Privacy Policy
Effective date: 1 September 2026
How the Alliance for Police Accountability collects, uses, shares and protects personal information.
This Privacy Policy explains how Alliance for Police Accountability ("APA", "we", "us" or "our") handles personal information when you use this website, contact us or make a donation.
For the processing described here, Alliance for Police Accountability is the data controller. You can contact us at info@theapa.uk.
1. Scope of this policy
This policy applies to personal information handled through this website, including the contact form and the one-off donation journey. It does not govern third-party websites that we link to or services that apply their own privacy notices.
This website is intended for a UK audience. We handle personal information in accordance with applicable UK data protection law, including the UK GDPR and the Data Protection Act 2018.
2. Personal information we collect
When you browse the website
Our hosting and security providers may process technical information such as your IP address, approximate location derived from it, browser and device information, requested pages, timestamps, referring page, response information and errors. This information is used to deliver, secure and diagnose the website.
When you contact us
We collect the name, email address, subject and message that you submit, together with subsequent correspondence and any information you choose to include in it.
When you donate
We process the amount you select and technical identifiers needed to create and verify a Stripe Checkout Session. Stripe collects payment information directly on its hosted Checkout page, including your email address, payment credentials, billing information and information used for authentication, security and fraud prevention.
We may receive or access transaction information from Stripe, such as the donation amount, date, status, donor email, payment method type and limited card details such as the brand and last four digits. We do not receive or store your full card number or card security code on this website.
Information from service providers
We may receive payment confirmations, refund or dispute information, delivery records, security signals and related account information from Stripe and the organisations involved in processing a payment.
Sensitive information
Because our work concerns race equality, policing and lived experience, a message you send may contain information that receives additional legal protection, such as information about racial or ethnic origin, political opinions, health or personal experiences. Please include sensitive information only where it is relevant and necessary.
We do not ask for special-category information through the general contact or donation forms. If you choose to provide it, we will restrict access and retain or use it only where this is necessary and a valid legal condition applies, such as explicit consent or the establishment, exercise or defence of legal claims. Otherwise, we will delete it or avoid further use where reasonably possible.
3. How and why we use personal information
Operating and securing the website
We use technical information to provide the website, prevent abuse, investigate errors and protect our systems. Our lawful basis is our legitimate interest in operating a safe, reliable public-interest website.
Responding to enquiries
We use contact-form information to understand and respond to your enquiry, keep an appropriate record and take steps you request before entering into an arrangement. Our lawful bases are our legitimate interests in communicating about APA's work and, where relevant, taking steps at your request before a contract or partnership.
Administering donations
We use donation and transaction information to create Checkout Sessions, confirm payments, issue or support receipts and refunds, prevent fraud, reconcile income, maintain financial records and respond to payment questions. Our lawful bases are our legitimate interests in receiving and administering donations and our legal obligations relating to finance, accounting, fraud prevention and regulatory compliance.
Legal obligations and claims
We may use information where necessary to comply with law, respond to regulators or lawful requests, protect people's rights and safety, and establish, exercise or defend legal claims.
Consent
Where we specifically ask for consent, you may withdraw it at any time. We do not currently use contact or donation details for general marketing merely because somebody contacted us or donated. If optional marketing or non-essential cookies are introduced, we will provide the required choices and update this policy.
4. Information you need to provide
You choose whether to contact us or donate. The contact form requires the marked fields so we can receive and respond to the message. Stripe requires certain identity, contact and payment information to process a donation and meet payment-security and legal requirements. If required information is not provided, we may be unable to respond or complete the donation.
5. Who we share information with
We share personal information only where necessary for the purposes described in this policy. Recipients may include:
Stripe and the banks, card networks, wallet providers and fraud-prevention services involved in a donation;
Resend, which transmits contact-form emails to APA;
Vercel and other infrastructure providers that host, deliver, protect or diagnose the website;
authorised APA personnel and organisations providing APA with operational, financial, legal, audit or professional support;
regulators, courts, law-enforcement bodies or other parties where disclosure is required or permitted by law; and
a successor organisation if APA changes legal form or transfers its operations, subject to appropriate notice and safeguards.
We do not sell personal information. Payment providers may also process information for their own fraud prevention, security and legal obligations under their own privacy notices.
6. International transfers
Some service providers or their subprocessors may process personal information outside the United Kingdom. Where UK transfer rules apply, we will use an available lawful mechanism, such as UK adequacy regulations or appropriate contractual safeguards, and take proportionate steps intended to protect the information.
You can contact us for further information about the safeguards relevant to your information.
7. How long we keep information
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and dispute-resolution needs. Our current retention approach is:
contact enquiries are normally kept for up to 24 months after the enquiry is closed, unless an ongoing relationship, safeguarding concern, complaint or legal issue requires longer retention;
successful donation and accounting records are normally kept for six years after the end of the relevant financial year, or longer where law, audit, a dispute or regulatory requirements make that necessary;
the website does not maintain its own donor database, although Stripe retains payment information under its own terms and retention requirements; and
technical and security records are kept according to operational need and provider configuration, then deleted or anonymised when no longer required.
8. Security
We use proportionate technical and organisational measures intended to protect personal information. Payment credentials are entered on Stripe's hosted Checkout page rather than being collected by this website. Access to administrative systems should be limited to authorised people and protected with appropriate account controls.
No online service can guarantee absolute security. If you believe information connected with this website has been compromised, contact us promptly.
9. Cookies and similar technologies
At the effective date of this policy, this website does not intentionally use non-essential analytics or advertising cookies. Hosting and security systems may process request information needed to provide and protect the service.
Stripe may use cookies and similar technologies on its hosted Checkout page for payment, authentication, fraud prevention and service operation under Stripe's own notices. If we introduce non-essential cookies on this website, we will provide appropriate information and consent controls before using them where required.
10. Your data protection rights
Depending on the circumstances, UK data protection law may give you rights to request access to your personal information, correct inaccurate information, request erasure or restriction, object to processing, and receive certain information in a portable format. Where processing relies on consent, you may withdraw that consent without affecting earlier lawful processing.
These rights are not absolute, and we may need to verify your identity. To exercise a right, email us with enough information to understand and locate the relevant records. You also have the right to complain to the Information Commissioner's Office, although we encourage you to contact us first so we can try to resolve the concern.
11. Automated decisions and fraud prevention
APA does not use information collected by this website to make solely automated decisions that produce legal or similarly significant effects about you. Stripe and other payment participants may use automated systems to authenticate payments, assess fraud and decide whether to accept or decline a transaction. Their privacy notices explain those activities and any rights available in relation to them.
12. Children
The website provides public information and is not designed to collect personal information from children without an appropriate reason. A person making a donation should be at least 18 or have the permission and lawful authority of the payment-method holder. If you believe a child has submitted personal information inappropriately, contact us.
13. Changes to this policy
We may update this policy when our organisation, website, services or legal obligations change. We will publish the updated version here and change the effective date. Where a change materially affects how we use existing information, we will take additional steps to notify people where required.
14. Contact us
For privacy questions, rights requests or concerns, email info@theapa.uk. Please do not send full payment-card details by email or through the contact form.