Privacy notice

[Draft wording for David to finalise before launch. Nothing on this page is final.]

This website sets no cookies and has no advertising or tracking scripts. [Write this from the documentation before launch, then check it on the live site (docs/LAUNCH_RUNBOOK.md: at D5 if possible, otherwise E4): that the contact form's spam check sets no cookie either. Cloudflare's 2022 launch post for Turnstile says it uses no cookies, but Cloudflare's current Cookie Policy lists cookies it may set for its "CAPTCHA products". Check in the browser's developer tools, including cookies for challenges.cloudflare.com, and change this sentence if any appear.]

Who we are

This website is run by the Lancashire Schools Sustainability Forum, a not-for-profit organisation.

[Who is responsible for your information (the "data controller") — to be confirmed: the Forum itself, or a named person.]

What the contact form collects

When you send us a message through the contact form, we receive:

• your name
• your email address
• the name of your school or group, if you give one
• what your message is about
• your message

Please don't include personal details about pupils.

The contact form has a spam check, provided by Cloudflare and called Turnstile. It is only loaded when you start to use the form: when you click or tab into it. [Wording to confirm. Cloudflare's Turnstile Privacy Addendum (https://www.cloudflare.com/turnstile-privacy-policy/, last updated 18 June 2025) says it uses your IP address, details of your browser and its connection (the User-Agent and a TLS fingerprint) and the address of the site, to tell people from automated programs. It does not read what you type. Cloudflare acts for us (as our "processor") when it protects the form, and on its own account when it uses the information to improve its bot detection.]

Why we collect it

We use your details only to read your message and reply to it.

[Our lawful basis for this under data protection law — to be confirmed.]

How long we keep it

The website itself stores nothing. It checks the form, sends your message to the Forum as a single email, and then discards it. It sends no copy or confirmation to you.

[Where the email is delivered and who reads it — to be confirmed: for example, it goes to the mailboxes of the Forum lead and Chairperson.] [How long messages are kept there, and who deletes them — to be confirmed.]

Who else is involved

One company, Cloudflare, provides everything this website runs on:

• it hosts the website;
• it provides the spam check on the contact form;
• it delivers your message to us by email;
• it counts visits to the site (Cloudflare Web Analytics), without cookies and without identifying you. [To match the setting chosen at launch: Cloudflare's default for new sites leaves out visitors in the UK and the EU altogether.]

[To settle before launch (docs/LAUNCH_RUNBOOK.md, C1 and C8). From Cloudflare's documentation (October 2026): for each email it keeps a delivery record (the addresses it was sent from and to, the subject, the time and whether it arrived) for 31 days. For the contact form those are the Forum's own addresses and a fixed subject naming the topic, never anything you typed. Whether it keeps the text of the message depends on the set-up: with a domain set up for Email Sending it keeps a readable copy for about 7 days unless "Email preview" is switched off (the runbook switches it off); for messages sent only to the Forum's verified mailboxes, Cloudflare doesn't say, so this is checked in its activity log after the first test message (runbook C8 and D6). Whether the log shows the sender's (reply-to) address is also to be checked there. If the Forum's address uses Cloudflare Email Routing, emails sent straight to it are recorded the same way, with the sender's address and their subject. Still to confirm from Cloudflare's data processing terms: whether it handles information outside the UK, and with what safeguards.]

[To confirm once the email set-up is decided: that we don't share your details with anyone else.]

Your rights

You can ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete it.

[Full wording of your rights — to be confirmed.]

Contact

To ask about your information, email us at [forum email address].

Complaints

If you're unhappy with how we've handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/.