Effective Date: [4/4/25]
Last Updated:
[21/8/25]

BackgroundTheodoxia Foundation understands that your privacy is important and that you care about how your personal data is used. We respect and value the privacy of everyone who interacts with us, whether through our website, www.theodoxia.com, in person, by phone, via email, through our partners, or in the course of working with our volunteers. We are committed to collecting, using, and safeguarding personal data in a manner that is fair, transparent, and compliant with applicable privacy laws. We collect and use personal data only as described in this Privacy Notice and in compliance with applicable laws, including U.S. federal privacy laws, Delaware privacy laws, the UK Data Protection Act 2018, the UK General Data Protection Regulation (UK GDPR) and the UK Data Use and Access Act (2025).
‍
Information About UsOur Site is owned and operated by Theodoxia Foundation, a federally registered 501(c)3 Non Profit in the United States.
Business Address: xxxxxx
Email: info@theodoxia.com
‍
Scope of This PolicyThis Privacy Notice applies only to your use of Our Site. Where we link to third-party websites or services, their privacy practices apply, and you are encouraged to review their policies before providing them with personal information.
What Is Personal Data?
“Personal data” means information that identifies, relates to, describes, or could reasonably be linked with an identifiable individual. This includes identifiers such as names, contact details, and online identifiers such as IP addresses.
Your Privacy Rights
• Under U.S. Federal & Delaware Law:
While the U.S. does not have a single, comprehensive privacy law for all personal data, we adhere to Federal Trade Commission (FTC) principles prohibiting unfair or deceptive practices, and we comply with applicable state and federal laws governing Theodoxia Foundation, the security of personal information, breach notification requirements, and children’s privacy (including COPPA where applicable). Under UK GDPR, EU GDPR, and Data Protection Act 2018:
You may submit a request to access, delete, correct, or transfer your personal data by contacting us at the details below. We will verify your identity before fulfilling your request, as required by law.
Right to be informed
Example: You visit our website and submit your email to join our mailing list. We provide you with a clear privacy notice explaining what data we collect, why we collect it, how long we keep it, and who we share it with, before you provide your email.
Right of access
Example: You email us asking for a copy of all personal data we hold about you. We provide a secure copy of that data within one month, along with details of how it’s being used.
Right to rectification
Example: You discover that the email address we have on record for you is misspelled. You contact us, and we update it to the correct address promptly. Right to erasure (“right to be forgotten”)
Example: You request that we delete your volunteer application and all related correspondence because you no longer wish to be considered. We remove your data from our systems unless we have a legal reason to keep it.
Right to restrict processing
Example: You believe the contact details we have for you are inaccurate. While we verify them, you request that we stop using your information for any communications, and we comply until the accuracy is confirmed.
Right to data portability
Example: You ask us to send the personal data you provided (such as your volunteer profile and contact preferences) to another charity you are joining. We provide the data in a commonly used, machine-readable format such as CSV.
Right to object
Example: You receive our marketing emails but decide you no longer want them. You click “unsubscribe” or email us to object to receiving further marketing communications, and we stop sending them.
Rights related to automated decision-making and profiling
Example: We use a system to score volunteer applications automatically based on certain criteria. You have the right to request that a human review the decision rather than relying solely on the automated score. Under the UK Data (Use and Access) Act 2025:o Adjusted rules for automated decision-making with safeguards
- Proportionality requirements for Subject Access Requests (SARs)
- Permitting certain low-risk cookies without consent, subject to transparencyIf you are not satisfied with how we have handled your personal information and cannot resolve the issue with us directly, you have the right to lodge a complaint with the
Information Commissioner’s Office (ICO), the UK’s independent body for upholding information rights.
You can contact the ICO at:
Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire, SK9 5AF
Email: https://ico.org.uk/for-the-public
‍
What Data We CollectWe collect only what is necessary:
• Automatically: IP address, browser type, operating system, and site interaction data for functionality and security purposes.
