Privacy Policy

The Four Legacy Foundation (the "Foundation", "we", "us" or "our") is a non-profit, non-partisan advocacy institution. This policy draft explains how personal information may be handled when you browse our website, contact us, donate, register for an event, volunteer, partner with us, or seek support. Personal information means information that identifies you or can reasonably be linked to you.

This policy concerns information handled by the Foundation. Websites, social platforms and payment services operated by others have their own privacy notices. Please review those notices before providing information.

Information you provide: your name, email address, telephone number, organisation, communication preferences, correspondence and information submitted through enquiries, registrations or applications. Volunteer and partnership applications may include experience, interests and availability.

Donation information: donation amount, date, currency, transaction reference, receipt details, billing information and donor preferences. The precise payment information received by the Foundation depends on the payment service used.

Technical information: depending on the website configuration, IP address, browser and device type, pages viewed, referral source, access times and cookie identifiers. Confirm which data fields and tools are actually used before publishing.

Information may come directly from you through website forms, email, telephone, in-person activities, donations or event registration. Technical information may be generated when you use the website.

Where relevant, service providers or authorised partners may supply transaction confirmations, registration records or referrals. The Foundation should confirm these sources and their authority to share information. If you submit information about another person, ensure you are authorised to do so and tell them about this notice.

Depending on your interaction with the Foundation, information may be used to:

• Respond to questions, requests for support and other correspondence.
• Administer donations, provide acknowledgements and maintain financial records.
• Organise events, volunteer activities, partnerships and programme participation.
• Send updates or fundraising communications in line with applicable choices.
• Maintain website functionality, understand engagement and address misuse.
• Meet applicable record-keeping duties and respond to lawful requests.

Before publication, confirm each purpose and identify the relevant legal basis under applicable law. Where consent is relied upon, explain how it is obtained and how it can be withdrawn.

Donations may be processed by an external payment provider. That provider may collect payment credentials and transaction information under its own privacy notice. Do not send card numbers, bank passwords or account security codes through an enquiry form or ordinary email.

The Foundation may receive transaction status, donation amount, reference and contact information needed for acknowledgements and donor administration. Confirm the provider, what payment details the Foundation can access, whether recurring donations are offered, and how payment records are retained. A donor's name, story or donation should not be published without an appropriate permission process.

Cookies and similar technologies can store information on your device or recognise a browser. Essential technologies may support site functions and security. Optional analytics may help explain how visitors use the website. Embedded content may also involve third-party technologies.

The final notice should list the technologies actually used, their providers, purposes and expiry periods, and explain the available consent controls. Do not assume optional analytics are enabled or that a consent banner exists. Where consent is required, optional technologies should follow the visitor's choice.

You can manage cookies through your browser settings. Blocking some technologies may affect site functions. Browser settings do not necessarily remove information already collected by third parties.

Information may need to be shared with service providers supporting website hosting, communications, events, donations or administration. Confirm the actual recipients and limit access to what is necessary for their agreed tasks. Appropriate confidentiality, security and data-handling arrangements should be documented.

Programme partners may receive information where needed for an agreed activity and where an appropriate basis exists. Disclosures may also be necessary in response to valid legal obligations, to protect people from serious harm, or to address fraud and abuse, subject to applicable law.

Confirm and expressly state the Foundation's position on selling information, advertising-related sharing and donor-list exchanges before publication; no such practice is assumed in this draft.

Requests for help or reports of injustice may include health information, allegations, information about children, or details of vulnerable people. Avoid including unnecessary sensitive information in public submissions or ordinary email. Please do not send identity documents unless an authorised process specifically requests them.

Before using this notice, confirm the secure reporting route, who can access case information, the basis for handling sensitive data, and any circumstances requiring safeguarding disclosures. Permission to share a story, photograph or testimony should be addressed separately from permission to provide support.

Retention should depend on the purpose of collection, the nature of the information and applicable requirements. Donation records may need to be retained for accounting obligations; event records, volunteer applications and support correspondence may have different retention periods.

Confirm a retention schedule for each category, including backups and records held by providers. Information no longer needed should be securely deleted or anonymised, subject to legitimate legal holds. No specific retention period is asserted in this draft.

Security arrangements should be proportionate to the sensitivity of the information. Relevant measures may include restricted access, secure systems, staff guidance and appropriate supplier controls. Confirm the measures actually implemented before making specific security claims.

No online transmission or storage method is completely risk-free. The final policy should identify how to report a suspected security incident and explain any notification duties under applicable law without promising absolute security.

Depending on applicable law and the circumstances, you may have rights to request access to your information, correct inaccuracies, request deletion, restrict or object to certain uses, or obtain a portable copy. Where processing relies on consent, you may be able to withdraw it without affecting earlier lawful processing. These rights are not absolute.

To make a request, use the privacy contact specified below and explain the information or action concerned. Proportionate identity checks may be needed; avoid sending excessive identification. Confirm the relevant response deadlines and complaint authority before publication.

Where marketing messages include an unsubscribe option, you can use it to change your preferences. Essential messages about a donation, request or activity may still be needed. Confirm the available preference-management process.

Information about children requires particular care. Before publication, confirm whether children can use forms or participate directly, any relevant age thresholds, and when parental or guardian authorisation is required. No universal age limit is assumed.

If you believe a child's information has been provided inappropriately, contact the Foundation through the verified privacy channel. The Foundation should assess the report and take appropriate steps under its safeguarding procedures and applicable law.

Hosting, communications or payment providers may handle information in countries other than where you live. Whether this happens depends on the services selected by the Foundation.

Confirm the locations involved and any legal safeguards required for international transfers. The final notice should describe the relevant protections and how people can obtain further information. This draft does not assert that any particular transfer mechanism is in place.

The Foundation may update its published notice when its activities, systems or legal requirements change. The final page should show an effective date and last-updated date. Material changes should be communicated in an appropriate way, with renewed consent where required.