Privacy Policy

Last updated: 8 April 2026 · Ground Roots Community Interest Company (Company No. 15962442)

1. Who we are

Ground Roots Community Interest Company (“we”, “us”, “our”) is a community interest company registered in England and Wales. Our registered office is Unit 21, 384 Abbott Road, London, E14 0UX. For data protection questions, contact us at [email protected].

2. What this policy covers

This policy explains how we process personal information when you visit our website, contact us, take part in our programmes, or interact with us online. We process data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

3. Information we may collect

  • Contact details you send via our contact form or email (for example name, email address, phone number if you provide it, and the content of your message).
  • Technical data such as browser type, device type, and approximate location derived from IP address, collected through standard server logs or essential cookies where used.
  • Programme-related information where you engage with our activities and we need it to run sessions safely and fairly (for example emergency contacts or safeguarding notes, collected through separate processes and notices where applicable).

4. How we use your information

We use personal data to:

  • Respond to enquiries and manage volunteering or partnership requests;
  • Operate and improve our website and communications;
  • Meet legal, regulatory, and safeguarding obligations;
  • Protect the security and integrity of our services.

We do not sell your personal data. We only use it for the purposes described here or as explained at the point of collection.

5. Lawful bases

Depending on the activity, we rely on lawful bases such as: your consent (where we ask for it); contract (where we are preparing or performing an agreement with you); legitimate interests (for example improving our website and responding to general enquiries, balanced against your rights); and legal obligation (where the law requires us to process data).

6. Sharing information

We may share data with trusted service providers who help us run our website or email (for example form delivery or hosting), subject to appropriate agreements. We may disclose information if required by law, regulation, or safeguarding duties.

7. International transfers

Where any provider processes data outside the UK, we ensure appropriate safeguards (such as UK adequacy regulations or standard contractual clauses) are in place where required.

8. Retention

We keep personal data only as long as needed for the purposes above, including any legal, accounting, or safeguarding retention periods, then delete or anonymise it securely.

9. Your rights

Under UK data protection law you may have the right to:

  • Access, correct, or erase your personal data;
  • Restrict or object to certain processing;
  • Data portability where applicable;
  • Withdraw consent where processing is consent-based;
  • Lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

To exercise your rights, contact [email protected].

10. Children

Our programmes involve young people. Where we collect data relating to children, we do so with appropriate safeguards and, where required, parental consent or lawful authority. If you believe we have collected a child’s data improperly, please contact us.

11. Changes

We may update this policy from time to time. The “Last updated” date will change when we do. Continued use of the site after changes means you accept the revised policy.