Your data
Privacy & Cookie Policy
We collect as little personal data as we can, use it only for the reasons below, and never sell it. This policy explains what we collect, why, who helps us process it, and your rights.
Last updated:
Who we are
PSSD Institute is the trading name of PSSD Initiative C.I.C., a Community Interest Company registered in England and Wales (company number 16659708), registered office 124 City Road, London, EC1V 2NX, UK. We are the data controller for the personal data described in this policy.
For any privacy question or request, email info@pssdinstitute.org or write to us at our registered office.
What we collect and why
When you contact us
If you use our contact form or email us, we receive your name, email address, subject and message. We use them to read and reply to your message. Our lawful basis is our legitimate interest in answering enquiries. The contact form is delivered to our inbox by Web3Forms, a form-delivery service.
Health information
Many people who contact us choose to tell us about their own experience of PSSD. Health information is "special category" data under data protection law. We never require it. If you choose to include it in a message, we process it on the basis of your explicit consent, given by sending it to us. We use it only to respond to you. We keep it confidential and never publish it or pass it on without your separate, explicit permission. You can withdraw your consent and ask us to delete it at any time.
When you join our mailing list
If you sign up for news and updates, we collect your email address and the date you signed up. We use it to send you news about PSSD research, advocacy and our work. Our lawful basis is your consent. Every email includes an unsubscribe link, or you can email us to be removed. If you joined our mailing list on our previous website, we have kept your email address so you continue to receive updates.
When you donate
Donations are handled by our payment providers (Stripe or PayPal), which collect your payment details directly; we never see or store your card details. We receive your name, email address, the amount and the date, and use them to process and acknowledge your gift and to keep the financial records the law requires.
When you visit the website
Our website is hosted by Cloudflare, which processes technical data such as your IP address and browser type to deliver the site and protect it from attacks. This is in our legitimate interest in running a secure website. Our fonts and images are served from our own site, and videos are links to YouTube, not embeds, so nothing loads from YouTube unless you follow a link.
With your consent only, we use Google Analytics to understand how many people visit and which pages are most useful. Google Analytics records information such as the pages you view, how you arrived, your approximate location (city or country) and your device type. It does not store IP addresses, and we have turned off Google signals and advertising features. See Cookies below.
Who we share it with
We never sell or rent your personal data. We share it only with service providers that process it for us under contract, and only as needed:
- Google (Google Workspace email, and Google Analytics if you accept analytics cookies)
- Cloudflare (website hosting and security)
- Web3Forms (delivers contact-form messages and sign-ups to our inbox)
- Our newsletter provider (stores the mailing list and sends our emails)
- Stripe and PayPal (process donations)
We may also disclose information if the law requires it.
International transfers
Some of these providers process data outside the UK, including in the United States. Where they do, the transfer is protected by UK adequacy regulations (such as the UK Extension to the EU–US Data Privacy Framework) or by the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses.
How long we keep it
- Messages and enquiries: up to 2 years after we last hear from you, unless we have an ongoing reason to keep them (for example, you are volunteering with us).
- Mailing list: until you unsubscribe. After that we keep only your email address on a suppression list so we don't email you again.
- Donation records: 6 years, as required for company and tax records.
- Google Analytics data: no longer than 14 months.
Cookies
Cookies are small files a website stores on your device. We don't use any advertising or tracking cookies. The only cookies we use are Google Analytics cookies, and only if you click "Accept analytics" in the cookie banner. If you reject them, or don't choose, Google Analytics does not load at all.
| Name | Set by | Purpose | Expires |
|---|---|---|---|
_ga | Google Analytics | Tells visits from different browsers apart, so we can count visitors | 2 years |
_ga_PPLF0H5DPT | Google Analytics | Keeps track of your visit (session) | 2 years |
pssd-consent (local storage, not a cookie) | This website | Remembers whether you accepted or rejected analytics cookies, so we don't ask on every page. Strictly necessary. | We ask again after 12 months |
You can change your choice at any time: . You can also block or delete cookies in your browser settings.
Your rights
Under UK data protection law (and the EU GDPR, if you live in the EU), you have the right to:
- ask for a copy of the personal data we hold about you
- ask us to correct inaccurate data
- ask us to delete your data
- ask us to restrict or stop using your data, or object to how we use it
- receive your data in a portable format
- withdraw your consent at any time, without affecting what we did before you withdrew it
To use any of these rights, email info@pssdinstitute.org. We will reply within one month. There is normally no charge.
Complaints
If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113), or to the data protection authority in the country where you live.
Keeping your data safe
Only the people at PSSD Institute who need your information to do their work can access it. We use secure, access-controlled accounts and encrypted connections (HTTPS) throughout.
Children
Our website and mailing list are intended for adults. We do not knowingly collect personal data from children under 13.
Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed.