Skip to content

Prototype for review. Some pages carry drafted content pending legal or ACT sign-off (privacy, terms, refund policy). Annual report PDFs and a handful of photographs are still to be uploaded. Design system

Donate Now
Legal

Privacy Policy

Draft — pending legal review. Written to a GDPR / APP / CCPA shape but not yet reviewed by a solicitor. Every ACT-specific detail marked [ACT to confirm] must be supplied before publication.

Who we are

ACT Foundation International is a charity registered with the Charity Commission for England and Wales, no. 1149049. In this policy, “we,” “us” and “our” mean ACT Foundation International.

  • Registered office: [ACT to confirm]
  • General enquiries: info@actfoundation.org
  • Data protection contact: [ACT to confirm — a named individual or an inbox such as privacy@actfoundation.org]
  • EU representative (Art. 27 UK GDPR / EU GDPR): [ACT to confirm]

ACT operates in over 25 countries through volunteer teams. When those teams receive personal data from you directly (for example, at a local fundraising event), the local team is the controller for that processing. This policy covers personal data collected through this website and through information you send to info@actfoundation.org.

What we collect, and why

We collect the smallest amount of personal data needed for each purpose.

  • When you donate: name, email, phone (optional), donation amount, and the initiative or campaign you chose. Lawful basis: contract (Art. 6(1)(b) UK GDPR).
  • When you send us a message: name, email, subject, message. Lawful basis: legitimate interests (Art. 6(1)(f) UK GDPR).
  • When you subscribe to our newsletter: name, email. Lawful basis: consent (Art. 6(1)(a) UK GDPR) — you can unsubscribe at any time.
  • When you visit the site: IP address, browser and device information, pages viewed, referrer. Lawful basis: legitimate interests.

We do not collect government-issued identifiers (passport, SSN, PAN, NIN), financial-account numbers directly (the future payment provider handles those — see “Payments” below), or special-category data (Art. 9 UK GDPR) unless you volunteer it in a message to us.

Cookies and similar technologies

We set only cookies strictly necessary for the site to work, and — if you consent — a small analytics measurement. You do not have to accept the analytics cookie; you can refuse it through the cookie banner on your first visit and change your choice later through the same banner. We do not set marketing cookies. We honour Do Not Track signals: if your browser sends DNT, we do not set the analytics cookie regardless of your banner choice.

Who we share your personal data with

We do not sell your personal data, ever, in any jurisdiction. We share it only with the providers we need to run the site and process gifts.

  • Cloudflare, Inc. — hosting, DDoS protection (US, with EU/UK data-processing agreement).
  • [ACT to confirm — payment provider] — processing donations. The provider is a separate controller for card and bank details; we do not see or store your card number.
  • [ACT to confirm — email service] — sending receipts and newsletter.
  • Local ACT country teams — only what you gave to a specific local event or campaign, in the country where the team operates.

We do not share your personal data with any organisation for its own marketing purposes.

International transfers

ACT is based in the UK. Some of the providers above are outside the UK and the EEA. Where personal data leaves the UK, we rely on an adequacy decision by the UK Secretary of State, or on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or on your explicit consent to the transfer where we ask for it. For transfers from the EEA under EU GDPR, we rely on Standard Contractual Clauses (2021/914) with UK-equivalent safeguards.

Payments

When the production site starts taking donations, payments will be processed by [ACT to confirm — payment provider]. Your card or bank details go directly to that provider; we never see or store them. The provider's own privacy policy governs the payment step — a link to it will appear on the donation form. Currently the donation form on this site is a template and takes no payment.

Retention — how long we keep your personal data

  • Donation records: 7 years after the last gift, to comply with UK charity accounting and HMRC requirements [ACT to confirm].
  • Contact-form enquiries: 24 months after the last exchange, then deleted.
  • Newsletter list: until you unsubscribe. We remove your email within 30 days of an unsubscribe.
  • Server logs: Cloudflare's default.
  • Analytics data: [ACT to confirm — depends on the provider chosen].

Your rights

Wherever you live, you have the rights the applicable law gives you.

In the UK and EU (UK GDPR / EU GDPR): access, rectification, erasure (subject to our retention obligations), restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent where consent was the basis.

In Australia (Privacy Act 1988 / APPs): access, correction, and complaint rights as set out in APPs 12, 13.

In California (CCPA / CPRA): the rights to know, delete, correct, opt out of sale or sharing (we do not sell), limit the use of sensitive personal information (we do not use it), and non-discrimination. We respond within 45 days.

How to exercise a right. Write to info@actfoundation.org. We verify your identity, then respond free of charge — within one month under UK / EU GDPR, or 45 days under CCPA.

Children

The site is aimed at adults. We do not knowingly collect personal data from children under 16 for the purposes of consent, or under 13 for the purposes of CCPA / COPPA. If you believe a child's data has reached us, write to us and we will delete it.

Complaints

If you are unhappy with how we handle your personal data, please write to us first — we would rather fix it than have you go to a regulator. If we cannot resolve it, you have the right to complain to:

  • UK residents: the Information Commissioner's Office — ico.org.uk, 0303 123 1113.
  • EU residents: your national data-protection authority.
  • Australian residents: the Office of the Australian Information Commissioner — oaic.gov.au.
  • California residents: the California Privacy Protection Agency — cppa.ca.gov.

Updates

We may update this policy from time to time. The “Last updated” date at the top of this page tells you when. Material changes are announced at the top of the site for 30 days before they take effect.