Privacy Policy

This policy applies to visitors to the AfroLegal website, people who submit support requests, volunteers, supporters, contributors to the Justice Journal, and anyone else who contacts AfroLegalthrough this website or associated digital channels.

AfroLegal is a UK-based community justice support organisation. We are not a law firm and do not provide legal representation, but we do process personal information connected to administrative support and community access to justice.

Depending on how you use the site, we may collect:

• Identity and contact information such as name, email address, phone number, and location.
• Case intake information, chronology, supporting documents, and background context you choose to submit.
• Volunteer application details, availability, practice area, experience, and related correspondence.
• Support contribution information such as contribution type, referral metadata, and payment confirmation status.
• Technical and security data such as IP address, device/browser signals, rate limiting records, and anti-abuse verification results.
• Editorial consent and story submission information where you ask us to consider publishing anonymised material.

Support requests may include special category data or highly sensitive information, such as health information, racial or ethnic origin, union membership, immigration matters, safeguarding concerns, or allegations relating to legal disputes.

Please only submit information that is necessary for us to understand your request. Where possible, redact information that is not needed at triage stage. If you submit sensitive data about another person, you must have authority to do so or another lawful basis for sharing it with us.

Where applicable, we rely on your explicit submission, your request for support, and where relevant the establishment, exercise, or defence of legal claims to process this type of information in line with applicable law.

• To assess, triage, and respond to support requests and volunteer applications.
• To prepare documents, organise case materials, and coordinate access to volunteer clinics.
• To contact you about your submission, next steps, scheduling, or safeguarding concerns.
• To process support contribution workflows through trusted payment and communication providers.
• To keep the website secure, detect abuse, and maintain operational records.
• To publish anonymised stories only where you have given appropriate consent.
• To comply with legal obligations, deal with complaints, and defend legal claims where required.

We rely on one or more of the following lawful bases under UK GDPR, and where relevant EU GDPR:

• Consent: for optional uses such as anonymised story publication and certain sensitive submissions where consent is the appropriate basis.
• Steps at your request / contract: to respond to enquiries, review support requests, and deliver the services or support model you ask us to provide.
• Legitimate interests: to administer the organisation, secure the site, manage operations, prevent abuse, and improve service delivery.
• Legal obligation: where we must keep records, respond to lawful requests, or meet accounting, safeguarding, or regulatory obligations.

We do not sell personal data. We may share it only where necessary with trusted providers or partners such as:

• Hosting, infrastructure, security, and anti-abuse providers.
• Email and communications providers used to receive or respond to submissions.
• The third-party payment provider used for support contributions.
• Volunteer professionals or partner clinics where this is necessary for a referral or appointment.
• Professional advisers, insurers, law enforcement, or public authorities where legally required or necessary to protect people from harm.

Where we share data with volunteer professionals or community partners, we do so on a need-to-know basis and only where the handoff is necessary to support your request.

Some of our providers may process data outside the United Kingdom. Where that happens, we use appropriate safeguards such as adequacy regulations, contractual safeguards, or equivalent lawful transfer mechanisms.

• General enquiries: usually up to 12 months after the last meaningful contact.
• Volunteer applications: usually up to 24 months, unless the volunteer joins an active programme.
• Case and support records: up to 6 years after closure where retention is needed for continuity, complaints, safeguarding, audit, or legal reasons.
• Support contribution and financial records: up to 6 years where needed for accounting and compliance.
• Security and abuse logs: typically up to 12 months unless a longer period is justified for incident response.

We may retain data for longer if required by law, if there is an active complaint or dispute, or if deletion would prejudice the handling of a safeguarding or legal issue.

We use reasonable technical and organisational measures to protect personal data, including access control, environment separation, validation, anti-abuse tools, and provider-level safeguards. No website, platform, or transmission method can be guaranteed completely secure.

AfroLegal handles community information with a confidentiality-first approach. Where a matter requires referral, escalation, or urgent safeguarding action, information may be shared only to the extent needed.

Subject to applicable law, you may have the right to request access, rectification, erasure, restriction, objection, portability, and withdrawal of consent where consent is the basis for processing.

To exercise a right, contact us using the details below. We may need to verify your identity before responding.

This website uses limited browser storage and essential security tooling. See the Cookie Policy for more detail.

This website is not directed at children. If you submit information on behalf of another person, including a child or vulnerable adult, you must have authority to do so and should only share what is necessary.

We may update this policy to reflect changes to our services, providers, or legal obligations. The date at the top of the page shows the latest version.

If you are unhappy with how we handle personal data, contact us first. You also have the right to complain to the UK Information Commissioner's Office: ico.org.uk.