Privacy Policy

This policy explains how The French Kids LP handles personal data on adforgood.com, on Proof Pages and in the Proof of Cause services.

1. Who we are and what this policy covers

Ad For Good®, Proof of Cause and all associated websites and services are owned and operated by The French Kids LP, a limited partnership registered in Scotland with registration number SL037848, having its registered office at 5 South Charlotte Street, Edinburgh, EH2 4AN, Scotland, United Kingdom. In this policy, "Company", "We", "Us" or "Our" refer to The French Kids LP. We are the controller of the personal data described in this policy, except where section 5 says otherwise.

This policy covers: visitors to adforgood.com and its subdomains; people who read a Proof Page; people who contact us, subscribe to our newsletter or fill in a form; the staff of customers, partners and nonprofits who use the Proof of Cause services; and people whose names appear in the evidence supplied for a Proof Page. It does not cover the websites of customers, partners or nonprofits that we link to.

Which law applies

We are established in the United Kingdom, so the UK General Data Protection Regulation and the Data Protection Act 2018 apply to everything we do. Because we offer our services to organisations in the European Union and publish Proof Pages read by people in the EU, the EU General Data Protection Regulation (Regulation (EU) 2016/679) also applies to that processing. Where the two differ, we apply the rule that gives you the stronger protection.

Where required by Article 27 of the EU GDPR, we appoint a representative in the European Union. Our representative is Shaï Douillet, based in Lisbon, Portugal, reachable at doers@adforgood.com.

How to contact us about your data

Email: doers@adforgood.com (for anything in this policy) or to report an error on a Proof Page. Post: The French Kids LP, 5 South Charlotte Street, Edinburgh, EH2 4AN, United Kingdom. We have not appointed a Data Protection Officer because the law does not require one for our activities; the person responsible for data protection can be reached at the email above.

2. The personal data we collect

We collect only what each situation needs. We do not collect special-category data (health, religion, political opinions and similar) and we ask you not to send it to us.

If you visit the website or read a Proof Page. Technical data sent by your browser: IP address, browser and device type, pages visited, date and time, and the page that referred you. Cookies and analytics are described in section 8.

If you contact us, subscribe to the newsletter or fill in a form. Your name, email address, role, organisation, website, the reason for your message and its content, and, for the newsletter, whether you opened or clicked our emails. For the "Prove a campaign" form we also collect the campaign details you enter (claim wording, calculation method, nonprofit, dates, channels), which are business information but may contain your name as contact.

If you work for a customer or partner. The name, professional email, telephone number, role and organisation of the people who place orders, upload evidence, approve invoices or act as our contact; billing details; the evidence files uploaded for a Proof Page, which may contain the names and signatures of the people who signed a donation agreement or issued a transfer order; and our correspondence.

If you work for a nonprofit. The name, professional email and role of the contact we send confirmation links to; the identity of the person who uses the confirmation link; the receipt or attestation the nonprofit attaches, which may bear a signatory's name; and the nonprofit's public registration details (RNA, SIREN, charity number), which relate to the organisation rather than to a person.

If you are named in evidence without being our contact. A donation agreement, a transfer order or a receipt may bear the name, title and signature of a director, treasurer or accountant. We hold that document as evidence; we do not publish it (see section 4) and we do not contact you unless the law requires it.

If you are an independent accountant issuing an attestation. Your name, firm, professional registration and contact details, and the attestation you issue, which is published on the Proof Page with your firm's name.

Where the data comes from. Directly from you or your organisation; from the customer or partner that names your organisation in a claim; from public registers of companies and nonprofits; and, for technical data, from your browser.

If you do not provide data. Contact details of at least one person per customer, partner and nonprofit are needed to run the service. Without them we cannot open a Proof Page or record a confirmation. Everything else is optional.

3. Why we use your data and on what legal basis

Each use rests on one of the bases allowed by Article 6 of the UK GDPR and the EU GDPR. Where we rely on legitimate interests, you can object under section 7.

We do not use personal data for automated decisions with legal or similarly significant effects, and we do not sell personal data.

Back to top

4. Proof Pages: what is public and what is not

Proof Pages exist to let anyone check a claim made in advertising. We designed them to publish facts about organisations, not about people.

Published on a Proof Page: the claim as worded in the advertisement; the calculation method, caps and period; the amount stated and the amount confirmed; the customer's legal name and company registration number; the nonprofit's legal name, registration number and status; the dates of transfer and of confirmation; the level reached; the type, date and cryptographic hash of each piece of evidence; at Level 3, the name of the accountant's firm; and a dated history of changes, reports and reviews.

Not published: the evidence files themselves; the names, signatures, email addresses or telephone numbers of the individuals who signed documents, uploaded evidence or confirmed receipt; bank details; and the content of any report of an error. The history shows that a confirmation or a report was made and when, never by whom.

If a personal name is unavoidable. Some advertisers are sole traders or partnerships whose legal name is a person's name, and some accountants practise under their own name. In those cases the name is published because it is the legal identity of the organisation or firm that made the claim or issued the attestation. Our legal basis is our legitimate interest, and the public interest, in a transparent record of advertising claims, which we have balanced against the limited intrusion of publishing a name that already appears in a public register. You may object under section 7; where we agree, we replace the name with the registration number.

