Privacy policy

Last updated: 20 August 2026

This notice explains how Terrabase Ltd uses personal information when you visit Unified Lodge Secretary, create an account, or use the service. It is written for lodge officers, members, guests and anyone else whose details may be stored in the system.

1. Who we are

Unified Lodge Secretary is operated by Terrabase Ltd (registered name TERRABASE LIMITED), a company registered in England and Wales.

• Company number: 04612938
• VAT number: GB 680 2244 52

Registered office:

Product and support enquiries: info@unifiedlodgesecretary.co.uk.
Privacy and data-protection enquiries: privacy@terrabase.co.uk.

2. What this notice covers

UK data protection law treats the organisation that decides why and how personal information is used as the controller, and an organisation that handles that information on someone else’s instructions as a processor.

For Unified Lodge Secretary:

• Terrabase Ltd is the controller for information about people who use the product itself — for example account holders (overseers, managers and clerks), billing contacts, people who email us, and technical data needed to run and secure the website.
• Each lodge is the controller for the lodge records it enters or imports: members, guests, visitors, attendance, documents, expenses and similar lodge business. Terrabase Ltd is the processor of those records: we store and process them only to provide the service the lodge has asked for.

If you are a lodge member (or a guest or visitor) and you want to know how your lodge uses your details, please contact the lodge in the first instance. We will help that lodge respond where we hold the information on its behalf. A data processing agreement is available on request from privacy@terrabase.co.uk.

Terrabase’s public company website at terrabase.co.uk has its own privacy notice. This page is specifically about Unified Lodge Secretary.

3. Information we collect as controller

Depending on how you use the service, we may process:

• Account details — name or email used to sign in, password (stored in hashed form, not as plain text), email verification status, and the lodges and roles attached to your account.
• Lodge account and billing details — lodge name and number, billing contact email, subscription status, and identifiers we receive from Stripe (our payments provider) such as customer and subscription IDs. We do not store full card numbers.
• Service messages you receive from us — verification links, password resets, lodge invitations, and billing notices.
• Support correspondence — emails or other messages you send to us, including any lodge or account details you include.
• Security and audit data — sign-in activity, IP address, and a log of sensitive actions (for example invitations, role changes, billing updates, and archive or reopening of a lodge).
• Technical data — browser type, device information and similar server-log data needed to deliver and protect the service.

Sign-in is by email address and password. We do not offer social-media login.

4. Lodge records we process as processor

Lodge officers enter (or import) the information their lodge needs to run itself. Typical categories include:

• Members — names, contact details, postal address, date of birth, membership dates and status, ranks and titles, membership references, proposer and seconder, dietary requirements, notes, and related documents.
• Meetings and attendance — meeting details, who was invited, who attended or sent apologies, dining choices, and dietary requirements.
• Guests and visiting members — names and, where the lodge records them, telephone, mobile, email and dietary requirements.
• Payments the lodge collects — amounts, descriptions, payment status and Stripe identifiers for dining fees or other sums the lodge chooses to collect. Card details are handled by Stripe, not stored in Unified Lodge Secretary.
• Documents and reports — files the lodge uploads, and lists or reports officers generate or export (for example CSV or Excel downloads).
• Secretarial expenses recorded against the lodge.

Some of this may be special category data under UK GDPR — in particular dietary requirements, which can indicate health or religious information. The lodge decides whether to collect that information and is responsible for having a lawful basis to do so. We process it only to provide the service.

Members do not automatically receive a user account. An account is created only for people the lodge (or we) invite to operate the system.

5. Why we use personal information, and our lawful bases

Where Terrabase Ltd is the controller, we rely on these bases:

• Contract — to create and run your account, provide the subscribed service, send service emails (verification, password reset, invitations, billing), and take payment for the lodge subscription.
• Legitimate interests — to keep the service secure, prevent misuse, keep audit records, improve reliability, and respond to support requests. We keep this processing proportionate.
• Legal obligation — to keep accounting and tax records, and to respond to lawful requests from authorities.

We do not sell personal information. We do not use Unified Lodge Secretary to send unsolicited bulk marketing. If that ever changes, we will only do so with a lawful basis and a clear way to opt out.

