Last Updated Oct 2024
Privacy Policy
1. Who we are
GardenOfLove is a community platform that helps people turn shared social and environmental concerns into real action, alongside verified charities and non-profit organisations.
GardenOfLove is operated by Software Genesis Group Ltd, a company registered in England and Wales (company number 12273882), whose registered office is Suite 115, Devonshire House, Manor Way, Borehamwood, Hertfordshire WD6 1QQ, United Kingdom (“we”, “us”, “our”).
We are the controller of the personal data described in this policy. Our registration number with the Information Commissioner’s Office (ICO) is ZB641603.
This policy applies to the GardenOfLove website (gardenoflove.net), our mobile apps and related services (together, the “Platform”). Please read it alongside our Terms of Service and Cookies Policy.
Privacy contact: uk.connect@gardenoflove.net
Post: Software Genesis Group Ltd, Suite 115, Devonshire House, Manor Way, Borehamwood, Hertfordshire WD6 1QQ
2. The personal data we collect
2.1 Information you give us
• Account details: name, email address, password (stored in encrypted form), and whether you join as an individual or as a non-profit organisation (NPO). If you sign up with Google or Facebook, we receive your name, email address and profile picture from that service.
• Profile details (optional): photo, bio, location, interests and anything else you choose to add.
• Gardens and posts: the Gardens you create or join, the concerns you post, your votes, comments, Updates and any photos, videos or files you upload.
• Volunteering: when you respond to a volunteering post, the details you share with the organisation, such as your contact details, availability and relevant experience.
• Donations and tips: the amount, the campaign you supported, whether you chose to donate anonymously, and any optional tip to GardenOfLove. Card payments are handled by our payment processor, Stripe; we do not receive or store your full card number or security code.
• Fundraising as an individual: to prevent fraud, we ask individual fundraisers for proof of identity and bank account details, which are checked by Stripe.
• NPO information: organisation name, charity registration number, Blueprint Profile content, team member names and roles, and documents you upload. Information about named team members is personal data.
• Messages: messages you send to other users through the Platform.
• Contact with us: anything you send us by email, contact form, survey or support request.
2.2 Information collected automatically
• Usage information: pages and features you use, searches, clicks, and the date and time of your activity.
• Device and connection information: IP address, device type, operating system, browser, app version and time zone.
• Location: an approximate location from your IP address; precise location (GPS) only if you give permission in your device settings.
• Cookies and similar technologies: see our Cookies Policy on gardenoflove.net.
2.3 Information from others
• Other users: for example, when someone mentions you in a post or sends you a message.
• Contact syncing (optional): if you choose to sync your phone contacts to find friends, we use phone numbers and email addresses from your address book only to check who is already on GardenOfLove. We do not use the details of contacts who are not GardenOfLove users for any other purpose, and we delete them within one month.
• Verification sources: we check NPOs against public charity registers, such as the Charity Commission register, and receive account status and identity verification results from Stripe.
2.4 Sensitive information
We do not ask you for information about your health, religion, ethnicity, political views, sexual orientation or similar sensitive matters. Some Gardens discuss topics such as health or faith, and you may choose to share personal experiences in your posts. Please think carefully before doing so, as posts may be visible to other users and, in some cases, to the public (see section 4). We only use such content to run the Platform and to moderate it.
3. How we use your data, and our lawful bases
UK data protection law requires us to have a lawful basis for each use of your data.
