Connected AF Privacy Policy

1.Who We Are

Connected AF is operated by:

For questions about this Privacy Policy or how we use personal information, please contact:

Email: [email protected]

Where we determine why and how personal information is processed, we act as the data controller.

Where we process personal information on behalf of an organisation using Connected AF, we generally act as a data processor, while that organisation remains the data controller.

2.What Is Connected AF?

Connected AF is a two-way messaging platform that enables organisations to communicate with their supporters and other contacts through SMS, RCS and WhatsApp.

Depending on the services being used, Connected AF may enable organisations to:

• send and receive messages;
• manage individual conversations;
• send messages at scale;
• create automated messaging journeys;
• manage communications across campaigns;
• connect information from fundraising and other third-party systems; and
• use AI-assisted tools to help users respond to messages.

3.Information We Collect

The information we collect depends on how you interact with Connected AF.

Customer and Account Information

If you create an account, purchase Connected AF, request a demonstration or otherwise enquire about our services, we may collect:

• your name;
• job title;
• organisation;
• business email address;
• telephone number;
• account and login information;
• billing and subscription information;
• communications with us;
• product preferences; and
• information relating to your use of Connected AF.

Website Information

When you visit our website, we may collect information including:

• IP address;
• browser and device information;
• pages visited;
• referral source;
• website interactions; and
• cookie information where applicable.

Supporter and Messaging Information

Organisations using Connected AF may upload, integrate or otherwise provide personal information about their supporters or other contacts.

Depending on how an organisation uses Connected AF, this may include:

• name;
• mobile telephone number;
• campaign or event information;
• fundraising information;
• registration information;
• communication preferences and consent records;
• SMS, RCS and WhatsApp message content;
• conversation history;
• delivery, read and engagement information where available;
• tags or categories applied by the organisation; and
• other information the organisation chooses to process through Connected AF.

In these circumstances, the organisation using Connected AF will generally be the data controller and Connected AF will process the information on its behalf.

4.How We Use Personal Information

Where Connected AF acts as the data controller, we may use personal information to:

• create and manage customer accounts;
• provide Connected AF and its services;
• process subscriptions and payments;
• respond to enquiries and provide customer support;
• communicate important service information;
• manage our relationships with customers;
• improve our products and services;
• understand how Connected AF is used;
• maintain the security and integrity of our systems;
• prevent fraud and misuse;
• meet legal and regulatory obligations; and
• send marketing communications where permitted.

We will only process personal information where we have an appropriate lawful basis for doing so.

Depending on the circumstances, this may include processing necessary to perform a contract, comply with a legal obligation, pursue our legitimate interests or where consent has been provided.

5.Information We Process for Our Customers

Organisations using Connected AF may use the platform to communicate with supporters and other contacts.

Where Connected AF processes this information on the organisation's instructions, the organisation is responsible for deciding why the information is being used, establishing the appropriate lawful basis and providing relevant privacy information to individuals.

Connected AF will process this information in accordance with the customer's instructions, our agreement with that customer and applicable law.

A separate Data Processing Agreement will set out the respective responsibilities of Connected AF and each customer when we process personal information on their behalf.

If you receive a message through Connected AF from an organisation and have a question about how that organisation uses your information, you should normally contact the organisation directly.

6.SMS, RCS and WhatsApp Communications

Connected AF enables organisations to communicate with individuals using SMS, RCS and WhatsApp.

The organisation sending the communication is responsible for ensuring that its use of these channels complies with applicable privacy, data protection and electronic communications laws and that it has an appropriate lawful basis or permission for the communication where required.

Connected AF may process information necessary to send, receive and manage these communications on behalf of its customers.

This may include:

• telephone numbers;
• message content;
• sender and recipient information;
• delivery information;
• timestamps;
• read or engagement information where supported by the relevant channel;
• opt-out information; and
• conversation history.

Where applicable, Connected AF may process opt-out and communication preference information on behalf of customers to help ensure those preferences are respected.

When an organisation connects its WhatsApp Business Account to Connected AF through Meta’s signup process, we receive and store the identifiers for that account and its phone numbers, and the business profile details needed to send and receive WhatsApp messages on the organisation’s behalf. We use this information only to provide messaging services to that organisation. The organisation can disconnect its account at any time, and can ask us to delete this information by contacting [email protected].

Customers remain responsible for determining which communications should be sent and to whom.

7.AI-Assisted Features

Connected AF may provide AI-assisted tools designed to help users respond to incoming messages.

For example, when a supporter sends a message, relevant message content and conversation context may be processed using technology provided by OpenAI to generate a suggested response.

The AI acts as a co-pilot rather than an autonomous responder.

The Connected AF user remains in control and may:

• use the suggested response;
• edit it before sending;
• disregard it; or
• write their own response.

AI-generated suggestions are not automatically sent to supporters.

Connected AF does not intend these features to make solely automated decisions about individuals that have legal or similarly significant effects.

