What we collect
We collect a small amount of personal data, and only when you give it to us or visit our site. The categories of data we may hold about you are:
- Contact data. Name, email address, postal address and (optionally) phone number, when you donate, sign up for our newsletter, contact us, or apply for an Ecoflix Foundation programme such as Teachers or Careers.
- Donation data. The amount, frequency and project designation of any donation. Payment card details are processed by our payment partner Stripe and never touch our servers.
- Technical data. IP address, device type, browser, operating system, the pages you visit on ecoflix.com, the link or referrer that brought you here, and broad geographic location at the country or city level.
- Communication data. The contents of any email, contact-form message, or letter you send us, and our replies.
- Marketing data. Your preferences for receiving updates from us, and the channels you'd like to hear from us on.
We do not collect special-category personal data (such as health, political views, or biometric data). We do not collect government identification numbers. We do not buy personal data from data brokers.
How we use it
We use the data above for a small set of purposes, all tied to running the Foundation:
- To process donations and send you a receipt for tax purposes.
- To send the email updates you've asked for, and to tell you how the project you funded is going.
- To answer your questions when you contact us.
- To run programmes like Ecoflix for Teachers, where we need contact details for accredited schools.
- To improve the website by understanding which pages people read and which ones they don't.
- To comply with our legal duties as a registered charity in the United States and the United Kingdom.
We never sell, rent, or trade your personal data. We do not use your data for advertising profiles. We do not share donor lists with other organisations.
Legal bases for processing
Under the EU and UK General Data Protection Regulation, every use of your data must rest on a legal basis. Ours are:
- Contract. When you donate, we process your data to deliver the donation receipt and accounting record you'd expect.
- Consent. When you subscribe to the newsletter, opt in to project updates, or fill in the Teachers application, you give us your consent. You can withdraw it at any time.
- Legitimate interests. We have a legitimate interest in operating the Foundation efficiently — answering correspondence, improving the website, securing our systems, and preventing fraud. Where we rely on this basis, we have weighed it against your rights and concluded it does not override them.
- Legal obligation. Charity regulators in both jurisdictions require us to keep certain financial records, and we have to comply.
Cookies and analytics
Our site uses a small number of cookies. Some are strictly necessary for the site to work, others are optional and only set with your consent.
We use a privacy-respecting analytics provider that aggregates page views without persistent identifiers. We do not use Google Analytics, Facebook pixels, or third-party advertising trackers on this site.
For full detail, including every cookie name, purpose, provider and duration, see our cookies policy. You can change your cookie preferences at any time from that page.
Donation processing (Stripe)
All donations are processed by Stripe, Inc., a US-based payments company that is PCI DSS Level 1 certified — the highest tier of payment-card security. When you donate, the Stripe Payment Element runs inside our donation page, but your card number, expiry and CVC are transmitted directly from your browser to Stripe over a 256-bit TLS connection and never reach Ecoflix's servers.
Stripe shares the following back with us so that we can issue receipts and keep our books straight: your name, email address, the donation amount, the currency, the project you chose, the date, the payment method type (card, Apple Pay, Google Pay, Link or bank) and a transaction reference. If you opted to cover processing fees or to make the donation recurring, Stripe shares that too.
Stripe operates under its own privacy policy at stripe.com/privacy. By donating, you accept that policy as well as this one. Recurring donations are managed through a Stripe-hosted Customer Portal; a link is included with your first receipt.
Newsletter and email updates
Our newsletter is sent via Buttondown, a privacy-focused email provider. When you sign up, we share your email address and (if you give it) your first name with Buttondown so they can deliver the emails on our behalf.
Buttondown does not place tracking pixels in our emails by default. We can see how many people opened a campaign in aggregate, but not which individual recipient opened it.
Every email we send contains a one-click unsubscribe link. You can also email privacy@ecoflix.com to be removed.
Children's privacy
Ecoflix Foundation's website and newsletter are not directed at children under 13 (in the US) or under 16 (in the UK and EU). We do not knowingly collect personal data from children.
