Privacy Policy

Last updated: November 2025

Buzzspark for Change CIC ("we", "us", "our") is committed to protecting the privacy and personal data of everyone we work with. This policy explains what personal data we collect, how we use it, who we share it with, and the rights you have.

This policy applies to:

Visitors to our website.
People who contact us by email, phone or through online forms.
People who take part in our projects.
People who work with us.

1. Who we are and how to contact us

Buzzspark for Change CIC is a Community Interest Company registered in England and Wales, company number 16863054.

For any questions about this policy or how we use personal data, you can contact us at:

Email: dpo@buzzsparkforchange.org
Postal address: Unit 3D Westpoint, 36-37 Warple Way, London W3 0RG

Buzzspark for Change CIC is the data controller for the personal data described in this policy.

We also work with Buzzspark Limited and other organisations as service providers or delivery partners. In most cases, these organisations act as our data processors and only process personal data on our instructions.

2. What this policy covers

This policy explains:

What personal data we collect.
How and why we use personal data.
The lawful bases we rely on under UK data protection law.
Who we share personal data with.
How long we keep personal data.
Your rights and how to exercise them.

It does not cover the privacy practices of other organisations we link to or work alongside. Those organisations are responsible for their own privacy information.

3. The personal data we collect

The personal data we collect depends on how you interact with us. It may include:

3.1 Website visitors

When you visit our website, we may collect:

Basic technical information such as your IP address, browser type and device type.
Information about how you use the site (pages visited, links clicked, time on page), if we use analytics tools.
Information you provide through contact forms or email links (for example, your name, email address and any message you send).

3.2 People who contact us

If you contact us by email, phone or via an online form (for example, to ask about a project or funding), we may collect:

Your name and contact details (such as email address and phone number).
The organisation you represent (if any).
The content of your message and our responses.

3.3 Project participants

If you take part in one of our projects, we may collect:

Your name and contact details (such as email address and, if relevant, phone number or postcode/town).
Basic eligibility information (such as your address).
Information about the activities you take part in.
Optional feedback or survey responses about your experience with the project.

We generally do not need to collect sensitive or "special category" data (such as health information, ethnicity, or religious beliefs). If there is a clear reason to do so (for example, to understand accessibility needs or monitor equality of opportunity), we will explain this, keep it optional where possible, and treat it with additional care.

3.4 Partner contacts

If you work with us as a partner or are exploring a partnership, we may collect:

Your name and role.
Contact details for you and your organisation.
Information about your organisation and how it is involved in a project.
Records of meetings, emails and other communications.

3.5 Volunteers, students and placements

If you volunteer with us, or join us through a student or placement programme, we may collect:

Your name and contact details.
CV or application information.
Reference details (where provided).
Any agreed learning objectives.
Basic monitoring information where required by a college/university or project stakeholders.

If we need to collect additional information for safeguarding or legal reasons, we will explain what is needed and why at the time.

4. How we use personal data and our lawful bases

We only use personal data where we have a lawful basis under UK data protection law. The main lawful bases we rely on are legitimate interests, consent, and, where we have a clear agreement with you, contract.

4.1 To run our website and respond to enquiries

We use personal data to:

Operate and improve our website.
Respond to enquiries from residents, partners, funders or other interested people.

Lawful basis: Our legitimate interests in running an effective website and responding to people who contact us. Where you ask us to do something before entering into an agreement (for example, asking for project information), we may also rely on contract.

4.2 To develop and deliver projects

We use personal data to:

Design, plan and deliver community‑led projects, including any early‑stage pilots and schemes.
Keep records of who is involved in activities and how projects are used.
Communicate with participants, partners and stakeholders about project activities.

Lawful basis: Our legitimate interests in developing and delivering community projects, and, where you have signed up to take part or work with us, contract.

4.3 To send updates, invitations and opportunities

If you ask to receive updates from us, or if you are closely involved in a project, we may use your contact details to:

Send you project updates, opportunities to get involved, or invitations to relevant events.

Lawful basis:

Your consent where you actively sign up to receive updates; or
Our legitimate interests in keeping key partners and active participants informed about closely related projects. You can opt out of these communications at any time.

4.4 To evaluate and report on our work

For many projects, especially where there is external funding, we need to:

Monitor how projects are used and who is taking part.
Evaluate what is working and where improvements are needed.
Report headline figures and outcomes to funders and stakeholders.

Where possible, we use aggregated or anonymised data for evaluation and reporting (for example, total numbers of participants in a town, types of activity).

Lawful basis: Our legitimate interests in understanding and improving our work, and fulfilling our obligations to funders and commissioners.

4.5 To meet legal and regulatory obligations

We may need to use personal data to:

Keep appropriate records for accounting and audit purposes.
Respond to complaints or legal claims.
Comply with safeguarding, health and safety or other legal obligations.

Lawful basis: Compliance with our legal obligations and our legitimate interests in operating responsibly and fairly.

5. Special category data

We aim to avoid collecting special category data (such as health information or ethnicity) unless it is genuinely necessary. If we do collect it, this will normally be because:

You choose to share information about your accessibility needs so that we or a partner organisation can make reasonable adjustments; and/or
We are running an optional survey or monitoring exercise to understand who we are reaching and whether our projects are inclusive.

