Privacy policy

1Introduction

1.1 This privacy policy sets out how Arise International ("we", "us", "our") collects, uses, stores, shares and protects information about individuals ("personal data") in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection legislation.

1.2 Arise International is a Charitable Incorporated Organisation (CIO) registered in England and Wales, registered charity number 1209972, with its registered address at 29 Tinsley Road, London E1 3DA.

1.3 For the purposes of the UK GDPR, the data controller for the processing described in sections 2 and 3 is Arise International. Contact details are set out in section 14.

1.4 This privacy policy applies to our website at kindrelay.co and to the Kind Relay email sending service. By using our website or services, you acknowledge that you have read and understood this privacy policy.

2What data we collect

2.1 We have deliberately kept this short, because the website collects very little. We may collect and process the following categories of personal data about you:

2.2

Identity and contact data — your name, email address, organisation, and anything else you choose to tell us, when you contact us or ask about early access.

2.3

Correspondence data — the content of emails you send us and our replies.

2.4

Technical data — when you visit the website, our hosting provider processes your IP address, browser type and request details in server logs for security and abuse prevention. We do not use analytics, advertising or tracking software on this site.

2.5

Account and sending data — once you use the Kind Relay platform, the account details of the people who administer your organisation's account, and the operational records described in section 4.

2.6 We do not ask for or knowingly collect special category data (as defined in Article 9 of the UK GDPR) through this website. Contact fields on the Kind Relay platform must not be used to record special category data.

2.7 We do not collect payment card details through this website.

3How we collect your data, and how we use it

3.1 Direct interactions. You provide us with personal data when you email us, request early access, or register for an account. We use it to reply to you, to assess and set up an account, and to manage our relationship with you.

3.2 Automated technologies. Server logs are generated automatically when you visit the site. We use them to keep the service available and to investigate abuse.

3.3 Third parties. We do not buy personal data, and we do not receive personal data about you from data brokers, advertising networks or list vendors.

3.4 Legal bases. We rely on legitimate interests (Article 6(1)(f)) to respond to enquiries, to run and secure our website, and to administer the service; on contract (Article 6(1)(b)) to provide the platform to an organisation that has an agreement with us; on consent (Article 6(1)(a)) where we send you marketing about Kind Relay, which you may withdraw at any time; and on legal obligation (Article 6(1)(c)) where the law requires us to retain or disclose information.

4Contact data belonging to organisations using Kind Relay

4.1 Kind Relay is a platform that sends email on behalf of other organisations. When a charity or business uses Kind Relay to send to its own supporters or customers, that organisation is the data controller for its contact list, and Arise International acts as a processor on its instructions. If you are a recipient of an email sent through Kind Relay and want to know why you were contacted, or want your data removed, the organisation that sent the message is the right place to ask — though you may also contact us and we will help you reach them.

4.2 Consent is declared, not assumed. At every list import, the sending organisation must record its lawful basis under the UK GDPR and the Privacy and Electronic Communications Regulations (PECR), the source of the contacts, and approximately when they were collected. We record this and make it available for review. We do not permit purchased lists.

4.3 Unsubscribing always works. Every marketing message we send carries a one-click unsubscribe (RFC 8058) and an unsubscribe link in the body that the sending organisation cannot remove. Unsubscribes are honoured immediately and enforced when mail is sent.

4.4 Automated monitoring sees aggregates, not people. Kind Relay monitors delivery, bounce and complaint rates to protect recipients from unwanted mail. The automated system that makes those judgements has access to rates, counts and trends — not to contact records.

4.5 Suppression survives erasure. Where an address has unsubscribed or complained, we retain a one-way hash of it so it is not contacted again. This means a suppression record may outlive a deletion request; keeping it is what makes the deletion effective.

5Sharing your data

5.1 We share personal data only with:

5.2

Infrastructure providers who host the website and operate the sending infrastructure on our instructions — currently Cloudflare, Inc. (website hosting, DNS and email routing) and Amazon Web Services (email delivery, in its London region).

