Voluntree Privacy Policy

Last updated: 20th June 2024

This is the privacy policy of Voluntree Community Interest Company (“Voluntree”, “we”, “our”, “us”), our website (voluntree.net) and our apps (“our platform”). This explains how we collect, use, share, and transfer your personal data when you use the services provided on our sites and our apps, and interact with us. It also includes your data privacy rights.

1. What personal data do we collect?

We collect your personal data when you visit our sites and platform, register to host or attend workhsops, or when you interact with us. We collect your personal data in the following ways:

When you talk to us at events or on social media

We may collect:

• Your name
• Your email address
• Other details such as your contact number

Personal data we generate about you

When you use our platform we may use cookies or similar technologies to collect data, including:

• Your IP address - a numerical code to identify your device, together with the country, region or city where you are based
• Information on how you interact with our services
• Your browsing history of the content you have visited on our sites, including how you were referred to our sites via other websites
• Details of your computer, mobile, TV, tablet or other devices, for example, the unique device ID, unique vendor or advertising ID and browsers used to access our content

We will not collect special categories of data from you - such as personal data concerning your race, political opinions, religion, health or sexual orientation.

When you submit a donation

When you make a donation to us via our website we collect the following information:

• Your email address
• Your name - providing your name is optional and if you prefer to stay anonymous you can leave this field empty. We believe in full fiscal transparency so all our donations are accessible on our finance page at https://voluntree.net/finances
• Personal data, including identifying information about the devices that connect to its services. For more information on our payment processor, Stripe, see privacy policy at https://stripe.com/privacy

2. Why we collect personal data

We collect this data to:

• Respond to your queries and to resolve complaints
• Diagnose and replicate problems
• Detect abuse and to provide hosting usage information
• Provide insights and analytics to improve our products and services
• Process donations

3. When we share your personal data

We may share your data with other organisations that provide services on our behalf. We may do this to perform a contract we have entered into with you, where it is in our legitimate interests or with your consent. Examples of when we may share your data with service providers include sharing with:

• Our internet and cloud hosting services provider, Amazon Web Services (AWS). See their privacy notice https://aws.amazon.com/privacy. We also use Supabase, see their privacy policy at https://supabase.com/privacy.
• Service providers that help provide us with insights and analytics that help us to improve our products and services. For example, we use Google Analytics to understand how visitors engage with our sites or apps. For more information, see How Google uses information from sites and apps that use our services.
• Our online payments processors who process credit and debit card transactions on our behalf, Stripe. Stripe collects and processes personal data, including identifying information about the devices that connect to its services. Stripe uses this information to operate and improve the services it provides to us, including for fraud detection and prevention. You can learn more about Stripe and its processing activities via privacy policy at https://stripe.com/privacy.

4. Lawful bases

We use personal data collected through our sites and apps only when we have a valid reason and the legal grounds to do so. The legal ground may be one of the following:

• Consent: Often we will use your personal data because we have asked for your consent, which you can withdraw at any time. For example, to collect information about how you use our platform.
• Compliance with law: In some cases, we may have a legal obligation to use or keep your personal data.
• Our legitimate interests: We may process your personal data where it is necessary for our legitimate interests in a way that might be expected as part of running Voluntree in a way which does not materially impact your rights and freedoms.

5. How we store your personal data

We keep your personal data for only as long as we need to. How long we need your personal data depends on what we are using it for, as set out in this privacy policy. For example, we may need to use it to answer your queries about a certain workshop that you hosted/attended and as a result may keep personal data while you are still using our product or services.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means.

If we no longer need your data, we will delete it or make it anonymous by removing all details that identify you. If we have asked for your permission to process your personal data and we have no other lawful grounds to continue with that processing, and you withdraw your permission, we will delete your personal data.

6. International data transfers

Data we collect may be transferred to, stored and processed in any country or territory where one or more of our service providers are based or have facilities. While our servers and databases are based in the European Economic Area (EEA), our service providers may transfer data to the United States.

The Privacy Shield frameworks previously provided a mechanism to comply with data protection requirements when transferring EEA, UK or Swiss personal data to the United States and onwards. In light of the Court of Justice of the European Union ruling on data transfers, invalidating the EU-U.S. Privacy Shield, we have moved to reliance on Standard Contractual Clauses for relevant data transfers, which, as per the ruling, can continue to be a valid legal mechanism to transfer data under the GDPR. The European Commission approved new versions of the Standard Contractual Clauses on June 4, 2021.

7. Your data protection rights

Under data protection law, you have the following rights:

• Your right of access: You have the right to ask us for copies of your personal information.
• Your right to rectification: You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure: You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing: You have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing: You have the right to object to the processing of your personal information in certain circumstances.
• Your right to data portability: You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. Please contact us at info.voluntree@gmail.com if you wish to make a request.

8. Contact us

If you have any concerns about our use of your personal information, you can make a complaint to us at info.voluntree@gmail.com.

You can also complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we have used your data.

The ICO’s address:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk