1. Introduction

Anvil Social Enterprises (“Anvil”, “we”, “our”, or “us”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and the rights available to you. It applies to our website, digital platforms, applications, newsletters, social media channels, and any other services we provide electronically (collectively, the “Services”), and should be read alongside our Terms and Conditions.

This Policy applies to personal data we collect directly from you, personal data collected automatically through your use of the Services, and personal data we receive about you from third parties, as described below.

2. Who Is Responsible for Your Data

Anvil Social Enterprises is the data controller responsible for your personal data in connection with the Services, unless stated otherwise for a specific Service provided by a subsidiary, Affiliate, or partner organization, in which case that entity will be identified as the controller at the point the Service is offered.

Controller: Anvil Social Enterprises

Registered Address: [Insert Registered Business Address]

Contact Email: [Insert Privacy Email Address]

Data Protection Officer: [Insert Name/Contact, or state ‘Not applicable’ if none appointed]

3. Personal Data We Collect

We collect the following categories of personal data, depending on how you interact with the Services:

Identity and contact data: name, email address, postal address, telephone number, and similar identifiers.
Account data: username, password (stored in hashed form), account preferences, and registration details.
Application and submission data: information you provide in enquiries, applications, proposals, grant or partnership submissions, and event registrations.
Donation and payment data: donation amount and history, and limited payment metadata; full card or bank details are collected and processed directly by our third-party payment providers and are not stored by us.
Communications data: correspondence you send us, feedback, comments, and social media interactions with our official channels.
Technical and usage data: IP address, browser type and version, device identifiers, operating system, referral source, pages viewed, and time spent on the Services, collected via cookies and similar technologies (see Section 7).
Marketing preferences: your choices about receiving newsletters or promotional communications from us.

We do not intentionally collect special category data (such as health, religious belief, or racial or ethnic origin data) unless you voluntarily provide it to us as part of an application or submission, and it is necessary for the purpose you provided it, in which case we will handle it in accordance with applicable law.

4. How We Collect Your Data

We collect personal data:

directly from you, when you register an account, submit an enquiry or application, register for an event, make a donation, subscribe to a newsletter, or otherwise interact with the Services;
automatically, through cookies and similar technologies when you use our website (see Section 7); and
from third parties, such as payment processors, partner organizations, publicly available sources, or social media platforms, where you have interacted with our content there.

5. Legal Bases for Processing

Where applicable law requires a legal basis for processing (such as under the UK/EU GDPR), we rely on one or more of the following:

Consent — for example, where you opt in to receive marketing communications or where cookies require consent.
Performance of a contract — to provide the Services you request, manage your account, or process a donation or event registration.
Legitimate interests — to operate, secure, and improve the Services, understand how they are used, and communicate with you about matters related to our mission, provided these interests are not overridden by your rights.
Legal obligation — to comply with applicable law, including financial record-keeping for donations.

You may withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

6. How We Use Your Data

We use personal data to:

create and administer your account;
process enquiries, applications, event registrations, and donations;
communicate with you, including responding to requests and sending service-related notices;
send newsletters or marketing communications where you have opted in (or as otherwise permitted by law), and to let you unsubscribe at any time;
operate, maintain, secure, and improve the Services;
analyze usage trends and measure the effectiveness of our content and initiatives;
detect, investigate, and prevent fraud, abuse, or violations of our Terms and Conditions; and
comply with legal, regulatory, and reporting obligations.

We do not sell your personal data. We do not use your data to make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects concerning you.

7. Cookies and Similar Technologies

Our website uses cookies and similar technologies for essential functionality, security, analytics, remembering your preferences, and performance improvement. Where required by law, we will ask for your consent before setting non-essential cookies, and you can manage or withdraw your preferences at any time through our cookie settings tool or your browser settings. Disabling certain cookies may affect the functionality of the Services. Further detail on the specific cookies we use, their purpose, and their duration is available in our [Insert Cookie Policy / Cookie Table Link].

8. How We Share Your Data

We may share personal data with:

service providers who process data on our behalf, such as hosting providers, email and newsletter platforms, payment processors, and analytics providers, under contractual obligations to protect your data;
subsidiaries, Affiliates, and the social enterprises we support, where necessary to deliver a Service you have requested or to operate our organization;
professional advisers, such as auditors, lawyers, and insurers, where necessary for their services;
regulators, law enforcement, or other third parties where required by law, or to protect our rights, property, users, or the public; and
a successor entity in connection with a merger, acquisition, reorganization, or sale of some or all of our assets, subject to appropriate safeguards.

We require any third party we share data with to respect the security of your personal data and to treat it in accordance with the law. We do not permit third-party service providers to use your personal data for their own independent marketing purposes.

9. International Data Transfers

Your personal data may be transferred to, and processed in, countries other than the one in which you are located, including countries that may not have data protection laws equivalent to those in your home jurisdiction. Where we transfer personal data internationally, we put in place appropriate safeguards, such as standard contractual clauses approved by the relevant authorities, an adequacy decision, or another lawful transfer mechanism.

10. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Retention periods vary by data type; for example, donation records may be retained for the period required by applicable tax and financial regulations, while account data is generally retained for as long as your account remains active plus a reasonable period thereafter. When personal data is no longer needed, we securely delete or anonymize it.

11. Your Rights

Depending on your location, you may have the right to:

access the personal data we hold about you;
request correction of inaccurate or incomplete data;
request erasure of your personal data in certain circumstances;
request that we restrict processing of your data in certain circumstances;
object to processing based on legitimate interests or for direct marketing purposes;
request a portable copy of data you provided to us, in a structured, commonly used, machine-readable format;
withdraw consent at any time, where processing is based on consent; and
lodge a complaint with a data protection supervisory authority in your country of residence.

To exercise any of these rights, contact us using the details in Section 15. We may need to verify your identity before responding and may decline requests that are manifestly unfounded, excessive, or as otherwise permitted by law. We will respond within the timeframe required by applicable law.

12. Children’s Privacy

The Services are not directed at, and are not intended for use by, individuals under the age of 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us using the details in Section 15 and we will take reasonable steps to delete that information.

13. Data Security

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. In the event of a data breach affecting your personal data, we will notify you and relevant authorities where required by applicable law.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or regulatory reasons. Where changes are material, we will provide notice by posting an updated version on our website with a revised “Last Updated” date, and, where practicable, by additional notice at least 14 days before the changes take effect. We encourage you to review this Policy periodically.

15. Contact Us

If you have questions about this Privacy Policy, wish to exercise your rights, or want to raise a concern, please contact us at:

Anvil Social Enterprises

Email: admin@anvilsocialenterprises.com

Website: www.anvilsocialenterprises.com

Registered Address: 71-75, Shelton Street, Covent Garden, London, WC2H 9JQ

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority (for example, the Information Commissioner’s Office in the UK, at ico.org.uk).