Make a donation

Privacy Policy

Draft for review — not legal advice. This document was prepared as a starting point and reflects how the site currently works. It must be reviewed and approved by a qualified solicitor before publication, and every [bracketed placeholder] must be completed.

Last updated: [DATE]

Who we are

This site is operated by the [Sebbie Hall Kindness Foundation] ("we", "us", "our"), [a registered charity in England and Wales, charity number [CHARITY NUMBER]], registered address [REGISTERED ADDRESS]. We are the "controller" of your personal data.

For anything about this policy or your data, contact us at [privacy@sebbiehall.org].

The information we collect

  • When you contact us — your name, email address, organisation (optional) and the message you send.
  • When you subscribe to our newsletter — your email address.
  • When you join the Kindness Challenge — your email address, the display name and optional profile picture you choose, and a record of the acts of kindness you tick off (your "KindCoins").
  • Automatically — a small amount of technical data needed to run the site securely, including essential cookies that keep you signed in, and standard server logs (e.g. IP address, browser type) kept for security. We do not use advertising or analytics cookies. Where a page embeds content from Instagram (e.g. our Gallery), Instagram may set its own cookies — see Cookies below.

We do not knowingly collect more than we need, and we never sell your data.

How and why we use it, and our legal basis

  • To reply to your enquiry — on the basis of our legitimate interests in responding to people who contact us.
  • To send you our newsletter — on the basis of your consent. You can unsubscribe at any time via the link in every email or by contacting us.
  • To run your Kindness Challenge account — on the basis of your consent and to provide the service you asked for. This includes showing your display name on the public leaderboard.
  • To keep the site secure and working — on the basis of our legitimate interests.

Who we share it with

We use a small number of trusted service providers ("processors") who handle data on our behalf under contract:

  • Supabase — database and sign-in (magic-link authentication) for the Kindness Challenge, and a backup copy of contact/newsletter records.
  • Vercel (hosting), Neon (database) and Vercel Blob (image storage) — for the website and its content.
  • Resend — to send transactional and notification emails.
  • JustGiving — if you choose to donate, you are taken to JustGiving's own website to complete your donation. We do not process or store your card details; JustGiving's own privacy policy applies to that.

Some of these providers may process data outside the UK/EEA. Where they do, we rely on appropriate safeguards (such as UK/EU adequacy decisions or standard contractual clauses).

How long we keep it

We keep personal data only as long as we need it: newsletter subscriptions until you unsubscribe; contact messages for [RETENTION PERIOD, e.g. 24 months]; Kindness Challenge accounts until you ask us to close them. We then delete or anonymise it.

Your rights

Under UK data protection law you have the right to: access your data; have it corrected; have it erased; restrict or object to our use of it; data portability; and to withdraw consent at any time. To exercise any of these, contact [privacy@sebbiehall.org].

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.

Children and young people

The Foundation works with, features and celebrates disabled young people. The Kindness Challenge is intended for people aged [16] and over; if you are under [16], please ask a parent or guardian before signing up. If you believe a child has given us personal data without appropriate consent, contact us and we will remove it.

Cookies

We use only essential cookies needed to keep you signed in to the Kindness Challenge and to keep the site secure. We do not use advertising or our own tracking cookies.

Some pages (such as our Gallery) embed content from Instagram. When an Instagram post or reel is displayed, Instagram may set its own cookies and receive technical data (such as your IP address) directly, in line with Meta's own privacy policy, over which we have no control. This happens only on pages where such content appears. [If analytics or other third-party cookies are added later, this section — and the cookie banner — must be updated.]

Changes to this policy

We may update this policy from time to time. The "last updated" date above shows when it last changed.

Contact

[Sebbie Hall Kindness Foundation], [REGISTERED ADDRESS] — [privacy@sebbiehall.org].