Privacy notice

Who we are

CivicLoop is a UK-based volunteer-matching platform. This notice explains what personal data we collect, why, and the rights you have under UK GDPR and the Data Protection Act 2018.

What we collect and why

• Account details (name, email, profile photo) — to run your account and connect you with organisations. Lawful basis: contract.
• Location (town/city or postcode you choose to pin) — to match you with nearby opportunities and, only if you enable it, send local alerts. Lawful basis: consent. Your precise coordinates are never shown publicly.
• Values, skills and bio — to personalise matches. Lawful basis: contract.
• Volunteering activity (applications, approved hours, badges) — to keep your record and issue certificates. Lawful basis: contract / legitimate interest.
• Content you post (stories, messages, group chat) — visible as described where you post it. Lawful basis: consent.

What we never share publicly

• Your email address — never shown to other users.
• Your postcode or precise coordinates — public pages show your town or city at most.
• Leaderboards show only your first name and city, and you can opt out entirely.
• You can make your whole profile private in your profile settings.

Your rights

• Access & portability — download a full copy of your data from your profile settings at any time.
• Erasure — delete your account from profile settings. Your personal data is removed; records other people rely on (e.g. an organisation's approved hour logs, messages you sent them) are anonymised to "Deleted user".
• Rectification — edit your profile at any time.
• Objection & consent withdrawal — turn off local alert emails and all email notifications in profile settings.
• You may also complain to the Information Commissioner's Office (ico.org.uk).

Retention & security

• Sessions expire after 7 days.
• Data is retained while your account is active and removed or anonymised on deletion.
• Access to admin tooling is restricted, and moderation actions are logged.