Privacy Policy

We Are Everywhere Limited ("We Are Everywhere", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our website (www.we-are-everywhere.org) and the We Are Everywhere mobile application (together, the "Platform").

This policy is issued in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Please read it carefully. By using our Platform, you confirm that you have read and understood this policy.

We Are Everywhere Limited is the data controller responsible for your personal data.

Data Controller:

• Name: We Are Everywhere Limited
• Company Registration No: 16600406
• Website: www.we-are-everywhere.org
• Email: hello@we-are-everywhere.org

If you have any questions about this Privacy Policy, or wish to exercise your data protection rights, please contact us at hello@we-are-everywhere.org

We Are Everywhere Limited is not required to appoint a Data Protection Officer (DPO) under Article 37 UK GDPR at this time; however, all data protection queries are handled directly by our leadership team. Should this change, we will update this policy accordingly.

3.1 Individual App UsersWhen you use the We Are Everywhere app as an individual seeking support, we collect the following information:

• Postcode you put in the search box — to identify charities operating within the local area you chose
• Age group — whether you are searching for a minor (under 18) or an adult
• Category selections — up to two self-selected categories describing identity or circumstances (for example: neurodiversity and LGBTQ+, or other relevant groups)
• Support needs — the type of care or support you are looking for, aligned with the Care Act 2014 framework (for example: support with personal care, toileting, maintaining a clean home environment, or other areas of need)

We do not collect your name, email address, phone number, or any other directly identifying information as an individual user unless you choose to provide it when contacting us.

3.2 Registered Charities (Communicator Feature)If your charity registers to use the Communicator feature — our messaging and networking platform — we collect:

• Organisation name and registered charity number
• Name and contact details of the individual creating the account
• Email address and password for account login
• Messages and communications sent within the Communicator
• Geographic and service coverage information provided during registration
• Any other information voluntarily submitted that is required during registration to set up and account to use the Communicator

3.3 Technical and Usage DataWe may also automatically collect certain technical data when you use the Platform, including:

• Device type, operating system, and browser type
• IP address (anonymised where possible)
• App usage data, session length, and navigation patterns
• Crash reports and diagnostic data

We Are Everywhere collects and processes special category personal data as defined under Article 9 UK GDPR. This includes:

• Health and care needs (including support requirements relating to personal care, mobility, or daily living activities)
• Sexual orientation and gender identity (where a user selects the LGBTQ+ category)
• Neurodevelopmental or neurological conditions (where a user selects the neurodiversity category)

We process this data on the basis of your explicit consent (Article 9(2)(a) UK GDPR), which you give when you make your selections within the app. You may withdraw your consent at any time; however, this will mean we are unable to provide the core functionality of the app.

We treat all special category data with the highest level of care and sensitivity. Where possible, this data is processed in an anonymised or pseudonymised form. We do not use this data to build individual profiles beyond what is necessary to match you with relevant local charities.

Our Platform is designed to be accessible to both adults and minors. Where a user identifies as a minor (under 18), we apply additional safeguards:

• We collect only the minimum data necessary (postcode, age group, category)
• We do not collect the name, email, or contact details of minors
• Minors are not able to register for or use the Communicator feature

Results are filtered based on age group where charity registration data permits. We do not guarantee that all results will be exclusively age-appropriate, and users should verify the suitability of any charity before making contact. The accuracy of the results provided is dependent on information supplied by registered charities, which We Are Everywhere cannot independently verify. We do not accept liability for the content, services, or suitability of any charity listed on the Platform

If you are the parent or guardian of a child who has used the Platform and you have concerns about data collected, please contact us at hello@we-are-everywhere.org.

We Are Everywhere does not verify the age of users. Age group is based solely on self-declaration within the app. We apply age-based filtering as a design measure in accordance with the principles of the Age Appropriate Design Code (AADC), but we cannot guarantee the accuracy of self-reported age information.

We rely on the following lawful bases under the UK GDPR:

Consent (Article 6(1)(a) UK GDPR)We rely on your consent to process special category data (such as health, LGBTQ+, or neurodiversity information). You provide this consent when making your selections in the app. You may withdraw consent at any time by clearing the app data or contacting us.

Legitimate Interests (Article 6(1)(f) UK GDPR)We process technical and usage data on the basis of our legitimate interests in maintaining and improving the Platform, preventing fraud, and ensuring Platform security, where those interests are not overridden by your rights.
We may use aggregated and anonymised usage data — such as the volume of users by region, category, or need type — to demonstrate the reach and impact of the Platform to prospective partner organisations and charities. This data does not identify any individual user.

