Privacy Policy - Discover Brum

1. Who we are

Discover Brum (“we”, “us”, “our”) runs discoverbrum.com, a community platform for Birmingham. We are the data controller for the personal data described here, and we handle it under the UK GDPR and the Data Protection Act 2018.

For anything about your data, email hello@discoverbrum.com.

2. What we collect

Account details - your name, username, email address and password (stored only as a secure hash).
Profile details - anything you choose to add, such as a bio, location within Birmingham, links or a photo.
Content you post - feed posts, forum threads, comments, listings, events and images.
Messages you send us - contact form submissions and email correspondence.
Technical data - IP address, browser and device type, and pages visited, from our server logs.
Payment data - if paid membership launches, card details go straight to our payment provider. We never see or store your full card number.

3. Why we use it, and our lawful basis

To run your account - registration, login, email verification, password resets. Basis: performance of a contract.
To publish what you post - showing your posts, listings and profile to other visitors. Basis: performance of a contract.
To keep the site safe - moderation, spam and fraud prevention, security logging. Basis: legitimate interests.
To improve the site - understanding which pages and sections get used. Basis: legitimate interests.
To send you marketing - newsletters or what’s-on emails, only if you ask for them. Basis: consent, withdrawable at any time.
To meet legal obligations - tax records, and responding to lawful requests. Basis: legal obligation.

4. What is public

Discover Brum is a public community site. Your username, profile and anything you post in the feed, forum, listings or comments can be seen by anyone visiting the site, and may be indexed by search engines. Your email address and password are never shown publicly. Think of a post as a postcard, not a letter.

5. Who we share it with

We do not sell your personal data. We share it only with the service providers that make the site work, and only as far as they need it:

Our hosting provider, which stores the site and its database.
Brevo, which delivers our transactional email (verification and password resets).
Google, for website analytics, and only if you accept analytics cookies (see section 6).
Microsoft, whose Clarity service records how pages are used, and only if you accept analytics cookies (see section 6).
A payment provider, if and when paid membership launches.
Law enforcement or regulators, where we are legally required to disclose.

Where a provider processes data outside the UK, we rely on UK adequacy regulations or the International Data Transfer Agreement.

6. Cookies

We use a session cookie to keep you logged in and a CSRF token cookie to protect forms against cross-site request forgery. These are strictly necessary, so they do not need consent.

With your consent, we use Google Analytics to understand which pages people visit and how they find us. It sets cookies named _ga and _ga_ followed by an ID, which last up to two years, and Google processes the data on our behalf.

With your consent, we use Microsoft Clarity to see how pages are used: where people click, how far they scroll and where they get stuck, including anonymised recordings of visits. Text you type into forms is masked and not recorded. It sets cookies named _clck (up to a year) and _clsk (one day), and Microsoft processes the data on our behalf.

None of this loads until you press Accept on the cookie banner. We keep your answer in a cookie named db_analytics_consent for a year, so we do not ask on every page.

You can change your answer at any time from , also linked at the foot of every page. Saying no removes these analytics cookies.

7. How long we keep it

Account and profile data: while your account is open.
Content you posted: until you delete it, or your account is deleted.
Server logs: typically up to 12 months.
Contact messages: up to 24 months.
Records we must keep by law, such as payment records: as long as the law requires.

Deleted data may persist in encrypted backups for a short period before those backups rotate out.

8. Your rights

Under UK data protection law you have the right to:

Ask for a copy of the personal data we hold about you.
Have inaccurate data corrected.
Ask us to delete your data, and to delete your account yourself from your profile settings.
Object to, or ask us to restrict, processing based on legitimate interests.
Ask for your data in a portable format.
Withdraw consent to marketing at any time, by using the unsubscribe link or emailing us.

Email hello@discoverbrum.com to exercise any of these. We will respond within one month. If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk.

9. Children

Discover Brum accounts are for people aged 16 and over. If we learn that an account belongs to someone younger, we will remove it.

10. Security

The site is served over HTTPS, passwords are stored as hashes and never in plain text, and administrative access is limited to accounts that need it. No system is perfectly secure, so please use a strong, unique password and tell us if you spot anything suspicious.

11. Changes to this policy

We may update this policy as the site grows. The date at the top of this page shows when it last changed, and we will tell registered members about significant changes by email or an on-site notice.