Purpose | Data used | Lawful basis |
Creating and running your account | Account and profile details | Contract |
Providing Gardens, posts, votes, comments and messages | Content, usage data | Contract |
Processing donations, tips and Harvest statements | Donation details, account details | Contract; legal obligation (financial records) |
Verifying NPOs and individual fundraisers | NPO details, identity and bank documents | Legitimate interests (preventing fraud and protecting donors); legal obligation where applicable |
Sharing volunteer responses with the organisation | Volunteering details | Contract |
Suggesting Gardens, causes and charities near you | Profile, location, usage data | Legitimate interests (making the Platform relevant) |
Safety, moderation and preventing misuse | Content, reports, usage and device data | Legitimate interests; legal obligation (including online safety law) |
Improving the Platform through analytics | Usage and device data | Consent, given through our cookie banner and app settings. See our Cookies Policy for details and to change your choices. |
Precise location and contact syncing | GPS location, address book | Consent |
Service messages (security, policy changes) | Contact details | Contract; legitimate interests |
News and updates about GardenOfLove | Email address | Consent (you can unsubscribe at any time) |
Responding to legal requests and enforcing our terms | Any relevant data | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details of this assessment.
We do not sell your personal data, and we do not use it for third-party advertising.
4. Who can see your information
• Other users: your profile, posts, votes, comments and Garden memberships are visible to other users according to your privacy settings.
• Charities and NPOs: when you donate, the charity can see your name and donation amount unless you choose to donate anonymously. When you respond to a volunteering post, the organisation receives the details you share. Charities then become separate controllers of that information and are responsible for how they use it.
• Fundraisers: for individual fundraisers, the same applies to donations to their campaigns.
• The public: campaigns, Garden names, posts, comments, profiles and the names of donors may be visible to visitors who are not signed in, subject to your privacy settings. If you donate anonymously, your name is not shown.
5. Who we share your data with
We share personal data only with:
• Service providers who process it on our behalf under contract: Stripe (payments and identity verification), Amazon Web Services (hosting, in the United States and Germany), Mixpanel (analytics), Google (sign-in and tag management), Meta (Facebook sign-in, if you use it) and Zoho (email).
• Charities and NPOs, as described in section 4.
• Professional advisers, such as lawyers, accountants and auditors.
• Authorities, where the law requires it, or to protect the safety of our users or others.
• A buyer or successor, if our business is reorganised, merged or sold. We will tell you before your data becomes subject to a different privacy policy.
6. International transfers
Some of our service providers store or process data outside the UK, in the European Economic Area (including Germany) and the United States.
Transfers to the EEA are covered by UK adequacy regulations.
Transfers to the United States are protected either by the UK Extension to the EU-US Data Privacy Framework (the “UK-US Data Bridge”), where the provider is certified under it, or by the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
You can ask us for more information about these safeguards.
7. How long we keep your data
Data | Retention period |
Account and profile | While your account is open, then deleted within 30 days of closure, except as below |
Posts, comments and votes | Until you delete them or close your account |
Donation and tip records | 6 years after the transaction, for tax and audit purposes |
Identity verification documents | Up to 6 years after the campaign ends, or the minimum required by law |
Messages | Until deleted by you, or account closure |
Moderation reports and safety records | 2 years, or longer if needed for legal claims |
Support requests | 2 years |
Analytics data | 26 months |
Synced contacts who are not users | Deleted within one month |
Backups are overwritten within 35 days.
By using the Services or providing any information to us, you expressly consent to such transfer and processing.
8. How we protect your data
We use technical and organisational measures to protect your data, including encryption in transit, encryption of stored passwords, access controls and regular security reviews. Messages are encrypted in transit and at rest; they are not end-to-end encrypted. No system is completely secure, so please use a strong, unique password.
9. Automated decisions
We do not make decisions with legal or similarly significant effects about you based solely on automated processing. We use automated tools to help detect spam, fraud and harmful content, but significant actions, such as closing an account, are reviewed by a person.
10. Your rights
• access a copy of your personal data;
• correct inaccurate or incomplete data;
• erase your data, in certain circumstances;
• restrict how we use your data, in certain circumstances;
• object to our use of your data based on legitimate interests, and to direct marketing at any time;
• data portability, to receive data you gave us in a commonly used format;
• withdraw consent at any time, where we rely on consent, without affecting earlier processing.
To use any of these rights, email uk.connect@gardenoflove.net. We will respond within one month, which may be extended by two further months for complex requests. We may need to confirm your identity first.
11. Complaints
You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk, 0303 123 1113.