Contractual Necessity (Article 6(1)(b) UK GDPR)For registered charities using the Communicator feature, we process account and contact data to provide the service you have signed up for

Legal Obligation (Article 6(1)(c) UK GDPR)We may process data where required to comply with a legal obligation, such as responding to a valid request from a regulatory authority.

7.1 Individual Users We use users postcode, age group, categories, and care needs to:

• Match you with charities in the local area you chose, that are able to support you based on the age group, category, and specified needs you chose
• Generate a downloadable list of relevant charities for you
• Improve the accuracy and relevance of our matching algorithm

7.2 Registered CharitiesFor charities using the Communicator feature, we use account data to:

• Create and manage your charity account
• Enable messaging, collaboration, and networking between registered charities users
• Send service-related notifications (e.g. account updates or platform changes)

We do not sell your personal data. We may share data in the following limited circumstances:

Service ProvidersWe may share data with trusted third-party providers who assist us in operating the Platform (for example, cloud hosting, analytics, or security services). These providers act as data processors and are bound by contractual obligations to process data only on our instructions and in accordance with UK GDPR.

Legal RequirementsWe may disclose personal data if required to do so by law, court order, or in response to a valid request from a competent authority.

Business TransfersIf We Are Everywhere is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction. We will notify you via a prominent notice on the Platform before any such transfer takes place.

We Are Everywhere does not share individual user data with Charities listed in the app when they appear in your search; it is solely your decision if you choose to contact them and share any information about yourself. Please note the accuracy of the results provided by the search engine is dependent on information supplied by registered charities, which We Are Everywhere cannot independently verify. We do not accept liability for the content, services, or suitability of any charity listed on the Platform.

We retain personal data only for as long as necessary for the purposes for which it was collected:

• Individual user selections (postcode, age group, category, care need): We convert personal data into aggregated, anonymous statistics for business analysis and advertising purposes. Once anonymised, this data may be retained indefinitely.
• Charity account data (Communicator): Retained for the duration of your active account; once the account is deleted, all data is deleted. You can delete the account by pressing the “Delete Account" option. Once deleted, it is not possible to retrieve the information.
• Technical and usage data: Retained for up to 24 months in anonymised or pseudonymised form for platform improvement purposes.
• Communications sent via the Communicator: They are all automatically removed once you delete the account.

At the end of the applicable retention period, data is securely deleted or anonymised

You have the following rights in relation to your personal data:

• Right of Access — You may request a copy of the personal data we hold about you.
• Right to Rectification — You may ask us to correct inaccurate or incomplete data.
• Right to Erasure (“Right to be Forgotten”) — You may request that we delete your personal data, subject to certain legal exceptions.
• Right to Restrict Processing — You may ask us to pause the processing of your data in certain circumstances.
• Right to Data Portability — Where processing is based on consent or contract, you may request your data in a machine-readable format.
• Right to Object — You may object to processing based on legitimate interests.
• Right to Withdraw Consent — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Rights related to automated decision-making — Our matching algorithm does not make legally significant or similarly significant automated decisions about you. It functions as a filtering tool based on criteria you provide.

To exercise any of these rights, please contact us at hello@we-are-everywhere.org. We will respond within one calendar month of receipt of your request. We will not charge a fee for reasonable requests but reserve the right to charge a reasonable fee or refuse manifestly unfounded or excessive requests.

You also have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office (ICO):

• Website: www.ico.org.uk
• Telephone: 0303 123 1113

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include:

• Encryption of data in transit and at rest
• Access controls and authentication requirements

While we take reasonable precaution, no digital system is entirely immune from security risks. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay.

We are based in England and Wales and process data within the United Kingdom. Where we use third-party service providers who may transfer data outside the UK, we ensure that appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or adequacy decisions, in accordance with Chapter V UK GDPR.

Our website and app may use cookies and similar tracking technologies. We use:

• Strictly necessary cookies — required for the Platform to function
• Analytics cookies — used to understand how users interact with the Platform (only with your consent)

You can manage your cookie preferences through your browser settings or via the cookie consent tool on our website. For more information, please see our separate Cookie Policy at www.we-are-everywhere.org.

The Platform may contain links to external websites operated by third parties, including charities. We Are Everywhere is not responsible for the privacy practices of those organisations. We encourage you to read the privacy policy of any external site you visit. The inclusion of a link does not imply any endorsement by We Are Everywhere.

We may update this Privacy Policy from time to time to reflect changes in law, technology, or our practices. Your continued use of the Platform after any changes are posted constitutes your acceptance of the revised policy.

This Privacy Policy is governed by the laws of England and Wales. Any disputes arising in connection with this policy shall be subject to the exclusive jurisdiction of the courts of England and Wales.