Privacy policy

Quorum provides software that private clubs and member led communities use to manage membership, finances, committees, events and voting. This policy explains what personal information we handle, why we handle it, and what you can do about it.

Our role depends on whose information is involved. When you visit this website or create a club account, we act as the controller of that information. When a club uses Quorum to manage its own members, the club decides what is recorded and why, so the club is the controller and we act as a processor on its instructions. If you are a member of a club and want to know why a particular record exists, your club is the right place to start.

We collect the following categories of information.

• Account information. Name, email address, password (stored only as a cryptographic hash), role within the club, and the club the account belongs to.
• Membership records. Information a club collects about its members and applicants, which may include contact details, date of birth, nationality, address, occupation, membership category, referral or nomination details, and any documents uploaded in support of an application.
• Financial records. Dues assessed, fines, contribution pledges, investment and savings circle positions, payment status and payment references. Card details are handled by our payment processor and are never stored on our servers.
• Activity records. Event responses, attendance, announcements read, ballots cast and messages sent within club and committee threads.
• Technical information. IP address, browser and device type, operating system, pages viewed, and the dates and times of requests. On mobile we also store a push notification token so we can deliver alerts to the right device.
• Correspondence. Messages you send us by email or through the contact form on this site.

We use personal information to:

• provide the service and keep each club record accurate and current
• authenticate users and protect accounts from unauthorised access
• process subscription payments from clubs and record member payments where a club has enabled them
• send transactional messages such as application outcomes, invitations, password resets, event reminders and notifications a member has asked for
• provide support, investigate issues and respond to enquiries
• monitor availability, diagnose faults, prevent abuse and improve reliability and performance
• comply with our legal obligations and enforce our terms

We do not sell personal information. We do not use club or member data to train machine learning models, and we do not use it for advertising.

Where data protection law requires a legal basis, we rely on the following.

• Contract. To provide the service to a club and to the members using it under that club.
• Legitimate interests. To secure the service, prevent abuse, understand how the product is used in aggregate and communicate about material changes. We balance these against your interests and rights.
• Legal obligation. To keep financial records and to respond to lawful requests.
• Consent. Where we ask for it, for example before sending push notifications on a mobile device. You can withdraw consent at any time.

A club administrator can see the records their club holds, including member contact details, financial position and attendance. What an ordinary member can see is limited to their own records, the committees they belong to, and anything the club has published to the wider membership.

Where a ballot is marked anonymous, individual responses are not shown to administrators in the results view. Anonymity applies to how results are presented and is not a guarantee against inference in a very small electorate.

If you are a member and you want a record corrected or removed, contact your club first. We will support the club in acting on your request, and we will act directly where the law requires us to.

Subscription payments from clubs are processed by a third party payment provider. When you pay, your card details are collected by that provider over its own secure connection. We receive confirmation of the outcome, the amount, the last digits of the instrument and a reference, which we store against the club record so both sides have a receipt.

Where a club collects money from its own members, the club is responsible for how it records and reconciles those payments, and for any receipts or proofs of payment its members upload.

We share personal information only where it is necessary, and only with:

• Infrastructure and hosting providers that run our servers, database and file storage
• Payment providers that process subscription and member payments
• Email and notification providers that deliver transactional messages and push notifications
• Professional advisers such as auditors and lawyers, where required
• Authorities where we are legally compelled, and only to the extent compelled

Every provider is bound by contract to process information only on our instructions and to protect it appropriately. If our business is transferred as part of a merger or acquisition, information may transfer with it, and we will tell affected clubs before that happens.

We keep information for as long as the club account is active. When a club closes its account, we delete or anonymise its records within ninety days, except where we are required to keep financial records for longer under applicable law, or where information is needed to establish or defend a legal claim.

Backups are retained on a rolling schedule and are overwritten in the ordinary course. A deletion request is applied to live systems immediately and works through backups as they cycle.

We protect information with encryption in transit, hashed passwords, role based access controls that limit what each account can reach, tenant isolation so one club cannot see another club record, and access logging on administrative systems.

No system is perfect. If we become aware of a breach affecting personal information, we will notify the affected clubs without undue delay and provide what they need to meet their own obligations.

Depending on where you live, you may have the right to request access to your personal information, correct it, delete it, restrict or object to how it is used, receive a copy in a portable format, or withdraw consent you previously gave.

To exercise a right, write to privacy@letsquorum.com. We respond within thirty days. If your request concerns records held by a club, we will pass it to that club and support them in answering it. You also have the right to complain to your local data protection authority.

This marketing website uses no tracking or advertising cookies. The Quorum application uses strictly necessary cookies and local storage to keep you signed in, to hold your session securely and to remember interface preferences such as a selected filter. These cannot be switched off without breaking sign in.

If we later introduce analytics, we will update this policy and ask for consent where the law requires it.

We may process information in countries other than the one you live in, including where our hosting and service providers operate. Where we transfer personal information across borders, we rely on appropriate safeguards such as standard contractual clauses, and we require the same standard of protection wherever the information travels.

Quorum is built for adult membership organisations and is not directed at children. We do not knowingly collect information from anyone under sixteen. If a club records information about a minor, the club is responsible for having a lawful basis and the appropriate consent. Tell us if you believe we hold information about a child in error and we will remove it.

We update this policy when the service changes or the law does. The date at the top of this page shows when it last changed. If a change materially affects how we handle personal information, we will notify club administrators by email before it takes effect.

Questions about this policy or about how your information is handled can go to privacy@letsquorum.com, or by post to Quorum, Lagos, Nigeria.