Privacy notice

Last updated 13 November 2026.

Who we are

Walk 4 Sahibzaade is a free, volunteer-run walk held every year from 22 to 27 December to remember the four Sahibzaade. This notice covers our website, the Kadam app, our events and our shop.

The organisation responsible for your details (the "controller"): Walk4Sahibzaade CIC, a community interest company based in London, United Kingdom. [OWNER TO CONFIRM: registered company name, company number and postal address.]

ICO registration: [OWNER TO CONFIRM: ICO registration number, or the reason the CIC is exempt from the fee.]

Privacy questions and requests: [email protected]

What we collect

We collect as little as we can. This is everything, by activity.

• Account: your email address, a nickname (it starts as "Walker" and never comes from your email; it does not have to be your real name), your language, and if you choose a country, a team or a Gurdwara, and whether you want news emails. We use no passwords. You sign in with a link we email you, or with Google or Apple. From Google or Apple we receive only a stable ID and your email address, not your name or picture.
• Steps: one total for each day (the date, the number of steps, and where the count came from, such as your phone's step counter or typed by hand). Only you can see your own steps. The public sees group totals, never a list of people.
• Groups: which team or Gurdwara you joined, and the steps you added while a member. Team names are public, so please do not put personal details in one.
• Events and passes: which event you registered for, how many guests you bring (a number, not their names), and whether you are confirmed or on the waiting list. A steward scanning your pass records that you checked in. A wallet pass holds the event, your nickname, a ticket number and a signed QR code.
• Shop orders: your email, name, delivery address, an optional phone number, what you ordered, and delivery and payment status. You type your card details straight into Stripe's form. They never reach our servers.
• Contact form: your name, email, topic and message. Group walk sign-ups: group name, contact name, email, city, country and expected number of walkers.
• Newsletter and waiting lists (including the Kadam app list): your email, which list, your language, where you signed up and when you agreed. We use a confirmation email and every news email has an unsubscribe link.
• Safety records: when you sign in or out we keep the type of event, the time and a scrambled (keyed, shortened hash) version of your IP address. We do not keep the address itself. Cookies and device storage: one strictly necessary sign-in cookie; a short-lived cookie (10 minutes) while you sign in with Google or Apple; and small items kept on your device for your age answer and your shop basket. No advertising or tracking cookies. See the cookies page.
• Servers and our proxy keep ordinary technical logs of visits (such as IP address and page requested) for running and securing the service.
• On your phone only (not sent to us): your age answer, your language, your step history and queue, event reminders, and, if you open the live-walk map and allow it, your location. Location in the app is optional, used only while the app is open on screen, kept on the phone and not sent to us.

We do not collect your date of birth, your contacts, your photos or advertising identifiers.

Why we use it

• To run your account, count your steps and show group and worldwide totals.
• To register you for events, issue passes and check you in.
• To take, make, send and deliver shop orders, and to reply to you.
• To send the emails you asked for. We send news only to people who said yes.
• To keep the service safe, stop abuse and fix problems.

In legal terms we rely on: a contract with you (accounts, events and orders), your consent (news emails and optional choices), our legitimate interest in running a safe charity service, and the law (tax records). We do not sell your details or use them for advertising.

Children

Accounts are for people aged 13 and over. Before you sign in we ask when you were born. This is a self-declared answer: we do not check it. Your answer stays on your device. We do not send or keep your date of birth.

If you are under 13 you cannot make an account. You can read the whole website and use the Kadam app as a guest, where your steps stay on the phone and are never sent to us. We do not run a parental-consent process, because under-13s do not get accounts.

We never show the name or steps of an individual person publicly. If you think a child has given us their details, email us and we will look into it and delete them.

Who helps us

These companies help us run the service. We have agreements with them and they use your details only for us, except where we say they decide for themselves. We do not sell your details.

• Hostinger: hosts our servers, database and website files.
• Cloudflare: sits in front of the website (it sees visitors' IP addresses and requests), runs our domain name settings, and stores encrypted backups (R2).
• Backblaze (B2): stores a second copy of our encrypted backups.
• Resend: sends our emails (sign-in links, event and waiting-list emails, news, form replies and order emails). It receives the address and the email text.
• Stripe: takes card payments for shop orders and paid events, and also uses card data for fraud checks and the law, as its own controller.
• Printful: makes and posts some merchandise. It receives your name, delivery address, email, optional phone number and items.
• A local fulfilment vendor or packing volunteers: pack and post items we make ourselves. They receive a packing sheet with your name, address, phone number and items.
• Royal Mail, Evri, DPD, DHL, UPS and Parcelforce: deliver parcels. They see the name and address on the parcel. They decide for themselves how to use it.
• Google: if you choose Sign in with Google (we receive your stable ID and email); Google Wallet for Android passes; Google Maps. On Android the live-walk map uses Google map tiles, so Google sees your phone's IP address and the map area. The map on event pages loads only after you click. Our volunteers also read the contact mailboxes in Gmail.
• Apple: if you choose Sign in with Apple; Apple Wallet passes (kept on your phone); Apple Maps on iPhone, so Apple sees your IP address and the map area; and the App Store.
• Expo and GitHub: build and store our app code. They receive no personal data about you.

Embedded videos and posts from YouTube, Instagram and Facebook load only when you press play or choose to allow them (see the cookies page). Then those companies see your IP address and device details. If you follow a map link, OpenStreetMap sees your visit. Some of these companies work outside the UK.

How long we keep it

• Your account: until you delete it.
• Steps: each day's row is deleted 18 months after the end of the walk year it belongs to. The steps then only remain inside the worldwide total, with no link to you.
• Event check-ins: 30 days after the event.
• Contact messages and group walk sign-ups: 12 months after each message.
• Sign-in records (including the scrambled IP): 90 days. Sign-in sessions last up to 30 days.
• Shop orders and payment records: kept for as long as tax and accounting law requires, which we expect to be six years. [OWNER TO CONFIRM with the accountant.]
• News and waiting list: until you unsubscribe. We then keep your email only as a "do not email" record. [OWNER TO CONFIRM.]
• Backups: encrypted, and replaced on a rolling schedule of roughly two to three weeks.

If you delete your account, anything in a backup is not restored for you and disappears when that backup ages out, about two to three weeks later.

Your rights and your choices

You can ask to see your details, correct them, delete them, move them to another service, object to how we use them, or take back a consent you gave. This is your right under UK data protection law.

• See or download your details: sign in, open your account, choose "Privacy and my data", then "Download my data". In the Kadam app, use "Download my data". The file holds your account, sign-in records, steps, registrations, check-ins and news subscriptions. It does not yet include contact-form messages, group sign-ups or shop orders: email us for those.
• Delete your details: choose "Delete my account" on the same page or in the app. This removes your profile, sessions, sign-in links, group memberships, steps, registrations and check-ins, and any news, contact and group sign-up records with the same email. Public totals are corrected within about 15 minutes. Wallet passes stop working. We keep shop orders and payment records for tax, a record that an account was deleted, without name or email (it keeps a scrambled IP address for up to 90 days), and backups until they age out.
• Correct your details: in your account or the app you can change your nickname, language, country, group and email choices. To change your email, email us.
• Stop news emails: use the link at the bottom of any email, or change the choice in your account.
• Anything else, or if you have no account: email [email protected]. We reply within one month.

If you are unhappy with how we have handled your details you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would like the chance to put it right first.

Changes and contact

If we change how we use your details we will update this page and, for big changes, tell you. The date at the top shows the latest version.

Contact: [email protected].

Read the terms of use