The exception is our Teachers programme, which is operated through accredited schools. Where data about pupils is involved, it is handled through the school's data-protection framework, not directly by us, and we only ever receive aggregate, de-identified usage data.
If you are a parent or guardian and you believe we hold data about your child, email privacy@ecoflix.com and we will delete it.
International transfers
Ecoflix Foundation operates legal entities in both the United States and the United Kingdom. Your data may be transferred between these entities and to the third-party processors named in this policy, who are predominantly based in the United States.
Where we transfer data out of the UK or EU, we rely on the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or the EU–US Data Privacy Framework, depending on the recipient. Copies of the relevant safeguards are available on request.
Your rights
Under the GDPR (UK and EU) and the California Consumer Privacy Act (CCPA), you have rights over the personal data we hold about you. They include:
- Right to access. Ask for a copy of the data we hold about you.
- Right to rectification. Ask us to correct anything that is wrong.
- Right to erasure. Ask us to delete data, where we don't have a legal obligation to keep it.
- Right to restrict processing. Ask us to pause our use of your data while a dispute is resolved.
- Right to data portability. Ask for your data in a machine-readable format you can take elsewhere.
- Right to object. Object to our processing of your data, including for direct marketing.
- Right to withdraw consent. Where we relied on your consent, you can withdraw it.
- Right to opt out of sale (CCPA). We don't sell personal data. There is nothing to opt out of, but we recognise the right.
- Right not to be discriminated against (CCPA). Exercising your privacy rights will never affect how we treat you as a donor or subscriber.
How to exercise your rights
To exercise any of the rights above, email privacy@ecoflix.com with the heading "Privacy request" and tell us, in plain English, what you want us to do.
We may ask for a small amount of additional information to confirm it is really you. We will respond within 30 days. The service is free.
In rare cases we may need to refuse a request — for example, because charity law requires us to retain a record of your donation for audit purposes. If we do, we will tell you why, and we will tell you how to complain to your data-protection regulator.
Data retention
We keep your personal data only for as long as we need it. As a rule of thumb:
- Donor records. Six years from the end of the financial year in which your last donation was made. This is the minimum retention period required by HMRC and the IRS for charity accounting and tax purposes.
- Newsletter subscribers. Until you unsubscribe, plus 30 days for the unsubscribe action to be logged.
- Contact-form messages. Two years from the date of last contact, then deleted unless they form part of an ongoing matter.
- Server logs. 30 days, then automatically purged.
- Application data (Teachers, Careers). Until the relevant cycle closes, plus 12 months, unless you ask us to delete it sooner.
Security
We take the security of your data seriously. Concretely, that means: all data in transit is encrypted with TLS 1.3; donor data at rest is encrypted with AES-256; access to systems is restricted to named staff with multi-factor authentication; we run quarterly access reviews and an annual penetration test; and any sub-processor we use must meet equivalent standards.
No system is perfectly secure. If we ever suffer a personal-data breach that is likely to result in a risk to your rights, we will notify you and the appropriate regulator within 72 hours.
Changes to this policy
We will update this policy from time to time. When we make a material change, we will update the "last updated" date at the top of the page and, where appropriate, email subscribers and donors to let them know.
If you continue to use the site after a change takes effect, you accept the new version. If you don't, you can exercise any of the rights described in section 9.
Contact
Ecoflix Foundation operates as two registered entities. The privacy contact is the same for both:
- Email: privacy@ecoflix.com
- US post: Ecoflix Foundation Inc., Attn: Privacy, 24730 Long Valley Road, Hidden Hills, Los Angeles, CA 91302, USA
- UK post: Ecoflix Foundation UK, Attn: Privacy, Aston House, Redburn Road, Newcastle Upon Tyne, NE5 1NB, UK
UK and EU residents have the right to complain to the Information Commissioner's Office (ico.org.uk). California residents can contact the California Attorney General's office.