Privacy Policy
Last Updated: 25 July 2026
1. Introduction
The Refract Foundation (“Refract”, “we”, “our”, or “us”) is committed to protecting your privacy and handling personal information responsibly.
This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have under applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
By using our website, participating in our programmes or research, attending our events, or otherwise interacting with Refract, you agree to the practices described in this policy.
2. Who We Are
The Refract Foundation is a youth-led non-profit organisation working to improve digital literacy, digital inclusion, online safety and access to technology education.
We deliver educational programmes, conduct research, organise events, and create resources that help young people develop digital skills.
Refract Foundation operates under the fiscal sponsorship of Hack Club, a United States 501(c)(3) nonprofit organisation (EIN 81-2908499). Hack Club provides financial administration and charitable oversight but does not generally determine how Refract delivers its programmes or processes personal information.
We may also work with schools, colleges, charities, public bodies and other partner organisations. Where those organisations collect information independently, their own privacy policies will apply.
For privacy enquiries, contact dpo@refractfoundation.org.
3. When This Policy Applies
This policy applies whenever you:
- Visit our websites
- Participate in our programmes or research
- Complete forms or surveys
- Register for events
- Contact us
- Apply to volunteer or work with us
- Use any other services operated by Refract Foundation
4. Information We Collect
Information You Provide
Depending on how you interact with us, we may collect:
- Name
- Email address
- School, college or organisation
- Event registration details
- Application information
- Messages you send us
- Feedback and survey responses
Information Collected Automatically
When you use our website, we may collect:
- IP address
- Browser and device information
- Operating system
- Pages visited
- Website usage statistics
- Security and diagnostic logs
Programme and Research Information
Some programmes may collect information about:
- Digital skills
- Technology access
- Confidence using technology
- Online safety awareness
- Learning experiences
- Attitudes towards digital technology
Where appropriate, we may also collect optional demographic information such as:
- Year group
- Gender
- Ethnicity
- Additional learning needs
- Indicators of economic disadvantage
Unless clearly stated otherwise, our programmes are designed not to collect names, email addresses, student identifiers, home addresses or other directly identifying information.
Please do not include personal information in free-text responses unless specifically requested.
5. How We Use Information
We use information to:
- Deliver our programmes and services
- Conduct educational research
- Improve our resources and initiatives
- Measure impact
- Produce reports and recommendations
- Organise events
- Communicate with participants and partners
- Support funding and grant applications
- Protect our systems and services
- Meet legal and safeguarding obligations
Where possible, research findings are reported using anonymised or aggregated data.
6. Our Legal Basis
Where UK GDPR applies, we process personal information under one or more of the following lawful bases:
- Consent – where you choose to provide information or participate.
- Legitimate Interests – to deliver our charitable activities, conduct research, improve services and administer the organisation.
- Legal Obligation – where we must comply with applicable laws.
- Public Task or Public Interest – where research or educational activities contribute to the public benefit.
7. Sharing Information
We may share information where necessary with:
- Schools and colleges
- Academy trusts
- Local authorities
- Research partners
- Charities and non-profit organisations
- Technology providers
- Professional advisers
- Funders
Where practical, information is shared in anonymised, aggregated or pseudonymised form.
We may publish reports, dashboards and research findings that are designed to prevent individuals from being identified.
We may also disclose information where required by law, safeguarding obligations, or to protect the rights, safety or security of Refract Foundation or others.
We never sell personal information.
8. Third-Party Services
We use trusted third-party providers to help deliver our services.
These may include:
- Tally
- Airtable
- GitHub
- Vercel
- Purelymail
- tawk.to
- Website analytics providers
- Cloud storage and productivity platforms
These providers may process information on our behalf and are required to maintain appropriate security and privacy safeguards.
9. International Transfers
Some of the services we use operate internationally and may process information outside the United Kingdom.
Where personal information is transferred internationally, we take reasonable steps to ensure appropriate safeguards are in place, such as recognised adequacy decisions, standard contractual clauses, or equivalent legal protections.
10. Data Retention
We keep personal information only for as long as necessary for the purposes described in this policy or to comply with legal obligations.
When information is no longer required, it is securely deleted, anonymised or otherwise disposed of.
Anonymous statistical and research data may be retained indefinitely.
11. Data Security
We use appropriate technical and organisational measures to protect personal information, including:
- Access controls
- Authentication
- Secure cloud infrastructure
- Encryption where appropriate
- Security monitoring
- Regular software updates
Although we work to keep information secure, no system can guarantee absolute security.
12. Cookies
Our website may use cookies and similar technologies to:
- Remember your preferences
- Improve website performance
- Understand how visitors use our website
- Maintain security
Where required by law, we will request your consent before using non-essential cookies.
13. Children’s Privacy
Many of our programmes are designed for young people.
We are committed to handling children’s information responsibly and in accordance with applicable data protection and safeguarding requirements.
Where activities are delivered through schools or other educational organisations, participation and data collection may be managed in partnership with those organisations.
14. Your Rights
Subject to applicable law, you may have the right to:
- Access your personal information
- Correct inaccurate information
- Request deletion of your information
- Restrict processing
- Object to certain processing
- Request a copy of your data
- Withdraw consent where consent is relied upon
To exercise your rights, email dpo@refractfoundation.org.
15. Complaints
If you have concerns about how we handle personal information, please contact us first so we can try to resolve the issue.
You also have the right to complain to the Information Commissioner’s Office (ICO).
16. Changes to This Policy
We may update this Privacy Policy from time to time.
The latest version will always be published on our website with the revised “Last Updated” date.
17. Contact
Privacy enquiries
General enquiries
Website
Support Our Work
Refract is entirely youth-led. Your donation helps us deliver programmes, events and resources that empower young people through technology and education.
Donate Today >