• Directly from You: Name, email address, and any details you provide when contacting us or signing up for updates or our newsletter.
• Payment Information: If you donate via Stripe, we collect transaction details but do not store full payment information (Stripe handles this securely).
‍
How We Use Your DataWe process your data to: Theodoxia Foundation
• Respond to your inquiries
• Fulfill legal and regulatory obligations
• Protect our rights and prevent fraud
Our processing is based on lawful grounds including consent, contract performance, legal obligations, and legitimate interests, depending on the context.
For campaigns
We collect pledges of support for campaigns
For direct marketing
To let you know by email, telephone, SMS or post the latest news about our work for children and share with you how else you can help, where we have a lawful basis to do so. These updates may include information on fundraising or campaigning for us, as well as updates on our work with children.
For gifts in wills, or legacy giving
To invite you to consider leaving a gift in your will and to review legacy commitments as part of our future financial planning.
For our website:
• To email you if we can offer help or resolve any issues, for example, if you start but do not complete a form or donation.
• To share our latest news and ways to support children through online adverts on other websites, based on your visit to ours.
• To provide live chat support so our supporter team can guide you to relevant content.
‍
Data SharingWe do not sell personal data. We may share information with service providers under confidentiality agreements, as required by law, or in connection with business transfers such as mergers or acquisitions.
Here are some examples of the types of organisations we may share your personal information with:
• Fundraising partners
• Social media partners
• Donations processing partners
• Delivery partners
• Research partners
• Partners who help provide our websites, systems and databases
• IT Service providers
• Professional advisors such as lawyersInternational Transfers
If we transfer personal data from the UK or EU to the U.S. or other jurisdictions, we implement safeguards such as Standard Contractual Clauses (SCCs) or equivalent measures.
‍
Data RetentionWe retain personal information only for as long as necessary to fulfil the purposes for which it was collected, in accordance with our Retention Policy. The storage period depends on the nature of the information, its intended use, and any legal or regulatory
requirements for its retention. In general, we retain personal information for seven years.
For individuals who have asked not to be contacted for direct marketing purpose, we retain their information for three months.
Security
We employ technical and organisational measures to protect personal data from unauthorized access, use, disclosure, alteration, or destruction.
Information We Collect, Use, Share, and Protect
2.1 Information We Collect
We may collect the following information when you interact with our website or services:Personal Information: Name, email address, and any other details you provide when contacting us or signing up for updates.Payment Information: If you make a donation via Stripe, we collect transaction details but do not store full payment information (Stripe handles this securely).Automatically Collected Data: When you visit our site, Google Analytics collects data such as your IP address, browser type, pages visited, and time spent on our site.Form Submissions: If you submit a contact form, we collect the information you provide to respond to your inquiry.
2.2 How We Use Your Information
We use your information to:Process donations and transactions securely via Stripe.Improve our website through Google Analytics insights.Respond to inquiries and messages submitted through contact forms.Send updates or communications (if you opt-in).
2.3 How We Share Your Information
We do not sell, rent, or trade your personal information. However, we may share data with:Third-Party Service Providers: Stripe (for payments), Google Analytics (for website traffic insights), and email services (for updates if opted-in).Legal Requirements: If required by law, we may disclose your information to authorities.
2.4 Your Rights and Choices
Depending on your location, you may have the right to:Request access to the personal data we hold about you.Ask us to correct or delete your data.Opt out of receiving communications from us.Disable cookies in your browser settings to limit tracking.
2.5 Data Security
We implement industry-standard security measures to protect your information, but no online platform is 100% secure. If you suspect a security issue, please contact us immediately.
‍
Contact UsEmail: info@theodoxia.com
Telephone: xxxxxx
Postal Address: xxxxxx
Policy Updates
We may update this privacy notice to reflect legal, technical, or business changes.
Updates will be posted on our site.
Last Updated: August 2025