Care & accountability
Privacy Policy
This policy describes privacy principles for the Roots Humanity Foundation website and for any future information-handling arrangements that are approved and configured.
Purpose and scope
Personal information should be handled fairly, transparently, and only for a clear organisational purpose. These principles cover the public website and any future enquiry, volunteer, partnership, or donation journeys that are authorised. Separate programme, beneficiary, employment, or partner records require their own approved arrangements.
Information currently expected
The current website does not provide operational forms or payment processing, and no website-owned analytics cookies are intended. Website infrastructure may create routine technical logs such as request, security, or error records. Until approved forms, destinations, and providers exist, the site should not invite visitors to submit personal, safeguarding, beneficiary, payment-card, or other sensitive information through generic channels.
Collection and use principles
When a collection channel is approved, it should request the minimum information needed, explain the purpose before submission, provide a clear lawful basis or consent choice where required, and prevent optional fields from becoming mandatory by default. Information should be used only for the stated purpose, with access limited by role and with reasonable measures to protect it from loss, misuse, or unauthorised disclosure.
Forms, donations, and third parties
A form should not display a success message until an approved private destination has durably received the submission. A donation flow should not be treated as available until a provider, data flow, payment confirmation process, and donor notice are approved and configured. Any hosting, form-delivery, payment, analytics, security, or other provider that receives information must be identified in the final notice with its relevant role and disclosures.
Cookies, logs, and individual choices
The implementation should avoid non-essential tracking by default and should document any future cookies, local storage, pixels, or similar technologies before release. Technical logging should be access-controlled, minimised, and reviewed for accidental personal or sensitive data. A privacy notice should explain available rights, how a person can raise a privacy question, and how identity or authority will be checked where needed, without publishing an unapproved contact route.
Changes and accountability
An accountable owner should be assigned for privacy decisions, and this notice should be reviewed whenever a new form, provider, cookie, payment method, or data use is introduced. An internal record of approved processing should be maintained, and public changes should be explained in plain language. The site must not imply that a policy has been adopted or that a right can be fulfilled through an unconfigured channel.