Privacy Policy

1. Introduction

Kantara (“we”, “us”, or “our”) is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our grant-finding and application platform designed for UK charities.

We are committed to compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

2. Data Controller

Kantara is the data controller responsible for your personal information. For any privacy-related inquiries, you can contact us at:

Email: admin@kantara.org.uk

3. Information We Collect

3.1 Information You Provide

• Account Information: Email address, charity name, and password when you create an account
• Charity Profile: Registration number, charity description, location, focus areas, target beneficiaries, annual income range, and contact details
• Grant Applications: Application content, project notes, and status information
• Cyber Security Data: Cyber health check responses and assessment results
• Communications: Feedback, support requests, and correspondence with us

3.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent on the platform, and interaction patterns
• Device Information: Browser type, operating system, IP address, and device identifiers
• Authentication Data: Login timestamps and session information

4. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our platform.

4.1 Strictly Necessary Cookies

These cookies are essential for the platform to function and cannot be disabled:

• Authentication Cookies: Keep you logged in securely and manage your session
• Security Cookies: Protect against unauthorized access and security threats

4.2 Functional Cookies

These cookies remember your preferences (optional, requires consent):

• Preference Cookies: Remember your sidebar state and interface customizations
• Cookie Consent: Store your cookie preferences for future visits

You can manage your cookie preferences at any time using our cookie consent banner or by adjusting your browser settings. Note that disabling cookies may affect the functionality of the platform.

5. How We Use Your Information

We process your personal information for the following purposes under the legal bases provided by UK GDPR:

5.1 Contract Performance

• Provide and maintain our grant-finding and application services
• Match your charity with relevant grant opportunities
• Generate AI-powered grant application content
• Manage your account and provide customer support

5.2 Legitimate Interests

• Improve and optimize our platform functionality
• Analyze usage patterns to enhance user experience
• Prevent fraud and ensure platform security
• Communicate updates and important service information

5.3 Legal Obligations

• Comply with applicable laws and regulations
• Respond to legal requests and prevent illegal activities

5.4 Consent

• Send marketing communications (only with your explicit consent)
• Use non-essential cookies and tracking technologies

6. Data Sharing and Disclosure

We do not sell your personal information. We may share your information only in the following circumstances:

6.1 Service Providers

We work with trusted third-party service providers who process data on our behalf:

• Cloud Infrastructure: Secure hosting and database services
• AI Services: Grant matching and content generation
• Analytics: Usage analysis and platform improvements

All service providers are contractually bound to protect your data and use it only for specified purposes.

6.2 Legal Requirements

We may disclose your information if required by law, court order, or governmental request, or to protect our rights, property, or safety.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the new entity, subject to the same privacy protections.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption of data in transit and at rest using industry-standard protocols
• Secure authentication mechanisms and password hashing
• Regular security assessments and vulnerability testing
• Access controls and role-based permissions
• Regular backups and disaster recovery procedures

While we take reasonable steps to protect your information, no method of transmission or storage is 100% secure. We encourage you to use strong passwords and keep your account credentials confidential.

8. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy:

• Account Data: Retained while your account is active and for a reasonable period after deletion
• Application Data: Retained for the duration of your grant application lifecycle and for record-keeping purposes
• Usage Data: Typically retained for 12-24 months for analytical purposes
• Legal Obligations: Some data may be retained longer if required by law

You can request deletion of your account and associated data at any time, subject to legal retention requirements.

9. Your Rights Under UK GDPR

Under UK GDPR, you have the following rights regarding your personal information:

To exercise any of these rights, please contact us at admin@kantara.org.uk. We will respond to your request within one month, though this may be extended by two additional months for complex requests.

10. International Data Transfers

Your data is primarily processed within the United Kingdom. If we transfer data outside the UK or European Economic Area (EEA), we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the UK government
• Adequacy decisions recognizing equivalent data protection standards
• Binding Corporate Rules for intra-group transfers

11. Children's Privacy

Our services are designed for charitable organizations and not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. When we make significant changes, we will:

• Update the “Last updated” date at the top of this policy
• Notify you via email or prominent notice on the platform
• Where required, obtain your consent for material changes

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

13. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

14. ICO Registration

You have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent authority for data protection: