Privacy Policy
Last updated: 5 September 2026
1. Who we are
We are the Data Protection Foundation, CIC (the “DPF”). We exist to support consumers to assert their data rights, through education, research and seeking legal redress. We are a non-profit community interest company and a company limited by guarantee, UK registered company number 12820041. Our registered office is Third Floor, 1 New Fetter Lane, London, EC4A 1AN.
We campaign for your right to control the use of your personal information. We hold ourselves to the standard we ask of others, so this policy sets out in specific terms what we collect, who processes it, where it goes, and how long we keep it.
2. Data controller
The Data Protection Foundation, CIC is the data controller for the processing described in this policy, and is registered with the Information Commissioner's Office under registration number C1470293.
Questions about this policy, our processing, or your rights: hello@dataprotectionfoundation.org.
3. Cookies and tracking
This website sets no cookies. It uses no analytics, no tracking technologies, no advertising pixels and no third-party scripts of any kind. Our fonts are served from our own domain rather than from a font provider, so visiting this site does not disclose your visit to any third party.
Because we do not store or access information on your device beyond what is strictly necessary to deliver the pages you request, no consent is required under the Privacy and Electronic Communications Regulations 2003, and we do not display a cookie banner.
This is enforced technically as well as by policy. Our site sends a Content Security Policy that instructs your browser to refuse connections to any domain other than our own. If a tracker were ever added to this site by mistake, your browser would block it.
4. What we collect and why
Website request data
When you visit, our hosting provider records standard request information, which may include your IP address, the page requested, and your browser type. This is used only to deliver the site and keep it secure. We do not use it for analytics and we do not build profiles from it.
Legal basis: our legitimate interests in delivering and securing our website.
Membership data
When you join the DPF we collect your name and email address. We use these to administer your membership and to send you updates about our work.
Legal basis: performance of the membership agreement you enter into with us, and your consent for updates. You can withdraw at any time.
Correspondence
If you contact us we process your name, email address and the content of your message, in order to respond.
Legal basis: our legitimate interests in responding to enquiries, or your consent.
We do not collect special category data. We do not carry out automated decision-making or profiling.
5. Who processes your data
We use a small number of service providers. Each acts as our processor under a written agreement, and each is listed here in full.
| Provider | What it does | What it processes | Where data is stored |
|---|---|---|---|
| Vercel Inc. (US) | Hosts and delivers this website | Website request data, including IP address | Served from London. Logs retained by Vercel for a limited period under its published retention policy |
| Supabase Inc. (US) | Stores membership records | Name, email address | London, United Kingdom |
| Resend (US) | Sends membership and update emails | Name, email address, content of emails we send you | United States |
| Google (Google Workspace) | Our own email accounts | Any email you send us | European Union |
We do not sell your data. We do not share it for advertising. We do not disclose it to any other party except where we are legally required to do so.
6. International transfers
Some of our providers are established in the United States, and in the case of Resend your data is stored there.
Where personal data is transferred outside the United Kingdom, we rely on the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, together with the UK Extension to the EU-US Data Privacy Framework where the provider participates in it. We have assessed these transfers and keep that assessment under review.
We are actively working to reduce these transfers. Our intention is to move email delivery to a provider that stores data within the European Economic Area, and we will update this policy when we do.
7. How long we keep it
| Data | Retention |
|---|---|
| Membership records | Kept for as long as you remain a member. If you withdraw, we delete your record within 30 days. We keep your email address alone on a suppression list, so that we do not contact you again by mistake. |
| Correspondence | 24 months from our last contact with you, then deleted. |
| Website request logs | Retained by our hosting provider for a limited period, then deleted. We do not retain copies. |
| Donation records | Seven years, as required by tax and company law |
8. Security
We protect your data with appropriate technical and organisational measures, including:
- Encryption in transit using TLS on all connections to this site
- Encryption at rest for membership records
- Multi-factor authentication on every administrative account
- Access limited to the smallest number of people who need it
- Published email authentication records (SPF, DKIM and DMARC) so that messages purporting to come from us can be verified
- A Content Security Policy restricting what this website is permitted to connect to
9. Your rights
You have the right to:
- be informed whether we hold data about you, and to access it
- have inaccurate data corrected
- have your data deleted
- restrict or object to our processing
- receive your data in a portable form
- withdraw consent at any time
To exercise any of these, email hello@dataprotectionfoundation.org. We will respond within one month.
To withdraw your membership, email the same address. We will delete your record as set out in section 7.
10. Complaints
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or by telephone on 0303 123 1113.
11. Changes to this policy
We keep this policy under review. Any changes will be published on this page with an updated date. Where a change materially affects how we use your data, we will tell members directly.