Privacy notice

Who we are

1st Hazel Grove Scout Group is part of The Scout Association and is run entirely by volunteers. We are responsible for the personal information you give us through this website. If you have any questions about it, email us at contact@1hg.org.

Every Scout group has its own data protection responsibilities. The Scout Association’s Data Protection Policy (opens in a new tab) explains how personal information is handled across Scouting.

In short

• We only ask for what we need, and use it to reply to you or to run Scouting activities for your child.
• Messages from the contact and joining forms are emailed to our volunteers. The website doesn’t save your message.
• This website doesn’t use advertising or analytics cookies.

Contact and joining forms

What we collect

• Contact form: your name, email address, a subject and your message. If you came from a section’s page, the form also notes which section you were looking at.
• Joining form: your name and email address, a phone number if you choose to give one, your child’s first name, their month and year of birth, the section you’re interested in, and anything else you choose to tell us.

Why we collect it

So we can reply to you. For joining enquiries, we use your child’s month and year of birth to work out which section fits their age, so we can talk to you about places and next steps.

Where it goes

When you send a form, the website emails it to our group mailbox, where our volunteers read and answer it. The email is sent by SparkPost, an email delivery service, using its European service. The website doesn’t save what you wrote in its database.

We keep enquiry emails only for as long as we need them to deal with your enquiry. If your child joins, their membership details are kept in Online Scout Manager (OSM), the membership system our sections use.

Spam protection and rate limits

Our public forms use Cloudflare Turnstile to check that they are being filled in by a person and not an automated program. To do this, Cloudflare looks at technical information such as your IP address and browser details. Cloudflare’s Turnstile privacy addendum (opens in a new tab) explains how it uses this information.

To stop misuse, the website also limits how often each form, and some other features, can be used from one connection. It stores your IP address with a count of requests for a short time window, between one minute and an hour depending on the feature (15 minutes for the contact and joining forms). Once the window has passed the record is no longer used, and old records are deleted automatically from time to time.

Photos and memories

If you share photos through our Share your photos and memories page, we collect your first and last name, your email address, any description you add, and the photos themselves. The photos are saved in a folder in the group’s Google Drive, and the website keeps a record of the submission (your name, email address, description, a link to the folder and the number of photos). Our volunteers are told about new submissions by email.

We use them to collect photos and memories of the group’s events and history. If you’d like photos or details you sent removed, email contact@1hg.org.

At Family Camp 2026, families could record their photo consent choices at a selfie booth. The names, email address (if given), consent choices, any notes and the selfie were saved in the group’s Google Drive and in the website’s database. The booth page also saved a random device code and the family’s names in the browser of the phone or tablet used, so the family didn’t have to enter them again.

Medical and permission forms

For camps, trips and some activities, our leaders send families a link to a medical and permission form. Each form has its own data protection notice explaining how the information is used. Answers are stored encrypted, and only the leaders running the activity and the volunteers who manage these forms can see them. Shortly after the event the forms are moved to an archive copy in the group’s Google Drive and deleted from the website. They are kept for 2 months after the event and then deleted.

Leaders’ own forms work the same way. A leader’s latest answers are also kept to pre-fill future forms, and are deleted 36 months after they last sent one.

Passport and GHIC details

When a trip needs them, our leaders may ask you to upload photos of your young person’s passport or Global Health Insurance Card (GHIC), along with your name and email address. The details are read automatically by Google’s Document AI service so you can check and correct them before sending. The photos and details are then saved to the group’s Google Drive and a Google Sheet that our leaders use to arrange the trip, and our leaders are told by email.

Donations and payments

Donations and payments are made through PayPal, so we never see your card or bank details. When you donate, PayPal tells us the amount and the donor’s name and email address, and our volunteers receive an email about it. If we send you a payment link, the website keeps a record of it (what it’s for, the amount, and the name and email address we created it for, if any) and notes when it has been paid. PayPal’s own privacy statement (opens in a new tab) explains how PayPal uses your information.

Cookies

This website doesn’t use advertising or analytics cookies. It only sets cookies that are needed for particular features to work:

• Volunteer sign-in: when our volunteers sign in to manage the website, a cookie keeps them signed in for up to 24 hours, and a short-lived cookie (10 minutes) protects the Google sign-in step.
• Quizzes: if your child takes part in a quiz run by our leaders on this website, a cookie keeps them in the quiz for up to 12 hours. The leader running the quiz gets a similar cookie.

The Cloudflare Turnstile check on our forms is described under spam protection.

Tools for our volunteers

Some pages on this website are tools for our leaders and volunteers, for example to log minibus journeys or send in receipts. The details entered, such as names, email addresses and journey or expense details, are kept in the website’s database or the group’s Google Drive and used to run the group.

Services we use

To run this website we use:

• Vercel, which hosts the website
• Turso, which hosts the website’s database
• SparkPost, which sends the website’s emails
• Google Workspace (Drive and Sheets), where our volunteers keep files
• Google Cloud Document AI, which reads passport and GHIC details
• Cloudflare Turnstile, for spam protection
• PayPal, for donations and payments

Vercel keeps short-lived technical logs to help us fix problems. These include IP addresses and the subject lines of emails the website sends, which can include a name or the subject you typed into the contact form.

Your rights

Under data protection law you can ask us for a copy of the personal information we hold about you, and ask us to correct it or delete it. You can also object to how we use it. To do any of these, or if you have a question or a concern, email contact@1hg.org.

If you’re unhappy with how we’ve used your information, please tell us first so we can try to put it right. You can also complain to the Information Commissioner’s Office: make a complaint to the ICO (opens in a new tab).

Changes to this notice

We’ll update this page if the way the website uses personal information changes. The date at the top shows when it was last updated.