1. Introduction
EduRise for Development (“EduRise”, “we”, “us”, or “our”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share personal data when you visit our website at https://edurisers.org or otherwise interact with us, and sets out your rights under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 (“DPA 2018”).
Please read this policy carefully. By using our website or submitting information to us, you acknowledge that you have read and understood this policy. If you have any questions, please Contact Us.
2. Who We Are
EduRise for Development is a UK-registered, independent, non-profit, non-governmental organisation incorporated in England and Wales under the Companies Act 2006. We are the data controller in respect of personal data processed under this policy.
Our Details
| Field | Details |
|---|---|
| Legal Name | EduRise for Development Ltd |
| Registered in | England and Wales |
| Date of Registration | 27 February 2026 |
| Type | Not-for-profit limited company |
| Website | https://edurisers.org |
| Contact | Via our Contact Us page |
We are not currently required to register with the Information Commissioner’s Office (“ICO”) as a data controller, but we process all personal data in full compliance with UK GDPR and the DPA 2018. We will register with the ICO as and when required by law.
3. Information We Collect
We collect personal data in the following circumstances:
3.1 Information You Provide Directly
When you interact with us through our website, you may provide personal data including:
- Contact enquiries: name, email address, subject, and message content submitted via our contact form.
- Volunteer applications: name, email address, professional background, skills, areas of interest, availability, and any other information you choose to include in your application.
- Partnership enquiries: name, organisation name, role, email address, and details of the proposed partnership.
- Programme applications: name, contact details, educational background, professional experience, motivation statement, and supporting documents where required.
- Newsletter subscriptions: email address and, where provided, your name and country of residence.
3.2 Information Collected Automatically
When you visit our website, we and our third-party service providers may automatically collect certain technical information, including:
- Your IP address (anonymised where possible)
- Browser type and version
- Operating system
- Referring URL
- Pages visited and time spent on each page
- Date and time of your visit
- Device type and screen resolution
- General geographic location (country or city level, derived from IP address)
This information is collected through cookies and similar tracking technologies. Please see our Cookie Policy for further details.
4. How We Use Your Information
We use the personal data we collect for the following purposes:
| Purpose | Lawful Basis |
|---|---|
| Responding to contact enquiries and general correspondence | Legitimate interests (Article 6(1)(f) UK GDPR) |
| Processing and assessing volunteer applications | Legitimate interests / Pre-contractual steps (Article 6(1)(b)) |
| Processing and assessing partnership enquiries | Legitimate interests (Article 6(1)(f)) |
| Processing and assessing programme applications | Legitimate interests / Pre-contractual steps (Article 6(1)(b)) |
| Sending newsletters and programme updates (where subscribed) | Consent (Article 6(1)(a) UK GDPR) |
| Improving our website and user experience | Legitimate interests (Article 6(1)(f)) |
| Complying with legal obligations | Legal obligation (Article 6(1)(c)) |
| Protecting the rights and interests of EduRise and third parties | Legitimate interests (Article 6(1)(f)) |
4.1 Legitimate Interests
Where we rely on legitimate interests as our lawful basis, we have carried out a balancing test and are satisfied that our interests are not overridden by your rights and freedoms. Our legitimate interests include operating and improving our website, communicating with individuals who contact us, and furthering our charitable and educational mission.
4.2 Consent
Where we rely on consent (for example, for newsletter subscriptions), you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. To withdraw consent, please Contact Us.
5. International Transfers of Personal Data
EduRise is a UK-based organisation that operates internationally. Some of the third-party service providers we use may process personal data outside the United Kingdom or the European Economic Area (“EEA”). Where personal data is transferred to a country that does not provide an equivalent level of data protection, we ensure that appropriate safeguards are in place, such as:
- Standard Contractual Clauses approved by the UK Information Commissioner's Office (UK SCCs or the International Data Transfer Agreement)
- Adequacy decisions made by the UK Secretary of State
- Other lawful transfer mechanisms as permitted under UK GDPR
If you would like further information about the safeguards we use, please Contact Us.
