Privacy Notice 

Last updated: December 2025 

1. Introduction

The Vodafone Foundation (“we”, “us” or “our”) is committed to keeping your personal data safe and meeting our responsibilities under privacy law. Given that this is information that can be used to identify you, we want you to be confident that we are using it responsibly. This Privacy Notice explains how we collect, use, share, and retain your personal data when you use our DIY Foundational Skills Platform (the “Platform”). 

2. Who We Are

Vodafone Foundation is an independent UK-registered charity (charity number 1089625). We provide digital learning tools and content to support education initiatives. 

If you have questions regarding your personal data or its use as part of the Platform, please contact us using the details set out in the ‘Contact’ section below. 

3. What Personal Data We Process

‘Personal data’ is any information that relates to an individual. It does not include information where the identity of the individual has been fully and effectively removed (anonymous data).  

We may process the following types of personal data as part of the Platform: 

• Identity Data: name, age or birth year, school or organisation. 

• Contact Data: email address. 

• Login Data: username, password, IP address. 

• Usage Data: assessments taken, dates, performance, and learning materials accessed. (No educator-specific accounts exist.) 

If you contact us, for example to provide your feedback, we may keep a record of that feedback and correspondence, as well as your name and contact details.  

Under data protection legislation, certain personal data is considered more ‘sensitive’ (e.g., information relating to race, religion, political affiliation, sex life, sexual orientation and health). This is also known as ‘special category data’. Information relating to criminal offences is also considered to be particularly sensitive. We do not intentionally collect sensitive personal data. 

4. Why We Collect Your Personal Information & Lawful Basis

We will only use personal data for specified purposes and when the law allows us to (i.e., where we have a ‘lawful basis’). Most commonly, we will use your personal data for the following purposes  

We process data to: 

• Provide access to the Platform — in order to do so, we rely on the lawful basis that this processing is necessary to perform a contract with you (i.e. to provide you with the Platform in accordance with its Terms of Use); 

• Support and communicate with you — in order to do so, we rely on the lawful basis that this processing is necessary for our legitimate interests (including our interests to provide our services, engage with users and make sure that they can use the Platform appropriately) and that these interests are not overridden by your rights and freedoms; 

• Ensure security and prevent misuse — in order to do so, we rely on the lawful basis that this processing is necessary for our legitimate interests (including our interests to ensure that the Platform remains secure) and that these interests are not overridden by your rights and freedoms; 

• Conduct Programme Monitoring & Evaluation — in order to do so, we rely on the lawful basis that this processing is necessary for our legitimate interests (including our interests to provide and improve our services) and that these interests are not overridden by your rights and freedoms (please note that we only use pseudonymised data for this purpose – this means that your identity will be hidden); 

• Improve Platform performance — in order to do so, we rely on the lawful basis that this processing is necessary for our legitimate interests (including our interests to provide and improve our services) and that these interests are not overridden by your rights and freedoms. 

• As necessary to comply with legal obligations to which we may be subject (for example reporting to HM Revenue and Customs, or the Charity Commission). 

In some circumstances, we may ask for your consent to use your personal data for a specific purpose. In particular, we may obtain your consent before we send you any email marketing, newsletters or other communications about topics and events which we think might interest you.  

You may unsubscribe from our email communications by following the instructions in any email that we send you, or you can withdraw your consent at any time by emailing us at privacy@di4y.org. 

6. Cookies and Analytics

The Platform may use essential cookies required for basic functionality (i.e. cookies that are needed for the Platform to run). No non-essential cookies are used unless explicitly stated. 

Pseudonymised analytics, which we collect via course evaluation surveys, may be used to understand engagement and improve the Platform.  

For more information about our use of cookies, please visit our Cookie Notice here.  

7. Who We Share Your Personal Data With

We may share data with: 

• Service providers supporting hosting, maintenance, analytics, or delivery of content; 

• Researchers and programme partners (pseudonymised only); 

• as part of a sale, merger or acquisition, or other transfer of all or part of our assets including as part of a bankruptcy proceeding; 

• pursuant to a subpoena, court order, or other legal process or as otherwise required or requested by law, regulation, or government authority programs, or to protect our rights or the rights or safety of third parties;  

• with our professional advisors, lawyers, accountants and auditors; or 

• with your consent or as otherwise disclosed at the time of data collection or sharing. 

We do not sell personal data. 

8. Data Storage, Retention & International Transfers

In some cases we may store or process your personal data outside of the UK. However, to the extent that we do so, we will typically store/process your personal data in the European Economic Area, which is considered to have data protection law that is essentially the same as that in the UK (and has therefore been deemed to be ‘adequate’ for data protection purposes). If we transfer your personal data to any other jurisdictions, we will take steps to ensure that your personal data is protected in accordance with appropriate safeguards, especially where the recipient country is not considered to be adequate under UK law. For example, we will rely on the appropriate safeguards under data protection legislation, such as standard contractual clauses approved by the UK Government.  

We will typically store your personal data for the following periods:  

• Personal data is kept while your account is active. 

• Deleted accounts are retained for 90 additional days. 

• System logs are retained while your account is active. 

• Pseudonymised evaluation data may be retained for programme duration (i.e. for as long as we operate the Platform). 

However, please note that in some cases, we may need to retain your personal data for a longer period, for example because of: (i) legal requirements that apply to us; (ii) our ongoing contractual and/or relationships with you; (iii) any (potential) disputes; and (iv) any guidelines issued by relevant regulators.  

After the expiration of the appropriate retention period, the relevant information is routinely deleted, as long as it is no longer necessary for the purposes described above. 

9. Your Rights

Under UK GDPR, you may: 

• Request access to your personal data; 

• Request that we correct inaccurate data about you; 

• Request the deletion of your personal data; 

• Object to, or request that we restrict, the processing of your personal data, in certain circumstances; 

• Request that we port personal data about you that you have provided to us to you or to a third party, in certain circumstances;  

• Make a complaint to us about our handling of your personal data; and 

• Withdraw consent where we have relied on that consent. 

To exercise your rights, please contact us at: privacy@di4y.org. Please be aware that we may be unable to provide these rights to you under certain circumstances, for example if we are legally prevented from doing so or can rely on exemptions. 

Additionally, you have the right to lodge a complaint against us with the Information Commissioner’s Office, which you can do at www.ico.org.uk/make-a-complaint. 

10. Changes to This Notice

We may update this Privacy Notice periodically for example, to take into account changes at the Vodafone Foundation or to reflect changes in regulation or legislation.  

Updates to this Notice will be posted on this page – please check back from time to time. We will also use reasonable efforts to inform you of any significant changes by email where appropriate. 

11. Other websites and third parties 

The Platform may contain links to other websites. Please note that when you click on one of these links, you are entering another website for which we have no responsibility (even if you access the website via a link to one of our websites). We encourage you to read the privacy notices (or similar) on all such websites.  

12. Contact

For questions or rights requests, contact us at: 
Vodafone Foundation 
Email: privacy@di4y.org 
Address: 1 Kingdom Street, Paddington Central, London, United Kingdom, W2 6BY