5.3

Professional advisers — auditors, lawyers and insurers, where they need the information to advise us.

5.4

Regulators and authorities — including the Charity Commission, HM Revenue & Customs and the Information Commissioner's Office, where we are required to report or disclose.

5.5 We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our service providers to use your personal data for their own purposes, and we do not sell personal data.

6International transfers

6.1 We keep personal data in the United Kingdom and the European Union. Email is delivered through Amazon SES in its London (eu-west-2) region, and our platform datastores are created under EU jurisdiction.

6.2 Some of our providers are companies incorporated in the United States, even where the data itself is stored in the UK or EU. Where a transfer outside the UK occurs, it is protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or by another safeguard permitted under Chapter V of the UK GDPR.

7Data retention

7.1 We keep personal data only as long as reasonably necessary for the purposes we collected it for, including to satisfy legal, regulatory, tax, accounting or reporting requirements.

7.2 Retention is tiered by the kind of data. Enquiry correspondence is kept while the enquiry is live and for a reasonable period afterwards; account records are kept for the life of the account and then for the period required by charity and tax law; server logs are kept for a short operational period; suppression records are kept indefinitely in hashed form, as explained in section 4.5.

7.3 Where we no longer need personal data we delete it or anonymise it so that it can no longer be associated with you.

8Your rights

8.1 Under the UK GDPR and the Data Protection Act 2018 you have the right of access (Article 15), to rectification (Article 16), to erasure (Article 17), to restrict processing (Article 18), to data portability (Article 20), to object to processing including direct marketing (Article 21), and not to be subject to solely automated decisions producing legal or similarly significant effects (Article 22). Where we rely on consent, you may withdraw it at any time without affecting processing carried out before you withdrew it.

8.2 To exercise any of these rights, contact us using the details in section 14. We will respond within one month. There is no fee unless a request is clearly unfounded, repetitive or excessive.

8.3 If your request concerns a contact list belonging to an organisation that uses Kind Relay, we will pass it to that organisation, as the controller, and support them in answering it.

9Cookies and local storage

9.1 This website does not use cookies. We do not run analytics, advertising or tracking software on it.

9.2 If you use the light/dark toggle, your choice is saved in your browser's local storage under the key kr-theme. It stays on your device, is never sent to us, and you can clear it through your browser settings.

9.3 This site loads its typefaces from Google Fonts. That means your browser makes a request to a Google server, which will see your IP address and browser details. If you would prefer this did not happen, a content blocker will prevent it and the site will still work.

9.4 The Kind Relay application, once you log in to it, will use strictly necessary cookies to keep you signed in. Those are required for the service to function and carry no tracking purpose.

10Children's privacy

10.1 Kind Relay is a tool for organisations and is not directed at children. We do not knowingly collect personal data from children through this website.

10.2 If we learn that we have collected personal data from a child without appropriate consent, we will delete it as quickly as possible. If you believe a child has provided us with personal data, please contact us using the details in section 14.

11Third-party links

11.1 Our website may link to third-party websites. Clicking those links may allow third parties to collect or share data about you. We do not control those sites and are not responsible for their privacy practices; we encourage you to read the privacy policy of any site you visit.

12Data security

12.1 We have put in place appropriate technical and organisational measures to prevent personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. These include encryption in transit, access controls limiting who can reach personal data, and separation of each customer organisation's data.

12.2 We have procedures for handling suspected personal data breaches, and will notify you and the Information Commissioner's Office where we are legally required to do so.

13Changes to this privacy policy

13.1 We may update this privacy policy by publishing a new version on this page. The date at the top shows when it was last changed.

13.2 Where a change materially affects how we use your personal data, we will tell account holders by email.

14How to contact us

14.1 If you have questions about this policy, or wish to exercise your rights, contact us:

15Supervisory authority

15.1 You have the right to complain at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection. We would appreciate the chance to address your concerns first, so please contact us before you approach the ICO.

15.2 Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Telephone 0303 123 1113. Website ico.org.uk.