Privacy Policy

2. Data We Collect

We collect only the data necessary for the specific purpose it serves. What we collect depends on how you use our services:

We do not collect sensitive personal data (such as ethnicity, religion, or health information). We do not use automated decision-making or profiling.

3. Legal Basis for Processing

Under UK GDPR, we must have a lawful basis for processing personal data. We rely on the following bases:

• ✓Contractual necessity (Article 6(1)(b)): Processing your registration data, creating and managing your account, and operating the platform.
• ✓Legitimate interests (Article 6(1)(f)): Sending transactional emails, fraud prevention, and improving the platform. We have assessed that our interests do not override your rights.
• ✓Consent (Article 6(1)(a)): Placing analytics cookies and loading Google Analytics. You may withdraw consent at any time by declining cookies or clearing your cookie preference.
• ✓Legal obligation (Article 6(1)(c)): Retaining transaction records and responding to regulatory requests where required by law.

4. How We Use Your Data

• —To create and maintain your account and profile on the Civic Bridge platform.
• —To match speakers with schools and facilitate event bookings.
• —To send transactional emails (account creation, event notifications, verification requests).
• —To display your approximate location on the Civic Bridge speaker/school map (postcode only — never precise GPS location).
• —To send occasional updates about Civic Shift's work (you may opt out at any time by emailing us).
• —To improve the platform using anonymised, aggregated analytics data (only with your consent).
• —To comply with our legal and safeguarding obligations.

5. Data Retention

We retain your data only for as long as necessary for the purposes described in this policy or as required by law. Our retention periods are:

• Active accounts:Retained for the lifetime of your account. You may delete your account at any time from your dashboard.
• Pending school registrations:Deleted automatically 24 months after submission if not actioned.
• Event records:Retained for 3 years from the event date for safeguarding and audit purposes.
• Messages:Deleted when you delete your account. Not retained separately.
• Analytics data:Google Analytics data is retained for 14 months (our GA4 setting). We do not store raw analytics data ourselves.
• Financial records:Donation records retained for 7 years as required by HMRC.

6. Young People and School Pupils

Civic Shift works with schools and may process personal data belonging to pupils, some of whom may be under 18. We take extra care with young people's data:

• ✓Pupil accounts on Civic Bridge are only created after a teacher at a registered school explicitly verifies the registration. The teacher acts on behalf of the school (the institution responsible for the pupil's welfare during school activities).
• ✓We do not knowingly allow children under 13 to create accounts without teacher verification acting as a safeguarding control. If you believe a child under 13 has registered without appropriate authorisation, please contact us immediately at info@civicshift.org.uk.
• ✓Pupil profile data is limited to: name, school name, and email address. No sensitive personal data about pupils is collected.
• ✓Pupils (or their parents/guardians) may request deletion of their account and all associated data at any time — either via the dashboard or by emailing us.
• ✓We do not use pupil data for any purpose other than operating the Civic Bridge platform.
• ✓Schools using Civic Bridge act as a co-controller in respect of their pupils' data. Schools should ensure they have appropriate consent and notification processes under their own data protection policies.

7. Cookies and Analytics

We use two categories of cookies:

• Essential cookies: Necessary for the platform to function (for example, keeping you logged in). These do not require your consent.
• Analytics cookies (Google Analytics 4): Used to understand how visitors use our site in aggregate. These are only placed with your explicit consent, which you can give or withdraw via the banner on your first visit.

Your cookie preference is stored in your browser's local storage. You can change it at any time by clearing your browser data. Google Analytics data is anonymised — we do not receive personally identifying information from it.

8. Data Processors

We use the following third-party data processors under written data processing agreements (DPAs). They process your data only on our instructions and in accordance with their own privacy policies and relevant adequacy decisions:

• —Supabase: Database, authentication, and file storage. Hosted in the EU (Ireland). Subject to EU standard contractual clauses.
• —Resend: Transactional email delivery. US-based, subject to standard contractual clauses.
• —Stripe: Secure donation payment processing. PCI-DSS compliant. US-based, subject to standard contractual clauses.
• —Vercel: Website hosting and serverless infrastructure. US-based, subject to standard contractual clauses.
• —Google Analytics 4: Aggregated site analytics. Only loaded with your consent. US-based, subject to standard contractual clauses.
• —Mapbox: Interactive mapping of speaker and school locations (postcode-level only). US-based, subject to standard contractual clauses.

We do not sell your personal data to any third party.

9. Your Rights

Under UK GDPR and the Data Protection Act 2018, you have the following rights:

• ✓Right of access — to request a copy of your personal data.
• ✓Right to rectification — to correct inaccurate or incomplete data.
• ✓Right to erasure — to request deletion of your data. Account holders can delete their account directly from their dashboard.
• ✓Right to restriction — to request we limit how we process your data.
• ✓Right to data portability — to receive your data in a structured, machine-readable format.
• ✓Right to object — to processing based on legitimate interests or for direct marketing.
• ✓Right to withdraw consent — for cookie-based analytics, at any time via your browser settings.

To exercise any of these rights, email info@civicshift.org.uk. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated to registered users by email. The “last updated” date at the top of this page will always reflect the most recent revision.