Privacy Notice

1. Who we are

Common Good Digital builds and hosts websites for UK charities. We are the data controller for personal data you share with us through this website, our forms, and our day-to-day correspondence. You can reach us at hello@commongooddigital.co.uk.

2. What this notice covers

This notice explains what personal data we collect when you visit commongooddigital.co.uk or contact us, why we collect it, how long we keep it, who we share it with, and your rights under UK GDPR and the Data Protection Act 2018. A separate notice applies to the websites we build and host for our charity clients — in those cases the charity is the controller and we act as their processor.

3. What we collect and why

Callback request form

When you request a callback we collect your name, email address, charity name, website URL, mobile number, and preferred time of day. We use this information to get in touch about your enquiry. The lawful basis is your consent (UK GDPR Art. 6(1)(a)), which you give by submitting the form.

Email correspondence

If you email us we will hold a copy of that correspondence and any reply. The lawful basis is our legitimate interest (Art. 6(1)(f)) in responding to people who contact us about our services.

Server logs and basic analytics

Our hosting provider records standard technical information about visits — IP address, browser, referring page, and timestamp — to keep the site secure and to understand which pages are useful. The lawful basis is legitimate interest. We do not use third-party advertising or cross-site tracking cookies.

Cookies

This site uses only strictly necessary cookies required for the site to function. We do not set marketing or analytics cookies that require consent.

4. Who we share data with

We only share personal data with the suppliers we need to run the service:

• Supabase (database and storage) — hosted in the EU. Used to store callback requests.
• Cloudflare — used to serve and protect this website.
• Email providers — used to send and receive correspondence.

We do not sell personal data and we do not share it with third parties for their own marketing purposes.

5. International transfers

Some of our suppliers may process data outside the UK. Where they do, we rely on the UK's adequacy regulations or on Standard Contractual Clauses with the UK Addendum to ensure your data is protected to a comparable standard.

6. How long we keep it

Callback requests and related correspondence are kept for up to 24 months after the last contact, then deleted. Records that we need for tax or legal reasons (e.g. invoices) are kept for 6 years.

7. Your rights

You have the right to:

• access the personal data we hold about you;
• ask us to correct or delete it;
• restrict or object to how we use it;
• request a copy in a portable format;
• withdraw consent at any time (where consent is the basis).

To exercise any of these rights, email hello@commongooddigital.co.uk. If you are not happy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk.

8. Security

We use HTTPS across the site, encrypted storage at our suppliers, access controls on our admin tools, and least-privilege accounts. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

9. Changes to this notice

We may update this notice from time to time. The "last updated" date at the top of the page will always reflect the most recent change.