Last updated: February 2026

Ocean Buffer Project CIC (“we”, “us”, “our”) is committed to protecting your privacy and handling your personal data responsibly. This policy explains how we collect, use, store, and protect personal information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Ocean Buffer Project CIC is a not-for-profit community interest company based in Cornwall, UK. We run community, educational, research, and environmental projects focused on ocean health, climate action, and public engagement.

Contact email: hello@oceanbufferproject.co.uk

2. What personal data we collect

We may collect the following personal data:

- Name
- Email address
- Phone number
- Postal address
- Social media handle (if provided)
- Volunteer application information
- Event registration details
- Expense claim information
- Feedback, survey responses, or correspondence
- Accessibility or support needs (only if you choose to share them)

Some of this data, such as address and phone number, is collected through our volunteer sign-up forms to help us safely coordinate activities and communications.

We do not knowingly collect data from children under 16 without parental or guardian consent.

3. How we collect personal data

We collect personal data when you:

- Sign up to our mailing list via our website, including embedded forms
- Register for events or workshops
- Apply to volunteer or collaborate via website forms
- Submit expense claims
- Contact us by email or social media
- Participate in surveys, interviews, or research

Our website is built on WordPress and hosted by 20i, and may collect data through forms and embedded services.

4. Website analytics and cookies

We use Google Analytics to understand how visitors use our website and to help improve performance and content.

- Analytics cookies are only activated after you give consent via our cookie banner
- These cookies collect anonymised information such as pages visited, time on site, and general location data
- We do not use analytics to identify individuals

You can manage or withdraw your consent at any time via the cookie settings on our website.

5. Email subscriptions (Substack)

Our website includes an embedded Substack sign-up form for newsletters and updates.

When you subscribe:

- Your email address is processed by Substack
- Substack acts as a third-party data processor
- You can unsubscribe at any time using the link in any email

We only send updates where you have actively opted in.

Some of the third-party services we use, such as Substack and Google, may process data outside the UK, including in the United States.

Where this occurs, we take reasonable steps to ensure your data is protected, including relying on appropriate safeguards such as standard contractual clauses or equivalent measures in line with UK GDPR requirements.

By subscribing, you acknowledge that your data may be processed outside the UK.

6. How we use your data

We use personal data to:

- Communicate about events, volunteering, and activities
- Manage bookings and attendance
- Coordinate volunteers and collaborators, including safety and logistics
- Process expense claims and payments
- Share updates and newsletters, with consent
- Improve accessibility and engagement
- Monitor and improve website performance
- Meet legal and reporting obligations

We do not use automated decision-making or profiling.

7. Marketing communications

You can unsubscribe from communications at any time.

We do not sell or rent personal data and we do not send unsolicited marketing.

8. Photography, audio, and video

Recording may take place at events. Consent will be requested where appropriate, and you may opt out at any time.

9. Sharing your data

We may share data with trusted third parties where necessary, including:

- Email newsletter provider (Substack)
- Website hosting provider (20i)
- Analytics provider (Google Analytics)
- Event or booking tools
- Accounting software
- Grant funders, anonymised where possible

All third parties are required to handle data securely and in accordance with data protection law.

10. Data storage and security

We take reasonable technical and organisational measures to protect personal data.

Data is stored securely and only retained for as long as necessary for the purposes outlined in this policy.

Data retention

- Volunteer application data is typically retained for up to 12 months after your last active involvement, unless a longer period is required for safeguarding, legal, or insurance purposes
- Mailing list data is retained until you unsubscribe or request removal
- Event and participation data is retained for up to 24 months for reporting and organisational purposes

Where data is no longer required, it is securely deleted or anonymised.

11. Your rights

Under UK GDPR, you have the right to:

- Access your personal data
- Correct inaccurate data
- Request deletion of your data
- Restrict or object to processing
- Withdraw consent at any time
- Lodge a complaint with the Information Commissioner’s Office (ICO)

12. Changes to this policy

We may update this policy from time to time. Updates will be published on this page with a revised date.