In these cases, we will explain why we are collecting the information, keep it optional wherever possible, and use it in aggregated or anonymised form whenever we can.

If we rely on your consent to use this kind of information, you can withdraw that consent at any time by contacting us (see Section 1).

6. Who we share personal data with

We only share personal data where it is necessary and appropriate, and we always aim to share the minimum needed.

We may share personal data with:

6.1 Buzzspark Limited

Buzzspark Limited is a separate company that provides delivery and technology support for some of our projects.

Where Buzzspark Limited processes personal data on our behalf, it does so as our data processor, under a written agreement that sets out:

What personal data it can process.
How it must protect that data.
That it must only act on our instructions.

6.2 Community and business partners

For certain projects, we may share limited personal data with community groups and businesses that are formally involved in delivering the project. In many cases, we will also receive data from these partners, so we can understand how the project is being used.

Each partner is responsible for providing its own privacy information for any personal data it collects in its own right.

6.3 Funders, commissioners and evaluators

We may share aggregate or anonymised information with funders and commissioners about how a project is performing. This may include, for example, the number of participants, types of activities and high‑level outcomes.

Where a funder or independent evaluator needs access to more detailed data, we will:

Limit what is shared to what is necessary.
Put appropriate agreements in place.
Use anonymised or pseudonymised data where possible.

6.4 Service providers

We may use third‑party service providers to help us run our website, email, surveys and digital tools (for example, web hosting, email newsletter tools, or online survey platforms). These providers may process personal data as our data processors and are required to keep it secure and confidential.

6.5 Legal and other disclosures

In rare cases, we may need to share personal data where we believe it is necessary to:

Protect someone’s vital interests (for example, in a safeguarding or safety context), or
Comply with a legal obligation, court order or request from a regulator or law enforcement body.

7. International transfers

Most of our core systems and providers are based in the UK or European Economic Area (EEA). If we use a service that stores or processes data in another country, we will ensure that appropriate safeguards are in place (for example, standard contractual clauses or equivalent protections), in line with UK data protection law.

8. How long we keep personal data

We keep personal data only for as long as is reasonably necessary for the purposes set out in this policy, including to meet any legal, accounting or reporting requirements.

As a guide:

General enquiries: We usually keep enquiry emails and form submissions for up to 12 months after the end of the conversation.
Project participation records: We may keep records related to funded projects for the duration of the project and then for up to 7 years afterwards, to meet funder and audit requirements.
Partner contact details: We may keep details of partner contacts for as long as we are working together and for a reasonable period afterwards (for example, 3 years) in case we need to follow up or demonstrate project history.
Evaluation data: We may retain aggregated or anonymised data for longer, as it no longer identifies individuals.

If you would like more detail on how long we keep particular types of data, you can contact us using the details in Section 1.

9. How we protect personal data

We take appropriate technical and organisational measures to protect personal data, including:

Using secure systems and tools with access controls.
Limiting access to personal data to staff, volunteers and suppliers who need it to do their work.
Training relevant people on data protection and confidentiality.
Regularly reviewing our security arrangements.

No system can be completely secure, but we aim to reduce risks to an appropriate level given the nature of the data and our size as a small community organisation.

10. Your rights

Under UK data protection law, you have a number of rights in relation to your personal data. These include the right to:

Access the personal data we hold about you.
Correct inaccurate or incomplete data.
Erase your data in certain circumstances (the "right to be forgotten").
Restrict how we use your data in certain circumstances.
Object to our use of your data where we are relying on legitimate interests.
Withdraw consent where we are relying on your consent to process data.
Data portability – in some cases, ask us to transfer your data to another provider.

These rights are not absolute and may be subject to some exceptions (for example, where we need to keep data for legal reasons).

If you wish to exercise any of these rights, please contact us using the details in Section 1. We may need to ask for proof of identity before we can respond.

10.1 Complaints

If you are unhappy with how we have used your personal data, we would encourage you to contact us first so we can try to resolve the issue.

You also have the right to raise a concern or make a complaint about how your data is used. To understand your rights and how to make a complaint, including to the Information Commissioner’s Office (ICO), the UK data protection regulator, please see the guidance on the ICO website.

11. Children and young people

Some of our projects may involve children and young people, often through schools, colleges, youth organisations or other community partners.

Our website and general communications are aimed primarily at adults (for example, community group leaders, business owners, funders and local decision‑makers). Where we need to collect or use personal data about children or young people directly, we will:

Work with appropriate partner organisations (such as schools or youth groups) wherever possible.
Put in place additional safeguards, including parental or guardian consent where required.
Use the minimum amount of personal data necessary and keep it for no longer than needed.

12. Cookies and similar technologies

Our website may use cookies and similar technologies to:

Make the site work properly (for example, remembering your preferences).
Understand how the site is used so we can improve it (for example, basic analytics).

Where required by law, we will ask for your consent before setting non‑essential cookies. You can control cookies through your browser settings and, where available, through our cookie banner or settings.

13. Changes to this policy

We may update this privacy policy from time to time, for example if our projects change or if there are updates in the law or guidance.

We will always include the date of the latest version at the top of this page. If we make significant changes, we may also highlight them on our website or contact you directly if appropriate.