6. Data Retention
We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. Our general retention periods are as follows:
| Category of Data | Retention Period |
|---|---|
| Contact enquiries | 2 years from the date of last correspondence |
| Volunteer applications (unsuccessful) | 12 months from the date of decision |
| Volunteer applications (successful / active volunteers) | Duration of engagement plus 3 years |
| Partnership enquiries | 3 years from the date of last correspondence |
| Programme applications (unsuccessful) | 12 months from the date of decision |
| Programme applications (successful participants) | Duration of programme plus 5 years |
| Newsletter subscription data | Until unsubscribe or withdrawal of consent |
| Website analytics data | 26 months (Google Analytics default, anonymised) |
| Financial and legal records | 7 years as required by HMRC and company law |
At the end of the applicable retention period, personal data is securely deleted or anonymised.
7. Data Security
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, or alteration. These measures include:
- Encrypted data transmission using TLS/SSL protocols
- Access controls limiting data access to authorised personnel only
- Regular review of our data processing activities and security practices
- Use of reputable, security-certified third-party service providers
- Secure hosting infrastructure with regular security updates
Whilst we take all reasonable steps to protect your personal data, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security, but we will notify you and the ICO of any data breach where required by law.
8. Children’s Privacy
Our website is not directed at children under the age of 13, and we do not knowingly collect personal data from children under 13 without verifiable parental consent. If you believe we have inadvertently collected personal data from a child under 13, please Contact Us immediately and we will take steps to delete such data promptly.
For individuals aged 13 to 17, we encourage parental or guardian involvement when submitting any personal data through our website.
9. Third-Party Services and Data Processors
We use a number of trusted third-party service providers (“data processors”) to help us operate our website and deliver our services. These processors act only on our instructions and are bound by data processing agreements. Our current processors include:
| Service Provider | Purpose | Location |
|---|---|---|
| Supabase | Database and backend infrastructure for form submissions and application data | USA (with UK GDPR safeguards) |
| Brevo (formerly Sendinblue) | Email communications and newsletter delivery | EU/EEA (with UK adequacy) |
| Google Analytics | Website analytics and performance monitoring (anonymised) | USA (with UK GDPR safeguards) |
| Vercel / Hosting Provider | Website hosting and content delivery | Global CDN (with UK GDPR safeguards) |
We do not sell, rent, or trade your personal data to third parties for their own marketing purposes. We may share personal data with third parties where required by law, by court order, or where necessary to protect the rights and safety of EduRise, our staff, volunteers, or the public.
9.1 Google Analytics
We use Google Analytics to understand how visitors use our website. Google Analytics uses cookies to collect anonymised information about website usage. We have configured Google Analytics with IP anonymisation enabled. The data collected is used solely for analytical purposes and is not used to identify individual users. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.
10. Your Rights Under UK GDPR
Under UK GDPR and the DPA 2018, you have the following rights in relation to your personal data:
| Right | Description |
|---|---|
| Right of Access (Subject Access Request) | You have the right to request a copy of the personal data we hold about you, together with information about how we process it. |
| Right to Rectification | You have the right to request that we correct any inaccurate or incomplete personal data we hold about you. |
| Right to Erasure ('Right to be Forgotten') | You have the right to request that we delete your personal data in certain circumstances, for example where it is no longer necessary for the purpose for which it was collected. |
| Right to Restrict Processing | You have the right to request that we restrict the processing of your personal data in certain circumstances, for example while we verify the accuracy of data you have disputed. |
| Right to Object | You have the right to object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will cease processing immediately. |
| Right to Data Portability | Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format. |
| Right to Withdraw Consent | Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing. |
| Right to Lodge a Complaint | You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your personal data lawfully. |
To exercise any of these rights, please Contact Us. We will respond to your request within one calendar month. We may need to verify your identity before processing your request.
10.1 Complaints to the ICO
If you are not satisfied with our response to any data protection concern, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “last updated” date at the top of this document. We encourage you to review this policy periodically.
Continued use of our website following the posting of changes constitutes your acceptance of such changes. If you do not agree to the updated policy, please discontinue use of our website and Contact Us if you wish to have your data removed.
12. Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or our data processing activities, please Contact Us. We aim to respond to all enquiries within five working days.