Privacy Policy

1. Introduction

Striving for Inclusion CIC ("SFI", "we", "us", or "our") is committed to protecting your privacy and the privacy of the families we serve. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, services, and platforms.

As a Community Interest Company supporting families with children who have Special Educational Needs and Disabilities (SEND), we take extra care to protect sensitive information about vulnerable individuals.

By using our services, you consent to the data practices described in this policy.

2. Who We Are

3. Information We Collect

3.1 Personal Information You Provide

We collect information that you voluntarily provide when you:

• Register for workshops or events
• Apply to become a volunteer or ambassador
• Submit partnership inquiries
• Make donations through our platform
• Subscribe to our newsletter
• Contact us through forms or email

This information may include:

• Name and contact details (email, phone number, address)
• Demographic information (age, location, cultural background)
• Information about your child's SEND needs (only when voluntarily provided for support services)
• Educational background and professional experience (for volunteers/ambassadors)
• Payment information (processed securely through Stripe)

3.2 Automatically Collected Information

When you access our website, we may automatically collect:

• Browser type and version
• Device information
• IP address and geographic location
• Pages visited and time spent on site
• Referring website addresses

3.3 Sensitive Information

We recognize that information about children with SEND constitutes sensitive personal data under GDPR. We only collect such information when:

• You explicitly provide it to receive tailored support
• We have your explicit consent
• It is necessary for the provision of our support services

4. How We Use Your Information

We use the information we collect to:

• Provide consultation sessions and tailored support for SEND families
• Organize and manage workshops, events, and cultural programs
• Coordinate volunteer activities and ambassador programs
• Process donations securely
• Send newsletters and updates about our services (with your consent)
• Respond to your inquiries and provide customer support
• Improve our website and services
• Analyze usage patterns to better serve our community
• Manage partnerships and collaborative initiatives
• Comply with legal obligations and safeguarding requirements

5. Legal Basis for Processing (GDPR)

Under GDPR, we process your personal data based on:

• Consent: For newsletter subscriptions, optional data collection, and marketing communications
• Contractual Necessity: To provide services you've requested (workshops, consultations, events)
• Legitimate Interests: To improve our services, analyze website usage, and fulfill our organizational mission
• Legal Obligation: To comply with safeguarding duties, financial regulations, and other legal requirements

6. How We Share Your Information

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

6.1 Service Providers

We work with trusted third-party service providers who assist us in operating our platform:

• Vercel: Website hosting
• Stripe: Payment processing for donations
• PostgreSQL/Supabase: Database services with encryption and access controls
• Email Service Providers: Newsletter distribution

These providers only access information necessary to perform their functions and are contractually obligated to protect your data.

6.2 Legal Requirements

We may disclose your information if required to:

• Comply with legal obligations or court orders
• Protect the rights, property, or safety of SFI, our community members, or the public
• Fulfill safeguarding duties related to children and vulnerable adults

6.3 International Transfers

As we operate in both the UK and Senegal, your information may be transferred between these jurisdictions. We ensure appropriate safeguards are in place for such transfers in compliance with GDPR and UK data protection laws.

For services provided through our Senegal operations, data may be processed locally under appropriate data protection agreements.

7. Data Security

We implement comprehensive security measures to protect your personal information:

• Encryption: Data transmitted over HTTPS; database encryption at rest
• Access Controls: Row-Level Security policies limiting data access to authorized personnel only
• Secure Payment Processing: PCI-DSS compliant payment handling through Stripe (we never store credit card details)
• Regular Security Audits: Ongoing monitoring and updates to security protocols
• Limited Data Retention: We retain data only as long as necessary for stated purposes

While we strive to protect your information, no method of electronic storage is 100% secure. We cannot guarantee absolute security but continuously work to maintain the highest standards.

8. Your Rights Under GDPR and UK Data Protection Law

You have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you
• Right to Rectification: Correct inaccurate or incomplete information
• Right to Erasure: Request deletion of your data (subject to legal obligations)
• Right to Restrict Processing: Limit how we use your data in certain circumstances
• Right to Data Portability: Receive your data in a structured, commonly used format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for processing at any time (where consent is the legal basis)

To exercise these rights, please contact us through our website contact form or email. We will respond within 30 days of receiving your request.

9. Children's Privacy

Our services are designed to support families with children who have SEND. We take extra precautions to protect children's privacy:

• We do not knowingly collect personal information directly from children under 16
• Information about children is collected only from parents/guardians with explicit consent
• Blog posts and content featuring children are published only with parental permission
• We comply with all safeguarding requirements and will report concerns to appropriate authorities

10. Cookies and Tracking Technologies

Our website uses minimal cookies and tracking technologies:

• Essential Cookies: Required for website functionality (session management, security)
• Analytics: Aggregate usage statistics to improve our services (anonymized)

You can control cookies through your browser settings. Disabling essential cookies may affect website functionality.

11. Data Retention

We retain personal data only as long as necessary:

• Event/Workshop Registrations: Retained for 2 years after the event for follow-up and evaluation
• Consultation Records: Retained for 7 years in accordance with safeguarding best practices
• Newsletter Subscriptions: Retained until you unsubscribe
• Volunteer/Ambassador Applications: Retained for the duration of your involvement plus 1 year
• Donation Records: Retained for 7 years for financial compliance
• Blog Comments: Retained indefinitely unless deletion is requested

12. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

13. Updates to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of significant changes by:

• Posting a notice on our website
• Sending an email to newsletter subscribers (for material changes)

The "Last Updated" date at the top of this policy indicates when it was last revised.

14. Contact Us

If you have questions, concerns, or wish to exercise your data protection rights, please contact us:

We will respond to all privacy inquiries within 30 days.

15. Right to Lodge a Complaint

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the relevant supervisory authority:

However, we encourage you to contact us directly first so we can address your concerns.