How long a Proof Page stays online. At least five years from the end of the campaign or the last confirmation, whichever is later. This period matches the time during which a claim can be challenged under consumer law and during which the customer and the nonprofit may need the record. Requests to remove a Proof Page earlier are handled under section 18 of our Terms & Conditions; personal data on a page is removed or replaced earlier where your rights under section 7 require it.

Search engines. Proof Pages are indexable, because being findable is part of being verifiable. We do not submit personal names to search engines and we use no markup that highlights individuals.

Back to top

5. Who we share data with

The other parties to a Proof Page. Evidence and confirmations are shared between the customer, the partner that placed the order, and the nonprofit concerned, each of which is an independent controller of the data it supplies and receives. The accountant engaged for a Level 3 attestation receives the evidence needed for that attestation and is bound by professional secrecy.

Service providers acting on our instructions (processors). We use a small number of providers, each under a written contract that limits what they may do with the data:

We will keep this table up to date.

Professional advisers and authorities. Our lawyers, accountants and insurers, under confidentiality; and courts, regulators, consumer-protection or advertising authorities where the law requires it or where a Proof Page is the subject of a complaint or investigation.

A successor operator. If the Proof of Cause services are transferred to another operator, the data needed to keep Proof Pages online for their retention period will be transferred with them, and this policy will continue to apply until replaced.

We do not sell personal data, share it with data brokers or use it for third-party advertising.

International transfers

We are based in the United Kingdom. Our providers may process data in the European Economic Area, the United Kingdom or the United States. Transfers from the UK to the EEA are covered by the UK adequacy regulations, and transfers from the EEA to the UK by the European Commission's adequacy decision for the United Kingdom. Where a provider processes data in the United States or another country without an adequacy decision, we rely on the UK International Data Transfer Agreement or Addendum and the EU Standard Contractual Clauses, or on the provider's certification under the UK Extension to the EU-US Data Privacy Framework. You can ask us for a copy of the safeguards in place.

Back to top

6. How long we keep data

When a retention period ends we delete the data or anonymise it so that it no longer identifies anyone. Backups are overwritten on a rolling basis within 90 days of deletion.

Back to top

7. Your rights

Under the UK GDPR and the EU GDPR you have the right to:

• Access the personal data we hold about you and receive a copy.
• Rectification of inaccurate or incomplete data.
• Erasure in the cases the law provides, for example where the data is no longer needed or where you withdraw consent. We may keep data we need to comply with a legal obligation, to keep a Proof Page accurate for its retention period, or to establish, exercise or defend legal claims; where that applies we will tell you.
• Restriction of processing while a dispute about accuracy or lawfulness is resolved.
• Objection to processing based on legitimate interests, including the publication of a personal name on a Proof Page (section 4). We will stop unless we can show compelling legitimate grounds that override your interests. You can object to direct marketing at any time and we will stop immediately.
• Portability of the data you gave us under a contract or with your consent, in a machine-readable format.
• Withdraw consent at any time where we rely on it (newsletter, non-essential cookies), without affecting processing carried out before withdrawal.

How to exercise them. Write to doers@adforgood.com with your name, the organisation concerned if any, and what you are asking for. We may ask you to confirm your identity. We respond within one month; for complex requests we may extend this by two further months and will tell you why. Exercising your rights is free, unless a request is manifestly unfounded or excessive.

What we cannot do. We cannot remove a Proof Page or change its facts at an individual's request when the data on it concerns an organisation and not a person. Requests about the content of a Proof Page are handled under section 19 of our Terms & Conditions.

Complaints. If you are unhappy with how we handle your data, we would like to hear from you first. You also have the right to complain to a supervisory authority: in the United Kingdom, the Information Commissioner's Office (ico.org.uk, telephone 0303 123 1113); in France, the Commission nationale de l'informatique et des libertés (cnil.fr); or the authority of the EU country where you live or work.

Back to top

8. Cookies and analytics

We keep cookies to the minimum. A Proof Page must be readable by anyone, including people who refuse all cookies, so no cookie is required to read one.

We do not use advertising or social-media tracking cookies. Embedded content from third parties (for example a video) may set its own cookies; where we embed such content we load it only after you click on it.

You can change your choice at any time through the "Cookies" link in the footer, and through your browser settings. Refusing non-essential cookies does not limit access to any part of the website.

Under the Privacy and Electronic Communications Regulations 2003 (UK) and the ePrivacy rules as applied in France, we ask for consent before placing any non-essential cookie.

Back to top

9. Security, children and changes

Security. Evidence files and confirmation records are stored with access restricted to the people who need them, encrypted in transit and at rest by our providers, and protected by a cryptographic hash that lets us detect any alteration. Confirmation links are unique, single-use for each contribution and expire after 30 days. Access to our systems requires individual accounts with two-factor authentication. If a breach affects your data and is likely to result in a high risk to you, we will tell you without undue delay and notify the ICO and, where applicable, the competent EU authority within 72 hours as the law requires.

Children. Our services are for organisations. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy. We may update this policy to reflect changes in our services, our providers or the law. The date at the top shows the current version. For material changes we will post a notice on the website and, for customers, partners and nonprofits with an active Proof Page, send an email to their contact address at least 30 days before the change takes effect. Earlier versions are available on request.

Back to top