Privacy Policy.

1. What we collect

Find your route: who you are, what is stalling, how urgent it is, the size of your operation, and your name, email, organization, country and any notes you add.

Talent Network: your name, email, location, languages, skills, seniority, availability, how you can work, how you would like to contribute, a short biography and an optional link.

Applications for support: your organization, your name and role, email, country, budget band, what you are asking for, what you deliver today and what breaks without the support.

Board vacancies: your organization, name, role, email, country, the seat you are filling, skills needed, time commitment, term and why now.

Contact and nominations: what you type into those forms.

That is the complete list. We do not ask for financial details, identity documents or anything about health.

2. What we do not do

No advertising cookies, no analytics, no tracking pixels, no third-party scripts, no fingerprinting, no data brokers, no profiling and no automated decisions that produce legal effects.

We do not sell, rent or trade your information. We do not publish the Talent Network. Organizations never see your contact details.

3. Cookies

The public site sets no cookies at all. There is no cookie banner because there is nothing to consent to.

The administration console, on its own separate address, sets one cookie called su_sid after a member of staff signs in. It holds a random session identifier, nothing else, and it expires after eight hours.

4. Location

The Directory has a Near me button. If you press it, your browser asks your permission and, if you agree, gives the page your approximate coordinates. Those coordinates are sent with that one search so we can sort results by distance.

We do not store your coordinates in our database and we do not keep a location history. If you never press the button, we never ask your browser for a location.

5. Video

Videos on the Work page are hosted by Vimeo. Nothing loads from Vimeo until you click play, so simply reading the page sends nothing to them. When you do play a video we request it with do-not-track enabled. Vimeo has its own privacy policy and we do not control it.

6. Why we are allowed to hold it

For anything you submit through a form, the basis is your consent, given when you send it, and our legitimate interest in answering you.

For Directory entries about organizations, the basis is legitimate interest in maintaining a public register of organizations, using information those organizations have already published. Directory entries describe organizations, not private individuals.

7. Where it is stored

The site and its database run on Cloudflare. The database is Cloudflare D1, hosted in the Eastern North America region. Everything travels over HTTPS.

If you are outside that region your information will be transferred there. Cloudflare is the only processor involved. We use no other third-party service to store or process form submissions.

8. Who can see it

Only people at Socially United who have an account on the administration console, which requires a password and a code from an authenticator app. Every sign in and every change is written to an activity log.

We will disclose information if the law requires it. We will not hand over the Talent Network to anyone else.

9. How long we keep it

Routing answers, messages and board vacancies: up to two years from your last contact with us.

Talent Network profiles: until you ask us to remove you, or three years after we last heard from you, whichever comes first.

Applications: up to six years, because funding decisions can need to be evidenced afterwards.

Ask us to delete something sooner and we will, unless we are legally required to keep it.

10. Your rights

You can ask what we hold about you, ask for it to be corrected, ask for it to be deleted, ask for a copy, object to us holding it, or withdraw consent at any time.

Email us and we will act within thirty days. We will not charge you and we will not ask why. If you are in the UK or the EU and you are unhappy with our answer, you can complain to your national data protection authority.

11. Security

Passwords are hashed, never stored as text. The console requires two-factor authentication and locks out after repeated failed attempts. Sessions expire after eight hours. Every administrative action is logged.

No system is perfect. If a breach ever affects your information, we will tell you and the relevant authority as the law requires.

12. Children

This service is meant for adults acting for themselves or for an organization. We do not knowingly collect information about anyone under sixteen. If you believe we have, tell us and we will delete it.

13. Changes

If this policy changes we will update the date at the top. If a change affects how we use information you have already given us, we will contact you before it takes effect.