Moments UK is the data controller for information submitted to this service. That means the operator decides why and how it is used. The operator's complete legal identity and service address will be inserted above before signup or payment functions are enabled. Questions can already be sent to hello@jewishmoments.co.uk.

We do not ask for a friend's, relative's, colleague's or card recipient's email address, birthday or other contact details. Reminders go to the subscriber, who chooses whether to share a greeting.

• Your email address and, if you choose to provide it, your first name.
• Your audience and reminder choices, such as major festivals, cards or workplace guidance.
• Your separate choices about the requested reminder service and the optional editorial newsletter or future offers, plus the date, wording and source of each choice.
• Necessary delivery records, such as confirmation, delivery, bounce, unsubscribe and complaint status.
• Messages you send us and the information needed to answer them.
• If support payments are enabled, payment status, amount and Stripe reference. We will not receive your full card number.
• Limited hosting and security logs, such as IP address, device information and request time, where generated by our hosting or security providers.
• When the automatic “Coming up next” calendar loads, your browser requests public holiday data directly from Hebcal.com. The request necessarily provides Hebcal with your IP address and standard browser headers, but it does not include your name, email address or reminder choices.

We do not currently use advertising pixels, behavioural advertising or cross-site profiling. We do not need recipient details to provide the service.

A choice to receive Jewish-festival reminders may reveal, or allow someone to infer, an interest connected with religion. Religious beliefs are special-category data under UK data protection law. We therefore minimise this information, keep the choice general, and use explicit consent for processing reminder preferences where the special-category rules apply.

We do not record that a subscriber is Jewish, infer a person's faith from their choices, build religious profiles, or use these choices for advertising. You may withdraw explicit consent at any time; this does not make earlier lawful processing unlawful, but it stops future use of the preference.

Where we rely on legitimate interests, we consider necessity, proportionality and your reasonable expectations. You can ask about that assessment.

Practical reminder emails contain the date, context, wording and card link requested by the subscriber. We keep them focused on providing that service.

The editorial newsletter, new products, supporter appeals, sponsored material and future offers are a separate choice. Its box is optional and unchecked. We do not treat consent to reminders as consent to direct marketing. Every marketing email will identify the sender and provide a simple unsubscribe route. Objecting to direct marketing stops it.

The site uses essential browser storage to remember whether you have acknowledged the privacy notice and, if optional analytics is offered, the choice you made. This prevents the notice repeatedly interrupting your visit and helps us respect your preference.

Optional analytics is disabled unless a visitor actively permits it through the privacy banner. When enabled, Google Analytics 4 and/or Cloudflare Web Analytics may collect page and performance information such as pages visited, approximate location, device type, referrer and interactions. We configure Google Analytics without advertising personalisation or Google Signals. We do not use advertising pixels, behavioural advertising or cross-site profiling.

You can reopen “Privacy choices” from any page and withdraw optional analytics permission. Withdrawing applies to future visits on that browser. Strictly necessary hosting and security processing may still occur to deliver the website, balance traffic and prevent abuse.

Email providers may need to record delivery, bounce and unsubscribe events. Optional open or click tracking will be disabled at launch where the provider permits. If we later use optional campaign analytics, this notice and the signup information will be updated before doing so.

The automatic holiday panel uses normal HTTP caching supplied by Hebcal. Jewish Moments UK does not use local storage or a tracking identifier for this feature, and the request is made without browser credentials.

We use only suppliers reasonably needed to operate the service. They may include website hosting and security providers, MailerLite for subscription and email delivery, Google Analytics and/or Cloudflare Web Analytics for consented site measurement, Stripe for payments, Hebcal for public Jewish-calendar dates, and professional advisers where necessary.

The date panel makes a direct request to Hebcal. Hebcal states that its server logs include IP address, browser type, pages requested, date and time, and that those logs are normally retained for approximately two weeks. See Hebcal’s privacy policy. We send no subscriber profile or contact information in that request.

Processors we appoint act under contracts and may use information only for the agreed service or their own limited legal obligations. Hebcal receives the direct calendar request under its own published terms and privacy policy. We may disclose information where required by law, a court or regulator, or where reasonably necessary to protect legal rights. We do not sell or rent subscriber lists.

Some suppliers or their subprocessors may process information outside the UK. Where the destination is not covered by UK adequacy regulations, we will use a recognised safeguard such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism, and assess relevant transfer risks.

MailerLite states that its primary data centres are in the EU and its data-processing terms include the UK Addendum for relevant transfers. Supplier locations and subprocessors can change, so we review the applicable contract rather than relying only on a marketing claim.

• Active reminders: while you remain subscribed and the selected service is offered.
• After unsubscribe or consent withdrawal: sending stops promptly and the active profile is deleted or anonymised within 30 days, subject to provider backups and the exceptions below.
• Suppression record: a minimal email or irreversible identifier and opt-out date may be kept as long as reasonably necessary to ensure we do not email you again against your wishes.
• Consent and complaint evidence: up to six years after the last relevant communication where reasonably needed to demonstrate compliance or handle a claim.
• General enquiries: normally two years after the matter closes.
• Financial records: normally six years, or longer if tax law requires.
• Security logs: normally no more than 90 days unless needed to investigate an incident or claim.

We review retention at least annually and delete or anonymise information that is no longer needed.

Depending on the circumstances, you can ask for access, correction, deletion, restriction or portability of your information; object to processing based on legitimate interests; and withdraw consent. The right to object to direct marketing is absolute.

We normally respond within one month. We may ask for proportionate proof of identity and may extend the period for a complex request as the law permits. You can also complain to the Information Commissioner's Office. Please contact us first if you are comfortable doing so, because we would like the opportunity to resolve the issue.

We use proportionate technical and organisational measures, including restricted account access, multi-factor authentication where available, encrypted HTTPS connections, supplier due diligence, secret management and tested deletion procedures. No internet service can promise absolute security.

If a personal-data breach occurs, we will investigate, limit harm, document the decision and notify the ICO within 72 hours where UK law requires it. We will also notify affected people without undue delay where the risk to them is high.

The subscription and support functions are intended for people aged 18 or over. We do not knowingly collect children's details. A parent or guardian who believes a child has submitted information should contact us so it can be removed.

We may update this policy when the service, suppliers or law changes. We will publish the new version and effective date here. If a change materially affects how existing information is used, we will give appropriate notice and seek fresh consent where required.

Privacy questions can be sent to hello@jewishmoments.co.uk. The operator's service address will appear above before data collection is enabled.

This policy was prepared with reference to current UK guidance, including:

• ICO: what privacy information organisations should provide
• ICO: special-category data, including religious beliefs
• ICO: direct marketing using electronic mail
• ICO: cookies and similar technologies
• ICO: personal-data breach guidance