Europe Must Act Effective date: 08.10.26
Europe Must Act (“we”, “us”, “our”) is committed to protecting and respecting your privacy. This policy explains what personal data we collect, why we collect it, how we use it, and the rights you have over it. It applies to personal data collected through this website and through our newsletter and donation channels.
This policy is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and with the EU General Data Protection Regulation (GDPR) where it applies to people in the EU.
1. Who we are
Europe Must Act operates under ForRefugees, a registered charity in England and Wales (Registered UK Charity No. 1168435), based at 13A Radcliffe Road, Croydon CR0 5QG, United Kingdom.
Our contact details:
- Email: hello@europemustact.org
- Postal address: 13A Radcliffe Road, Croydon CR0 5QG, United Kingdom
2. Where our data is hosted
This website is hosted by GreenNet (GreenNet Ltd, a UK-based ethical internet service provider). Data you submit through this website is stored on GreenNet’s servers. GreenNet acts as our data processor and processes data only on our instructions.
3. What data we collect and why
If you subscribe to our newsletter, we collect your email address (and your name, if you choose to provide it). We use MailerLite, an email marketing service operated by MailerLite, UAB (Lithuania), to manage our subscriber list and send our emails.
- Purpose: sending you our newsletter and occasional campaign updates.
- Lawful basis: your consent. You can withdraw it at any time using the unsubscribe link in every email, or by contacting us.
- Storage: your subscription data is stored by MailerLite on servers located within the European Union.
- Double opt-in: subscriptions are confirmed through a double opt-in process, so we hold a record of when and how you consented.
You may unsubscribe at any time. When you do, your email address is removed from the list.
If you make a donation through this website, the donation form is provided by Donorbox. Payment card details are collected and processed directly by our payment processor (Stripe and/or PayPal) and do not pass through Donorbox’s or our systems.
- Data we receive: your name, email address, donation amount, and (if you provide it) your country or postal address for receipt purposes. We do not see or store your full card details.
- Purpose: processing and receipting your donation, thanking you, and — where required — meeting accounting and legal obligations.
- Lawful basis: legal obligation (for financial records) and legitimate interests (administering and thanking our donors). Gift Aid declarations, where applicable, are collected under legal obligation.
- Storage: donation records are stored with Donorbox, which is based in the United States. See section 5 on international transfers.
If you make a one-off anonymous donation and provide no personal data, we hold no personal data about you.
3.3 Contacting us
If you contact us by email or through our workshops contact form, we collect your name, email address and the contents of your message.
- Purpose: responding to your enquiry.
- Lawful basis: legitimate interests (replying to people who contact us) or, where you are asking us to take an action on your data, that request itself.
- Retention: we keep correspondence for as long as needed to deal with your enquiry and for a reasonable period afterwards.
4. Lawful bases — summary
| Purpose | Lawful basis |
| Sending the newsletter | Consent |
| Processing donations | Legal obligation / legitimate interests |
| Responding to enquiries | Legitimate interests |
| Keeping financial and Gift Aid records | Legal obligation |
5. International data transfers
Most of the services we use store data within the UK or the European Economic Area:
- GreenNet (website hosting): UK-based.
- MailerLite (newsletter): based in Lithuania; data stored in EU data centres.
One service involves a transfer outside the UK/EEA:
- Donorbox (donations): based in the United States. Where personal data is transferred to Donorbox, it is protected by appropriate safeguards under Chapter V of the GDPR — the EU Standard Contractual Clauses and, for transfers out of the UK, the UK International Data Transfer Addendum — together with Donorbox’s Data Processing Agreement, which we have signed.
We do not sell, rent or trade your personal data with third parties for their own marketing purposes.
6. Data processors we use
We only share personal data with service providers who process it on our behalf:
- GreenNet Ltd — website hosting
- MailerLite, UAB — newsletter management
- Donorbox, Inc. — donation forms and donor records
- Stripe and/or PayPal — payment processing (they act as independent controllers of payment data they collect under their own privacy policies)
7. How long we keep your data
- Newsletter subscriptions: until you unsubscribe or your address bounces permanently.
- Donation records and receipts: for the period required by tax and accounting law (typically [six/seven] years after the financial year of the donation).
- Enquiries and correspondence: up to two years after the enquiry is closed.
- Consent records (double opt-in): for as long as you remain subscribed, and for three years afterwards so we can demonstrate consent.
8. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate data;
- Erase your data (“right to be forgotten”), where the law allows;
- Restrict or object to processing, including objecting to processing based on legitimate interests;
- Withdraw consent at any time (for example, unsubscribing from the newsletter), without affecting the lawfulness of processing already carried out;
- Data portability — receive your data in a structured, commonly used format;
- Not be subject to decisions based solely on automated processing, including profiling. We do not carry out automated decision-making or profiling.
To exercise any of these rights, contact us at hello@europemustact.org. We will respond within one month.
If you are unhappy with how we handle your data, you may complain to your national data protection authority. In the UK this is the Information Commissioner’s Office: ico.org.uk.
9. Security
We apply appropriate technical and organisational measures to protect personal data, including HTTPS encryption on this website, access controls, and limiting access to personal data to those who need it. No method of transmission over the internet is completely secure, but we review our safeguards regularly.
10. Children
This website is not directed at children, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. The current version will always be published on this page, with the effective date shown above. Where changes are significant, we will notify newsletter subscribers by email.
12. Contact
Questions about this policy or about how we handle your data can be sent to: Europe Must Act (operating under ForRefugees, Registered UK Charity No. 1168435) Email: hello@europemustact.org Address: 13A Radcliffe Road, Croydon CR0 5QG, United Kingdom