Privacy policy

1. Who we are

Factory East ("we", "us", "our") is a grassroots charity based in East London. This privacy policy explains how we collect, use, store, and protect personal information when you use our website (the "Site") or interact with us through it.

For the purposes of UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the data controller responsible for personal information processed in connection with the Site, unless we tell you otherwise in a specific context.

2. What information we may collect

Depending on how you use the Site, we may process:

• Contact details — for example your name, email address, telephone number, or message content, if you contact us through forms or links on the Site.
• Technical data — such as IP address, browser type, device type, general location (e.g. country or region), and pages visited, collected through cookies or similar technologies where applicable.
• Donation-related information — if you donate via a third-party provider (for example PayPal), that provider processes payment details under their own privacy policy. We may receive limited information from them needed to acknowledge or administer your donation.

3. How we use your information

We use personal information only where we have a lawful basis to do so. This may include:

• Responding to your enquiries and providing information about our work (typically on the basis of our legitimate interests in operating the charity and communicating with supporters, or your consent where required).
• Operating and improving the Site, including troubleshooting and security (legitimate interests).
• Complying with legal obligations (for example record-keeping or regulatory requirements).

4. Cookies and similar technologies

The Site may use cookies or similar technologies that are strictly necessary for the Site to function, or that help us understand how the Site is used. Where we use non-essential cookies, we will seek your consent where required by law. You can usually control cookies through your browser settings. For more detail, see our cookie policy.

5. Who we share information with

We do not sell your personal information. We may share it with:

• Service providers who help us host the Site, send emails, or analyse traffic, acting only on our instructions and under appropriate safeguards.
• Payment and donation processors, where you choose to donate or pay through their services.
• Professional advisers, regulators, or law enforcement where we are legally required or permitted to do so.

6. International transfers

Where personal information is transferred outside the UK, we will ensure appropriate safeguards are in place as required by applicable data protection law (for example adequacy regulations or standard contractual clauses).

7. How long we keep data

We keep personal information only for as long as necessary for the purposes described in this policy, including to meet legal, accounting, or reporting requirements. Retention periods vary depending on the type of data and the reason we hold it.

8. Your rights

Under UK data protection law you may have the right to:

• Request access to your personal information.
• Request correction of inaccurate or incomplete data.
• Request erasure in certain circumstances.
• Request restriction of processing in certain circumstances.
• Object to processing based on legitimate interests.
• Request data portability where applicable.
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint with the Information Commissioner's Office (ICO) — ico.org.uk.

To exercise any of these rights, please contact us. We may need to verify your identity before responding.

9. Security

We implement appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, or misuse. No method of transmission over the internet is completely secure; we cannot guarantee absolute security.

10. Children and young people

Our work supports young people, but the Site is not directed at collecting personal information from children without appropriate consent or involvement of a parent, guardian, or responsible adult where required. If you believe we have collected information from a child in error, please contact us and we will take steps to address it.

11. Changes to this policy

We may update this privacy policy from time to time. The "Last updated" date will be revised when we do so. We encourage you to review this page periodically. Continued use of the Site after changes may indicate acceptance of the updated policy where the law allows.