Where we are the processor, we use lodge records only to provide the functions the lodge uses: storing the roster, running meetings, sending meeting invitations the lodge chooses to send, collecting payments the lodge initiates, producing reports and exports, and supporting the lodge when it asks us to.

6. Who we share information with

We share personal information only where necessary, including with:

• Stripe — to take lodge subscription payments and, if a lodge connects its own Stripe account, to collect sums from members on that lodge’s behalf. Stripe’s own privacy notice applies to the payment data it processes.
• Hosting, backup, email and infrastructure providers who run the platform on our instructions, under contracts that require them to protect the data and use it only for that purpose.
• Professional advisers (for example accountants or solicitors) where needed to run the business.
• Authorities where the law requires us to disclose information, or to protect rights, safety or security.

Lodge officers with access to a lodge can see that lodge’s records according to their role. We do not give one lodge access to another lodge’s roster. People we employ or contract to support the service may access lodge data when needed to fix a problem or answer a request you have made. There is no formal support SLA; contact is personal and by email.

If a lodge officer exports a file or forwards an email, that copy is outside our control. Lodges should handle downloads and printed lists in line with their own privacy responsibilities.

7. International transfers

Some providers (notably Stripe) may process information outside the United Kingdom. Where a transfer is not to a country covered by a UK adequacy decision, we use appropriate safeguards such as the UK International Data Transfer Agreement or equivalent standard contractual clauses.

8. How long we keep information

• Active lodge accounts — for as long as the lodge uses the service.
• Archived lodges — if a subscription ends, we keep that lodge’s records in archived form for 12 months so the lodge can reopen. After that window we may delete or further restrict the operational records.
• Billing, tax and company records — typically up to six years, or longer if the law requires it.
• Account and security logs — for as long as needed to operate, secure and review the service, then deleted or aggregated.
• Support email — while we are dealing with a request and for a reasonable period afterwards so we can follow it up.

Lodge officers can update or remove member records they control while the lodge account is active. If you want a lodge’s data erased after the archive window, contact privacy@terrabase.co.uk.

9. Cookies

We use a strictly necessary session cookie so that you can stay signed in and so that forms are protected against misuse. We do not use advertising cookies, and we do not currently use third-party analytics cookies on Unified Lodge Secretary.

Because these cookies are required to provide the service you asked for, we do not show a cookie banner. You can block cookies in your browser, but the signed-in application will not work without the session cookie.

10. Security

We use HTTPS, hashed passwords, access controls based on lodge and role, and audit logging of sensitive actions. Payment card data is handled by Stripe rather than stored in our database.

No internet service is completely secure. Please use a strong password, keep your sign-in details to yourself, and tell us promptly if you think an account has been misused. Payment links sent to members are token-based: anyone who has the link can complete that payment, so those messages should be treated as confidential.

11. Your rights

Where Terrabase Ltd is the controller, you may have the right to:

• request access to personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to delete information in certain circumstances;
• restrict or object to certain processing;
• receive information you provided in a portable format where the law applies;
• complain to the UK Information Commissioner’s Office (ICO).

To exercise these rights, email privacy@terrabase.co.uk. We may need to confirm your identity. We aim to respond within one month, or to explain if we need more time.

ICO website: ico.org.uk.

12. Lodge members, guests and visitors

If your details are in a lodge’s records, that lodge is the controller. Please contact the lodge secretary or overseer first. Typical requests (correction of an address, removal of a guest record, a copy of what the lodge holds about you) are for the lodge to handle. We will assist the lodge as its processor.

Please do not send us special category information (for example health details) by general email unless we have agreed a suitable channel.

13. Children

Unified Lodge Secretary is a professional tool for people who run a lodge. User accounts are not offered to children. A lodge may still hold dates of birth or other details about younger people if it chooses to record them; that lodge remains responsible for doing so lawfully.

14. Changes to this notice

We may update this page when the product, our suppliers or the law changes. The “Last updated” date above will change when we do. We encourage you to review it from time to time. If we make a material change, we will take reasonable steps to bring it to account holders’ attention.

15. Complaints

If you are unhappy with how we have used personal information, please contact privacy@terrabase.co.uk so we can try to put it right. You also have the right to complain to the ICO at ico.org.uk.

16. Related

Use of Unified Lodge Secretary is also governed by our terms of service.