Privacy policy
This policy explains how Billing for Mosdos ([Company name], [Company address], company number [Company number]) handles personal data under the UK GDPR and the Data Protection Act 2018.
Two roles
- Organisations' data (clients such as members, parents, donors, children, balances, payments, pledges, notes). The organisation using the Service (the school, shul or other body) is the controller. We are its processor: we handle this data only to provide the Service and on the organisation's instructions. Questions about this data should go to the organisation first.
- Our own data (account users, people who contact us, demo visitors). For this, we are the controller.
What we collect
- Account users: name, email or username, role, sign-in times, and a record of changes made (an audit log).
- Organisation data: whatever the organisation enters or imports, such as names, addresses, phone numbers, emails, children's names and classes, charges, payments, pledges, notes, and texts sent.
- Contact form: your name, email, phone (if you give it), organisation and message, plus a one-way scrambled form of your IP address, used only to stop spam.
- Technical data: the minimum needed to run the site securely, such as security cookies and short-lived server logs. We do not use advertising or tracking cookies.
Why we use it, and our lawful basis
- To provide the Service to organisations (contract, and the organisation's instructions as controller).
- To keep the Service secure, prevent abuse and keep backups (legitimate interests).
- To reply to messages sent to us (legitimate interests).
- To meet legal obligations.
Texts and email to members
Organisations decide whether to text or email their members. They are responsible for having a lawful basis and any consent that is needed. Every member record has an opt-out flag, and opted-out members are skipped. Nothing is sent until the organisation sets up a sending provider and confirms.
Who we share it with
We use carefully chosen service providers ("sub-processors") to host the Service and its database and, if an organisation switches them on, to send texts or emails. They may only process data on our instructions. We never sell personal data and never use it for advertising.
Where it is stored
The Service runs on a reputable cloud platform. Where data is processed outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
Security
Data is encrypted in transit (HTTPS). Passwords are stored as salted hashes, and provider keys are encrypted. Access is limited to each organisation's own account, changes are logged, and we take backups before updates.
How long we keep it
- Organisation data is kept while the account is active.
- When an account is closed, organisation data is deleted within 90 days, and from backups within a further 90 days, unless the organisation asks for an export first or the law requires us to keep it.
- Contact messages are kept for up to 24 months.
- Demo data is made up and is reset daily.
Your rights
You have the right to access, correct or delete your personal data, to restrict or object to processing, and to data portability. For data held by an organisation, please contact that organisation; we will help them respond. For anything else, email admin@billingformosdos.com. You can also complain to the Information Commissioner's Office (ico.org.uk).
Changes
We will post updates here and change the date above.
Contact
[Company name], [Company address] · admin@billingformosdos.com