Purpose and minimality
Each form should request only the information needed for its stated programme, event, resource or enquiry purpose. Optional marketing consent is separate from the information required to provide a requested service.
Collection notices
Forms identify why information is required and link to the applicable privacy information. Campaign-specific applications may provide additional notices where the information or recipients differ.
Special personal information
The platform does not request special personal information or information about children by default. A programme requiring such information must introduce an approved legal basis, additional safeguards and a specific collection notice before publishing its form.
Security safeguards
Personal information is validated on the server, stored in access-controlled systems and made available only to authorised staff. Uploaded application files use private storage and time-limited access.
Data-subject requests
Requests for access, correction, objection or deletion can be submitted through the Contact page. The Foundation may need to verify identity before disclosing or changing a record.
Security incidents
Suspected unauthorised access or disclosure should be reported through the Contact page as a privacy request so that it can be escalated and assessed.