Introduction
Mrs Khan's Matrimonial Services Limited (SC864954) is committed to processing data responsibly and in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). This policy sets out our internal governance framework for data protection across the entire organisation.
For individual privacy rights and how your data is used, please see our Privacy Policy.
1Data Protection Principles
We adhere to the seven principles of UK GDPR. Personal data must be:
- Lawfully, fairly and transparently processed — we have a lawful basis for all processing and we are open about how we use data;
- Collected for specified, explicit and legitimate purposes — we do not use data for purposes incompatible with those stated at collection;
- Adequate, relevant and limited — we collect only what is necessary;
- Accurate and kept up to date — we take reasonable steps to correct inaccurate data;
- Kept for no longer than necessary — we apply defined retention periods;
- Kept secure — we protect data against unauthorised access, loss, or destruction;
- Accountable — we can demonstrate compliance with these principles.
2Lawful Bases for Processing
We rely on the following lawful bases, as appropriate:
- Contract (Art. 6(1)(b)): Providing our matchmaking services;
- Legal Obligation (Art. 6(1)(c)): Tax records, safeguarding obligations, legal disclosures;
- Legitimate Interests (Art. 6(1)(f)): Fraud prevention, IT security, service improvement — subject to a documented balancing test;
- Consent (Art. 6(1)(a) & Art. 9(2)(a)): Marketing and special category data (religious beliefs). Consent is freely given, specific, informed, and unambiguous, and may be withdrawn at any time.
3Special Category Data
Our service involves the processing of special category data, specifically religious or philosophical beliefs, which members voluntarily provide for matching purposes. We process this data under Article 9(2)(a) UK GDPR (explicit consent). Members may withdraw consent at any time, and we will cease processing this category of their data accordingly.
4Data Subject Rights
All data subjects have the rights set out in our Privacy Policy (Section 8). We have documented procedures to respond to each type of request within the statutory timeframe of one month (extendable to three months in complex cases).
5Data Breach Response
In the event of a personal data breach, we will:
- Contain the breach and assess the risk to individuals as quickly as possible;
- Notify the ICO within 72 hours of becoming aware of the breach, where required;
- Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms;
- Document all breaches in our internal breach register, regardless of whether ICO notification is required.
6Data Processors & Third Parties
Where we engage third-party data processors (e.g., hosting providers, payment processors), we ensure they are bound by a Data Processing Agreement (DPA) that meets UK GDPR requirements, and that they provide sufficient guarantees of technical and organisational security measures.
7Data Retention Schedule
- Active member data: Retained for the duration of membership;
- Closed account data: Retained for 6 years after closure (legal compliance);
- Financial records: 7 years (HMRC requirement);
- Complaint records: 6 years;
- Marketing data: Until consent is withdrawn or 3 years of inactivity, whichever is sooner.
8Contact the Data Controller
For any data protection query or to exercise your rights, please contact us via our Contact & Data Protection Enquiries page or at mrskhanmatrimonial@gmail.com. You may also contact the ICO at ico.org.uk.