Privacy notice

Who is responsible

Itsnicetobehere Charity is responsible for the personal information described in this notice. Email xtraordinarylabs@gmail.com or call +44 7360 093019. Lisa Mutinhiri, Quality Assurance, handles privacy requests. Ask for the privacy lead and provide a safe way to reply.

If your concern involves the privacy lead, ask for Tallyn Mckale, Founder, through the same contact route. We do not publish or request identity documents through the website forms.

Information we collect

Support requests collect your full name, phone number, address and the practical assistance requested. Email is optional. You can add timing and a preferred contact method. Volunteer applications collect contact details, location, interests, availability and optional skills and motivation. Partner enquiries collect organisation and contact details, location and the proposed collaboration.

The staff directory holds a name, sign-in email, role, access status, reporting manager and optional phone, location and start date. Staff and permission changes create an access activity record. The website also uses short-lived, pseudonymous request counters to reduce form abuse.

Please provide only what is needed for the enquiry. Do not include medical records, identity numbers, bank details or another person’s private information. These forms do not accept file uploads. A parent, guardian or trusted adult can contact us about appropriate support for a child.

Purposes and lawful basis

We use enquiries to assess practical support, consider volunteer roles and partnerships, respond to the person concerned and keep an accurate record of follow-up. We use staff records to manage authorised access, responsibilities and organisational accountability. A submission does not guarantee assistance, a placement or a partnership.

Where UK data protection law applies, our basis for this necessary administration is our legitimate interest in operating the charity, responding to requests and protecting the service. We limit access and the information collected, and consider the effect on the person concerned. You may object to this use by contacting the privacy lead.

We seek separate permission before publishing an identifiable image or personal story. If a later activity requires sensitive personal information, we will explain the need, the applicable lawful basis and any additional conditions before requesting it through an appropriate channel. The public forms are not intended for that information.

Access, providers and international processing

Only active, authorised staff can access the administration workspace. Access to support requests, volunteer applications and partner enquiries is limited by role. Social media access does not include applicant submissions by default. We do not sell personal information or publish form answers as testimonials.

Website submissions are held in the hosted Cloudflare D1 database. Google Firebase provides staff sign-in and stores staff profiles, role permissions, access activity and website content. The hosting service and these providers may process information outside your country. Contact the privacy lead for information about the relevant provider arrangements and applicable safeguards.

We share information with a delivery partner only where it is needed for an agreed purpose, with appropriate safeguards and an explanation to the person concerned. We may also disclose information where required by law or necessary to respond appropriately to a safeguarding concern.

Retention and deletion

Closed support, volunteer and partner submissions become eligible for deletion 12 months after closure. Archived staff profiles become eligible after 12 months; a later update to an archived profile starts a new review period. Staff and permission activity becomes eligible after 24 months. Pseudonymous form rate-limit identifiers expire within 48 hours and are removed during bounded routine cleanup.

The owner reviews eligible records and runs the protected cleanup process. Open cases are reviewed for continuing need rather than assigned an invented closure date. Older records without a recorded closure date are reviewed manually. Information needed for an unresolved complaint, safeguarding matter or legal obligation is handled separately under an appropriate documented arrangement.

Encrypted backup copies are restricted to recovery use. The owner must protect the backup passphrase, replace older manual copies and remove copies no longer required. A restored backup must be checked against deletion records before operational use. Provider recovery copies follow the applicable provider retention period.

Your choices and rights

Contact the privacy lead to ask about your information, request a correction or deletion, object to use, or ask about other rights available under the law that applies to you. We may need proportionate information to confirm your identity. We normally respond to a UK data-rights request within one month and explain any permitted extension.

You can withdraw permission for future use of an image or story without affecting assistance. Withdrawal does not undo earlier lawful use, and copies already shared by other people may not be fully recoverable. If you remain concerned about UK data handling, you can contact the Information Commissioner’s Office at ico.org.uk. You may also have a right to contact the relevant regulator in your country.