Privacy and Cookies
Contemporary British Portrait Painters (CBPP) respects your privacy. This notice explains how we handle personal information in our membership administration and online renewal service, including the limited browser storage used by administrators.
This notice covers the CBPP Membership Portal. You can also read the privacy policy for CBPP's main website, which is a separate service.
Who is responsible, and how to contact us?
Contemporary British Portrait Painters is responsible for deciding how membership records are used. For a privacy enquiry, to correct information, or to exercise your data protection rights, please email info@thecbpp.org.
Information we hold
We may hold your membership number, name, email address, website, joining date, renewal date, membership status and payment method, along with any relevant notes and (if you leave) your departure date and reason. We also maintain renewal reminders and delivery outcomes, renewal-link visit records, payment amounts, dates and references, and records of changes made by authorised administrators. Some information is supplied by you; other details are entered or updated by CBPP's authorised committee administrators.
Administrators have separate account and security records, including their email address, sign-in information and multi-factor authentication details. Technical services may process access or security information such as IP addresses to deliver and protect the service.
Why we use this information
- To manage membership, keep the register accurate and contact members about their subscriptions and renewal dates.
- To issue and track renewal reminders and payment confirmations.
- To record bank transfers and card-payment results, reconcile subscriptions and handle enquiries or disputes.
- To control administrator access, protect the system and maintain essential administrative audit records.
Depending on the activity, our lawful bases under the UK GDPR are our legitimate interests in administering a membership organisation securely and accurately, carrying out membership arrangements where processing is necessary for a contract, and meeting applicable legal obligations (including financial recordkeeping). Where we rely on legitimate interests, these include maintaining accurate subscriptions, responding to members and preventing misuse of the portal. We do not use membership renewal information for third-party advertising or behavioural profiling.
Renewal links and emails
A personal renewal link contains a secure identifier. When the renewal page is displayed, the portal records that the page was opened and the time of that visit. We use this to administer renewals, not to follow your browsing across unrelated websites. The system also records whether subscription emails were sent or failed, helping us avoid duplicate reminders and investigate problems.
These links are personal. Please avoid forwarding a renewal link or sharing its full address.
Payments and service providers
We use Google's Firebase services to host the portal, store membership records and authenticate administrators. We also use an email service provider to send membership communications. Authorised CBPP committee administrators can access the records they need for their duties.
Card payments are made on SumUp's independently hosted checkout. SumUp handles the card details and its own checkout technologies. CBPP receives and retains payment status, amount and reference information to account for the subscription; we do not ask you to enter your card number into the CBPP portal. SumUp explains its own handling of payment information and cookies in its privacy information.
These service providers may operate internationally. Where personal information is transferred outside the UK, appropriate UK data-protection safeguards must apply. You can contact CBPP for more information about the arrangements relevant to your data.
How long we keep information
We need current members' records while membership continues. When someone leaves, we retain information only where still needed for membership administration, an outstanding question or dispute, or a legitimate recordkeeping purpose. Payment and accounting information may need to be kept longer to meet financial or legal requirements. Operational email records and technical logs should not be kept longer than required for their purpose.
CBPP is reviewing its retention periods and introducing a formal housekeeping process. Automatic deletion on fixed schedules is not yet in operation. Older records will be assessed against their continuing administrative and legal purpose. If you wish to know why a particular record is still held, please contact us.
Cookies and browser storage
In testing of the CBPP renewal page and the administrator portal, no cookies set by the CBPP portal were identified. The administrator sign-in uses Firebase Authentication, which stores sign-in state in your browser's IndexedDB; Firebase may also store diagnostic or heartbeat information. This helps provide and support secure access to the administration service.
We do not currently operate advertising or visitor-profiling cookies on this Membership Portal. We have not introduced a cookie-consent banner because the browser storage identified for the portal supports authentication and service operation rather than optional advertising. We will review this if the technologies we use change.
SumUp's separately hosted checkout may use cookies and similar technologies for payment, security and other purposes; those are managed by SumUp under its own privacy and cookie arrangements. You can control or remove browser storage through your browser settings, although blocking authentication storage may prevent administrator sign-in.
Your rights
Subject to the applicable legal conditions and exceptions, you may ask for access to your personal information, correction of inaccuracies, erasure, restriction of processing, portability where applicable, or object to processing based on legitimate interests. You can raise these requests by emailing info@thecbpp.org. We may need to verify your identity before releasing information.
You may also raise a concern with the Information Commissioner's Office (ICO), the UK's data protection regulator. We would welcome the opportunity to address concerns directly first.
Updates to this notice
We will update this page when our membership systems, data retention arrangements or service providers materially change. The date at the top identifies this version.