Privacy Policy — With Kind Folk

1. Who we are

With Kind Folk is a corporate volunteering management platform operated by [Company Name] ("we", "us", "our"). We are registered in England and Wales. Our registered address is [Address]. If you have any questions about this policy, contact us at privacy@withkindfolk.com.

2. What data we collect

We collect the following personal data: (a) Account data: your name, email address, and organisation when you sign up. (b) Profile data: role, skills, hourly rate, and volunteering allowance configured by your organisation administrator. (c) Usage data: your participation in volunteering events, including registration, approval status, hours logged, and outcome data. (d) Technical data: IP address, browser type, and access timestamps, collected automatically for security purposes.

3. How we use your data

We use your data to: provide the With Kind Folk service to you and your organisation; calculate and display impact metrics and reports; send you notifications about events you have registered for; and improve the platform based on aggregated usage patterns. We do not use your data for advertising, profiling, or any purpose unrelated to providing our service.

4. Legal basis for processing

Under the UK GDPR, we process your data on the following legal bases: (a) Contract performance: processing necessary to provide the service you have agreed to use. (b) Legitimate interests: where we have a legitimate interest in processing data (e.g. platform security and abuse prevention). (c) Legal obligation: where we are required to process data to comply with applicable law.

5. Data sharing

We do not sell your personal data. We share data with: (a) Your organisation administrator, who can see all employee participation data within the platform. (b) Supabase, our infrastructure provider, who processes data on our behalf under a data processing agreement. (c) Any other processor only under a written data processing agreement and only as necessary to provide the service.

6. Data retention

We retain your personal data for as long as your organisation's account is active, plus 30 days following account cancellation (to allow data export). After this period, all personal data is permanently deleted. You may request deletion of your personal data at any time by contacting privacy@withkindfolk.com.

7. Your rights

Under the UK GDPR, you have the right to: access your personal data; correct inaccurate data; request deletion of your data; restrict or object to processing; and data portability. To exercise these rights, contact privacy@withkindfolk.com. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies

We use essential cookies for authentication and session management. We do not use tracking or advertising cookies. See our Cookie Policy for details.

9. Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, row-level security in our database, and regular security reviews. See our Security page for details.

10. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes by email. Continued use of the platform after notification constitutes acceptance of the updated policy.