Privacy
Policy.

World Merit is the data controller for all personal data collected through our website, platform, and programmes. World Merit is fiscally sponsored by Legacy Global, a 501(c)(3) organisation registered in Arizona, United States. World Merit's office is located in Santa Barbara, California, United States.

If you have any questions about how we handle your personal data, please contact our Data Protection Officer at privacy@worldmerit.org.

We collect different types of data depending on how you interact with World Merit. We only collect what we need and always with a clear purpose.

• •Name, email address, and date of birth when you create an account
• •Profile information including location, biography, and profile photo
• •Programme application data including essays, references, and project descriptions
• •Payment information when you make a donation (processed securely by Stripe; we do not store card details)
• •Communications you send us via email, contact forms, or support tickets

• •Device and browser information
• •IP address and approximate location
• •Pages visited and time spent on our website
• •Platform activity including posts, reactions, and course progress
• •Cookies and similar tracking technologies (see Section 8)

• •Social login data if you sign in via Google or LinkedIn
• •Partner organisation data where you have consented to data sharing
• •Publicly available information to verify programme eligibility

We use personal data to run the platform and our programmes: creating and managing your account, enrolling you in courses, challenges and councils, matching volunteers with projects, processing applications, and verifying the impact you report.

We use your data to communicate with you about the programmes, projects, and opportunities that matter to you, and to respond to your enquiries. We process donations and send you receipts. We use aggregated and anonymised data to measure our impact and report to funders and partners.

We also use data to keep our website and platform secure, to prevent fraud and abuse, to improve our services, and to meet our legal and regulatory obligations. We only send marketing communications where we have your consent, and you can opt out at any time.

We process personal data on the following lawful bases:

• •Contract: to provide the platform, courses, and programmes you sign up for
• •Legitimate interests: to operate and improve our services, keep them secure, prevent fraud, and advance our charitable mission, balanced against your rights and freedoms
• •Consent: for marketing communications, non-essential cookies, and certain data sharing — you can withdraw consent at any time
• •Legal obligation: to meet tax, charity regulation, accounting, safeguarding, and lawful authority requirements
• •Vital interests and public interest: in limited circumstances, for example safeguarding or public-health education where it is necessary

We never sell personal data. We share data only where necessary and always with appropriate safeguards.

• •Service providers: hosting, email, analytics, and payment processors (for example Stripe) who act on our behalf under contract and only for the purposes we set
• •Partner organisations: where you have consented, or as part of a jointly delivered programme, or where a partner needs your data to provide you a service you requested
• •Legal and safety: where required by law, or to protect the safety of an individual (for example in a safeguarding case)
• •Public information: only what you have chosen to make public on the platform

• •International transfers: some of our service providers are based outside the UK and European Economic Area. Where we transfer data internationally, we ensure appropriate safeguards are in place in line with UK data protection law.

We keep personal data only for as long as we need it for the purposes for which it was collected. Account data is kept while your account is active and for a reasonable period afterwards. Financial records are kept to meet tax, accounting, and charity obligations.

When we no longer need your data, we delete or anonymise it in line with our retention schedule. You can ask us to delete your data at any time (see Section 7, Your Rights).

Depending on your location, you may have the following rights regarding your personal data, including under the California Consumer Privacy Act (CCPA/CPRA) for California residents. These rights are not absolute and may be subject to certain exemptions, but we will always respond to your request and explain our reasoning.

• •Right of Access: request a copy of all personal data we hold about you
• •Right of Rectification: correct any inaccurate or incomplete personal data
• •Right to Erasure: ask us to delete your personal data
• •Right to Restriction: limit how we process your data in certain circumstances
• •Right to Portability: receive your data in a machine-readable format
• •Right to Object: object to processing based on our legitimate interests

We use essential cookies to make the website work, including keeping you signed in and protecting your security. We may use analytics cookies to understand how visitors use the site and to improve it.

Non-essential cookies are only set with your consent. You can control or delete cookies at any time through your browser settings. Disabling cookies may affect how the site works.

If you have any questions about this policy or how we handle your personal data, contact our Data Protection Officer at privacy@worldmerit.org. You can also write to us at our registered address.

You also have the right to lodge a complaint with a data protection or consumer protection authority in your jurisdiction where applicable.