Privacy policy

1. Who we are

Bahrain Social Club ("we", "us") is a social club based in the Kingdom of Bahrain, and we're responsible for the personal data described in this policy. Our registered name is Bahrain Social Circle Company for Organizing Events, Marketing and Operating Web Portals W.L.L., with commercial registration (CR) number 131367-1. We handle it in line with Bahrain's Personal Data Protection Law (Law No. 30 of 2018). Contact us at [email protected].

2. What we collect

When you become a member

Your first and last name and your email address, and your phone number if you give it (it's optional), so the team can reach you about club things, like last-minute changes.
Your date of birth, to check you're 18 or over. Beyond that, it only counts towards anonymous totals by age group.
Your gender (woman or man), only for anonymous totals that help us plan women only and men only events. It's never shown publicly.
Optional: your nationality (see About the nationality question).
We also ask whether you live in Bahrain, because membership is for people who live here. We don't keep the answer, and if it's no, we don't keep anything at all.
The password you choose. We only keep a scrambled one-way version of it (a hash), made with a secret key that's kept apart from our database, never the password itself, so nobody at the club can see it.
That you agreed to the liability waiver, the membership terms and this policy, with each one's version, the time and the language you read it in. Your choices about club news, the Patron launch and merch drops, and each time you change them.
Your member number, and when you became a member.

If you link your Discord or turn on two-step login

Linking your Discord account is optional. It gives us your Discord account ID and username, read from Discord when you link. We never get your Discord password or messages, and we don't keep any access to your Discord account. Once it's linked, you get the Club Member role in our server, which everyone in the server can see, and a CLUB MEMBER ticket with your member number on your /rank card. You can unlink any time on your account page.
Two-step login is optional too. It keeps the key for your authenticator app, encrypted, and your backup codes, scrambled. The QR code for setting it up is made in your browser, not by another website.

When you contact us or fill in a form

What you tell us in our contact, partner, sponsor, team application and accessibility forms, including your name and contact details.
Safety reports: what you tell us, which may include information about other people, and whether you'd like a woman or a man on the team to handle it. You can report anonymously.

When you save a spot at an event

The name you type. It shows on that event's post in our Discord, marked as a website sign-up, where anyone who can see that channel can see it. You never need to save a spot to come.
Your phone number, so the team can reach you about that event. Only our staff see it, in our events service. It never shows in the Discord.
If that kind of event has house rules, saving a spot means agreeing to them, and we note that you did. The same goes for saving a spot in the Discord.
A private cancel code for your spot, kept in your browser on your device so you can see and cancel your spot later.
To stop spam, a scrambled code made from your IP address and the date, kept for a day. Your IP address itself is never sent to our events service.

At events and in the Discord

Photos and videos, only with consent (see Photos).
If you're on the team: your profile on the Who we are page (your name, photo and Discord username, which you control in the staff area), and your Discord account ID so you can log in.
In our Discord server, what you post and your username, as Discord makes them visible to server admins.
Our Discord bot gives XP for chatting. Your Discord name, picture, level, XP and tier show on our public leaderboard page, and your picture's web address includes your Discord account ID. You come off it if you leave the server, or ask the team to take you off. In the Discord, anyone can also see how many of our events you've been to on your /rank card.

3. Why we use it

To run your membership, including your account, your member number and the emails your account needs, like confirming your email or resetting your password. Our basis: your consent when you sign up.
To check you're 18 or over, from your date of birth.
To give you the Club Member role in our Discord, and show your member number on your /rank card, if you link your Discord account.
To send you club news, only if you ticked the box. You can stop it anytime.
To tell you when Patron or the merch launches, only if you asked.
To understand the club as a whole, using anonymous totals: how many members we have, how many linked their Discord, and how many by gender, age group and nationality. Any group smaller than 5 only ever shows as "fewer than 5".
To run event sign-ups, so hosts know roughly how many people to expect and the team can reach you about that event. Our basis: your consent when you save a spot. You can cancel any time on the What's on page.
To reply to your messages and handle partnership, sponsorship and accessibility requests.
To keep people safe, including handling safety reports and enforcing our code of conduct.
To meet our legal obligations where the law requires it.

We don't use your data for automated decisions, and we don't sell it or use it for advertising.

4. About the nationality question

Nationality is optional. We only use it for internal statistics, as anonymous totals, so we understand who's in the club. It's never shown publicly, never shared with anyone outside the team, never shown when the team looks a member up or in the list of all members, and never used to decide who can join or come to anything. You can leave it blank, or remove it from your account page at any time.

Our team: only the people who need it for their role. Safety reports are only seen by the Trust and Safety team.
Looking members up: our founders, and the few people on the team they allow, can look up one member at a time by the exact member number, email or Discord ID, for example to help with an account. They see your name, contact details, member number, Discord link, whether two-step login is on, and your agreements and email choices. Never your date of birth, gender or nationality. Every lookup is logged with who did it. Our founders can also see a list of all members, with each member's number, name, email, Discord username (if linked) and when they became a member, and nothing else. Every time they open it, it's logged with who did it.
BahrainBot, our Discord bot, which runs on Railway in its EU West region. To give and take away the Club Member role, and show your member number on your /rank card in the Discord, it asks our website which Discord accounts belong to members. It only ever gets "member, yes or no", your member number and the list of linked Discord IDs. Never your name, email or anything else. Anyone who sees your /rank card can see your number.
Service providers that help us run the club: Cloudflare, which runs this website, stores member accounts and staff profiles, keeps encrypted backups of our events service (R2), and checks that membership and event sign-ups come from a person (Turnstile); Discord, where form messages reach the right team in private channels and event sign-ups show on event posts; Railway, which runs our events service and BahrainBot, and stores event sign-ups in its EU West region; Resend, which sends account emails like "confirm your email", from its EU region (Ireland); and Google, which runs our email. They only process data on our instructions.
Venues: if a venue needs a guest list for an event you've signed up to, we'll share only what they need, usually your name, and tell you first.
Authorities: if the law requires it, or if someone's safety is at serious risk.

