Privacy Policy.

Last updated: 7 July 2026

1. Who we are

Project Resist is an independent strategic advocacy and policy organisation focused on the needs of black and minority women in the UK. We are the data controller for the personal data we collect through this website.

If you have any questions about this policy or how your data is handled, contact us at comms@projectresist.org.uk.

2. What data we collect

We only collect personal data you actively give us, plus minimal technical data necessary to run the site:

• Contact form — name, email address, and the message you send us.
• Newsletter sign-up — your email address.
• Server logs — IP address, browser type, pages visited, and timestamps. Used only for security and to fix errors.
• Cookies — see Section 6 below. We do not currently use any analytics or marketing cookies.

3. Why we collect it (legal basis)

• To respond to your enquiry when you use the contact form — legal basis: legitimate interest.
• To send you our newsletter if you signed up — legal basis: your consent. You can unsubscribe at any time using the link in any newsletter we send.
• To operate the site securely — legal basis: legitimate interest.

4. Who we share it with

We do not sell or rent your data. We share it only with the service providers that help us run this website:

• Vercel — hosts the website and processes server logs. Data may be processed in the EU and US.
• Neon — hosts our database. Servers are located in the EU (London).

Both providers are under written contracts that require them to protect your data and only process it on our instructions.

5. How long we keep it

• Contact form messages — kept for up to 24 months unless we need them longer for an ongoing matter.
• Newsletter subscriptions — kept until you unsubscribe.
• Server logs — typically rotated within 30 days.

6. Cookies

We use one strictly necessary cookie/local storage entry to remember your cookie-consent choice. This is set only after you click Accept or Reject on our cookie banner and is required by law to be exempt from consent.

We do not currently use analytics, advertising, or social-media cookies. If we add any in the future, they will be opt-in via the cookie banner before they load.

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Have inaccurate or incomplete data corrected.
• Have your data erased ("right to be forgotten") in certain circumstances.
• Restrict or object to our processing of your data.
• Receive a copy of your data in a portable format.
• Withdraw consent at any time where we rely on consent.
• Lodge a complaint with the UK Information Commissioner's Office ( ico.org.uk).

To exercise any of these rights, email comms@projectresist.org.uk.

8. Security

We use HTTPS for all traffic and host our data with established providers that maintain industry-standard security. No system is completely secure, but we take reasonable steps to protect your data and will inform affected users without undue delay if a personal data breach occurs.

9. Children

Our website is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with their data, please contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page indicates when it was last reviewed. Material changes will be highlighted on the home page or via the newsletter.

Questions? Email comms@projectresist.org.uk.