We will maintain appropriate contractual and data protection arrangements with AI providers used to provide these services.

8.Our Technology Providers

We use third-party technology providers to operate and deliver Connected AF.

These include:

• Amazon Web Services (AWS) - cloud infrastructure and hosting;
• Twilio - messaging and communications infrastructure;
• Meta - WhatsApp and related messaging services; and
• OpenAI - AI-assisted functionality.

We may also use other suppliers where necessary to provide areas such as payment processing, security, authentication, customer support and other technical services.

Where suppliers process personal information on our behalf, we require appropriate contractual and data protection safeguards.

We may also disclose information where required by law, regulation or court order, or where reasonably necessary to establish, exercise or defend our legal rights.

9.Data Location and International Transfers

Connected AF's primary platform infrastructure and data storage are hosted in the United Kingdom.

Some of the third-party services required to provide Connected AF, including messaging and AI services, may process or transfer personal information outside the United Kingdom.

Where personal information is transferred internationally, we will ensure that appropriate safeguards are in place in accordance with UK data protection law.

Depending on the destination and circumstances, these may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved Standard Contractual Clauses, or other legally recognised safeguards.

Further information about relevant sub-processors and international transfers may be made available through our Data Processing Agreement or sub-processor information.

10.How Long We Keep Information

Organisations using Connected AF can manage how long supporter and messaging information is retained within their account while they have an active subscription. As the data controller, the organisation is responsible for determining an appropriate retention period and ensuring personal information is not retained for longer than necessary.

Customers can delete supporter records and conversation data from their Connected AF account during their subscription.

At the end of a subscription, customer data will be retained for up to 28 days, allowing time for appropriate account closure and, where applicable, the retrieval of data.

Following this 28-day period, the organisation's customer data will be securely deleted from Connected AF's active systems, subject to any information we are required to retain by law and any limited data that may remain temporarily within secure backups in accordance with our backup and deletion procedures.

Customer account, billing and contractual information may be retained separately for longer where necessary to meet our legal, accounting, regulatory or legitimate business requirements.

To request the deletion of your data, please contact [email protected]

11.Security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, loss or destruction.

Depending on the nature of the processing, these measures may include:

• encryption;
• access controls;
• authentication;
• monitoring and logging;
• backups;
• secure UK-hosted infrastructure;
• vulnerability management; and
• internal security policies and procedures.

No online service can guarantee absolute security, but protecting the information processed through Connected AF is a core part of how the platform is designed and operated.

12.Your Rights

Depending on the circumstances, UK data protection law provides individuals with rights relating to their personal information, including the right to:

• access their personal information;
• correct inaccurate or incomplete information;
• request deletion;
• request restriction of processing;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing relies on consent; and
• raise concerns about how their information is being used.

These rights do not apply in every circumstance.

If your information is being processed through Connected AF on behalf of one of our customers, you should normally contact that organisation first.

Connected AF will assist its customers in responding to valid data protection requests where required.

Where Connected AF is the controller of your information, you can contact us at [email protected].

13.Marketing From Connected AF

Connected AF may send information about our products, services, events and other relevant updates where permitted by law.

You can opt out of marketing communications at any time using the unsubscribe option provided or by contacting us at [email protected].

Opting out of marketing will not prevent us from sending essential communications relating to your account or services.

This section relates to marketing sent by Connected AF itself. Marketing and supporter communications sent by organisations using Connected AF are the responsibility of the organisation sending them.

14.Cookies

Our website and platform may use cookies and similar technologies necessary to provide functionality, maintain security and remember user preferences.

If we introduce non-essential cookies, including analytics or advertising cookies, we will provide appropriate information and obtain consent where required.

Further information may be provided in a separate Cookie Policy.

15.Integrations and Third-Party Services

Connected AF may integrate with third-party fundraising, CRM, messaging and other services.

Where a customer chooses to connect Connected AF with another service, information may be exchanged between the systems as necessary to provide the integration.

Customers are responsible for ensuring that they are authorised to connect those services and instruct Connected AF to process the relevant information.

Third-party organisations may have their own privacy policies and terms governing their services.

16.Children's and Sensitive Information

Messages processed through Connected AF may contain information that is sensitive or personal in nature.

Customers are responsible for considering the nature of the information they choose to process through Connected AF and ensuring that their use of the platform is appropriate and lawful.

Where special category information or information relating to children is processed, additional legal and security requirements may apply.

Connected AF may impose additional restrictions or requirements relating to certain categories of information through its Terms of Service or Data Processing Agreement.

17.Complaints

If you have concerns about how Connected AF uses your personal information, please contact us at:

[email protected]

We would welcome the opportunity to address your concerns.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

18.Changes to This Privacy Policy

We may update this Privacy Policy as Connected AF develops, our services change or legal requirements evolve.

The latest version will be available through our website and the date at the top of the policy will show when it was last updated.

Where we make significant changes to how personal information is used, we will take appropriate steps to bring those changes to the attention of affected individuals.