We never sell your personal data, and we don't share it with partners or sponsors for their own marketing.

6. Where your data is stored

This website runs on Cloudflare, and member accounts are stored in Cloudflare's database. Account emails go out through Resend's EU region. When you send any other form, it goes as a message to a private channel in our Discord server that only the relevant team can see. Safety reports go only to the Trust and Safety team. Event sign-ups and RSVPs are stored by our events service on Railway, in its EU West region, backed up to Cloudflare R2, and shown in our Discord. Cloudflare, Discord, Railway and Resend may store and process data on servers outside Bahrain, and they use strong security measures to protect it. By using our forms, you agree to your data being transferred and stored this way.

7. How long we keep it

Membership details: for as long as you're a member. Delete your account any time from your account page, or ask us to do it, and everything goes straight away: your details, agreements, email choices, Discord link, two-step login and logins. Your member number is never given to anyone else.
Deleted accounts can stay in our database host's restore history (Cloudflare D1) for up to 30 days, then they're gone for good.
Sign-ups that aren't confirmed: deleted after 7 days.
Your agreements (the waiver, the membership terms and this policy): kept with your account, and deleted with it.
Logins: up to 30 days, or until you log out. Changing your password, or turning two-step login on or off, logs you out everywhere else.
The log of staff lookups and founder actions (deleting a member, sending a two-step removal link, opening the list of all members): a year, even after an account is deleted. It keeps who did it, when, and the member number if it was about one member, never what they searched for.
Scrambled codes that stop spam and password guessing: a day.
Messages and enquiries: for as long as we need to deal with them, and no more than two years after that.
Event sign-ups from the website: your name is deleted 30 days after the event, from our events service and from the Discord post, and your phone number with it. Cancel your spot before then and it comes off the list straight away. Encrypted backups of our events service are kept for 14 days, then deleted.
RSVPs in our Discord: kept with your Discord account and made anonymous after a year. On events with separate spots for men and women, we also note which side you signed up on, from your verified role. To have yours removed sooner, email us or message the team in the Discord.
Who came to events: we keep a record of which events you came to or missed for a year, then delete it. Your total, your milestone role and your place on the members list stay until you ask us to delete them. Only our staff can see the members list, but your total also shows on your /rank card in the Discord.
The Club Member role: BahrainBot keeps a note of each time it checks your role for 30 days (90 if the check failed), then deletes it.
Safety reports: for as long as needed to keep people safe and handle any follow-up, including legal requirements.

8. Your rights

Under Bahrain's Personal Data Protection Law, you can:

ask whether we hold data about you, and get a copy of it;
ask us to correct it if it's wrong;
ask us to delete it, or stop using it;
object to us using it, including for updates and marketing;
withdraw your consent at any time, which doesn't affect anything we did before;
complain to the Personal Data Protection Authority in Bahrain.

In your account you can see and change your details, download a copy of everything we have about your account (Download my data), and delete it all, any time. For anything else, email [email protected]. We'll reply within the time limits the law sets, and it's free.

9. Keeping it safe

Passwords are only kept as a scrambled one-way code (a hash), made with a secret key kept apart from our database, and you can add two-step login to your account. Only our founders, and the few people on the team they allow, can look members up, one at a time, and every lookup is logged. Only our founders can see the list of all members, and every time they open it, it's logged. We use secure, reputable services to store everything. No system is perfect, so if something ever goes wrong that affects your data, we'll tell you and do what the law requires.

10. Age

Bahrain Social Club is for people 18 and over, and we check the date of birth members give when they sign up. We don't knowingly collect data from anyone younger. If we find out we have, we'll delete it.

11. Photos

We ask before anyone's face goes up on our channels. Anyone wearing a no-photos sticker won't appear in anything we post. If you'd like a photo of you taken down, tell us and we'll remove it the same day.

12. This website, cookies and Discord

This website doesn't use analytics or advertising trackers. Its only cookies are for logging in: one keeps you logged in to your member account (or, for our team, the staff area), and a short one lasts 10 minutes while you log in with Discord or link your Discord account, to check it's really you. They do nothing else. If you never log in, you never get one.
It stores a few small things in your browser: whether you paused the moving banner; if you save a spot at an event, your name and that spot's private cancel code; and while you link your Discord from the welcome steps, a note so the steps come back after. The banner setting and that note never leave your device. The name and code are only sent to us, to show or cancel your spot.
When you open the sign-up box on the What's on page, or start the membership form, Cloudflare Turnstile checks that you're a person, not a bot. It runs in your browser, and Cloudflare's privacy policy applies to it.
Linking your Discord takes you to Discord's own page to log in, where Discord's privacy policy applies.
Our website host may keep standard technical logs, like IP addresses, for a short time to keep the site secure.
Some pages ask Discord for our server's live member count, and the leaderboard page loads people's pictures from Discord, so your browser connects to Discord. Discord's privacy policy applies to that.
Links to Instagram, TikTok and Discord take you to those platforms, where their own privacy policies apply.

13. Changes to this policy

We may update this policy as the club grows. The version at the top shows which one you're reading. If we change it in a way that matters, we'll tell members and ask them to agree to the new version.

14. Contact and complaints

Questions or concerns about your data? Email [email protected] and we'll help. If you're not happy with our answer, you can complain to the Personal Data Protection Authority in Bahrain.