1. Who we are
Open Space Support is a volunteer-run initiative based in the United Kingdom. We provide practical information, a confidential support application, and a way to donate if you want to help keep the work going. We are not a registered charity.
For UK data protection law, Open Space Support is the data controller for personal information collected through this website. That means we decide why and how that information is used.
This policy is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). It covers this website and the forms on it.
2. What we collect
You can browse our resources without creating an account or giving us your name. We only collect personal information when you choose to send it to us, or when it is needed for the site to work.
Information you give us
| What you do | What we collect |
|---|---|
| Apply for support | Name, email address, optional phone number and contact preferences, the kinds of support you are looking for, and anything you choose to write about your situation |
| Send a contact message | Name, email address, and your message |
| Join the newsletter | Email address |
| Make a donation | We do not collect your card number. Payments are taken on Stripe’s own page. After you pay, we may see your name, email address, the amount, whether it is one-off or monthly, and a payment confirmation, so we can keep records and say thank you if appropriate |
| Save an application draft | A copy of what you have typed so far, stored on your own device until you submit or clear it |
| Use the resource survey | Your answers stay in this browser tab so we can show a results page, and are not sent to us. We also store a small flag on your device so the invite does not keep popping up after you close it or finish |
Messages sent through the contact form are delivered to our team by our website host (Netlify). We use the name, email, and message you type to reply to you. The newsletter signup is not connected yet, so anything typed there is not sent to us.
Information collected automatically
Like most websites, our hosting provider may keep standard server logs for a short time. These can include your IP address, browser type, the pages requested, and the date and time. We use this only to keep the site running and secure, not to build a profile of you.
We do not currently use advertising cookies, social media tracking pixels, or analytics tools that follow you around the web. See our Cookie Policy for the full picture.
3. How we use it, and our legal basis
UK law says we need a lawful basis for each use of your information. This is what we rely on:
| Purpose | Lawful basis |
|---|---|
| Read and respond to a support application | Consent, and where you share health, belief, or similar details, explicit consent |
| Reply to a contact message | Consent, and our legitimate interest in answering the people who write to us |
| Send the newsletter | Consent (you can unsubscribe at any time) |
| Process a donation you choose to make | Contract (taking the payment you asked for), and our legitimate interests in keeping proper records. We also keep donation records where the law requires it |
| Keep the website secure and working | Legitimate interests |
| Meet a legal obligation, or protect someone’s vital interests | Legal obligation, or vital interests if someone is at immediate risk of serious harm |
You can withdraw consent at any time by contacting us. That will not affect anything we have already done lawfully before you withdrew it.
We will never sell your information, and we will never use a support application to market to you. The newsletter is separate from the support portal, as the forms themselves say. We will not add donors to the newsletter unless you have signed up for it yourself.
4. Sensitive (special category) information
A support application may include information UK law treats as extra-sensitive. That can include details about:
- religious or philosophical beliefs, including leaving a faith community
- health, trauma, or addiction
- sexual orientation or gender identity, if you choose to mention them
We only use this information to understand what you are asking for and to offer appropriate support. We rely on your explicit consent, which you give by ticking the consent box before you send the application.
You do not have to answer the optional questions. Share only what feels safe and useful.
5. Who we share it with
Support applications are seen only by our support team. We do not pass your details to another organisation without asking you first, except in the limited cases below.
We may share information with:
- Service providers who help us run the site - for example a hosting or database provider used to store submitted applications securely. They are only allowed to process information on our instructions.
- Stripe - to take donations. Card details are entered on Stripe’s page, not ours. Stripe’s privacy policy covers the information you give them. We may receive your name, email, and the donation amount from Stripe so we can keep accounts and, if needed, help with a refund or a cancelled monthly gift.
- Professional advisers if we need legal or safeguarding advice, under confidentiality.
- The police, emergency services, or a regulator if the law requires it, or if we believe someone is at immediate risk of serious harm.
We will not contact your family, congregation, or anyone from the group you have left, unless you ask us to.
Links to other organisations (Shelter, Samaritans, and so on) take you to their websites. What you do there is covered by their privacy policies, not ours.
6. How long we keep it
We keep information only for as long as we need it:
- Support applications - while we are supporting you, and then for up to 24 months after our last contact, unless you ask us to delete it sooner, or we need to keep it longer for a legal or safeguarding reason.
- Contact messages - usually up to 12 months after we have finished dealing with them.
- Newsletter signups - until you unsubscribe, or we close the list.
- Donation records - usually for up to six years, which is the normal period for keeping financial records in the UK.
- Application drafts on your device - until you submit the form, use Save and exit and later return, or clear your browser storage.
- Server logs - for a short period set by our hosting provider, typically a matter of days or weeks.
7. How we keep it safe
We take the sensitivity of this work seriously. Applications are intended to be stored with a reputable hosting provider using encrypted connections (HTTPS). Access is limited to the people who need it to offer support.
No website can promise perfect security. If you are filling in an application on a shared computer, use the quick-exit button when you need to leave, and consider whether a saved draft on that device is safe for your situation. Drafts live in your browser, not on our servers, until you submit.
8. Transfers outside the UK
Some of the tools we use to run the site are provided by companies outside the United Kingdom. That currently includes:
- Google Fonts, which serves the typefaces you see on the pages
- Stripe, which processes donations. Stripe is a US company with operations in the UK and EU. Card details are handled by Stripe, not stored on this website
- hosting or database services we use to store submitted applications, if those servers are outside the UK
Where a transfer happens, we rely on a lawful mechanism such as the UK’s adequacy regulations or standard contractual clauses, so that your information still has a comparable level of protection.
9. Your rights
Under UK GDPR you can ask us to:
- give you a copy of the personal information we hold about you (access)
- correct information that is wrong or incomplete
- delete your information, in certain circumstances
- restrict or object to how we use it, in certain circumstances
- move your information to you or another organisation (data portability), where the legal basis is consent and the processing is automated
- withdraw consent, where we rely on it
To use any of these rights, contact us through our contact form and tell us what you would like us to do. We will respond within one month, or let you know if we need a little longer.
We may need to confirm it is really you before we change or delete a record. We will never ask you for passwords, or for more of your story than we need to find your information.
10. Young people
Some of our resources are written for teenagers still living at home. You do not need to give us any personal information to read them.
We do not knowingly collect personal information from children under 13. If you are under 16 and you apply for support, share only what feels safe. Because of the nature of this work, we will not contact a parent or guardian about your information unless you ask us to, or we believe someone is at immediate risk of serious harm. You should be 18 or over to make a donation.
If you believe we hold information about a child under 13, please tell us so we can delete it.
11. Cookies and similar technologies
We currently set no advertising or analytics cookies. A banner on your first visit asks you to accept this. Application drafts are stored in your browser using local storage, which is similar to a cookie and is needed for the “save your progress” feature. Full details are in our Cookie Policy.
12. How to contact us, and how to complain
Questions about this policy, or about your information, can be sent through our contact form.
If you are unhappy with how we have handled your information, please tell us first so we can try to put it right. You also have the right to complain to the UK regulator:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk
We may update this policy if the site, the law, or our practices change. The date at the top will always show the latest version. If a change is significant, we will make that obvious on the site.
This policy describes how we handle information today. It is written for the current website. It is not legal advice about your own situation.