Privacy
What we collect, and what we refuse to.
This covers this website and the application programme. The platform itself has its own policy, linked at the bottom.
The short version
We collect the nine fields on the application form and nothing else. We do not use analytics or tracking cookies on this site. We never collect data about students or anyone under 18. We do not sell or share anything with advertisers.
Who is responsible
irabu.org is an access programme operated by Irabu. The separate legal entity for the nonprofit arm is in formation, so today Irabu is the controller of any personal data described here. When the entity is registered, this page will name it and say what transferred.
Data protection contact: privacy@irabu.org.
What we collect
When you apply
Nine fields, all about you in your professional capacity:
- Organisation name, type and country of registration
- A link showing the organisation is registered
- An estimate of how many staff would use the platform
- Your name, your role and your work email address
- Optionally, a short note about what you would use the platform for
Lawful basis: legitimate interests — we cannot assess an application without knowing who is applying. Where local law requires consent instead, submitting the form is that consent.
When you register interest in giving
One email address, used once, to tell you when donations open. That is consent-based and you can ask us to delete it at any time by replying or emailing the address above.
What we never collect
- Data about students, pupils or children. Not on the form, not during the programme. If you send it to us by mistake, we delete it and tell you we have.
- Data about anyone under 18.This site and this programme are for staff of institutions. If processing children’s data ever became necessary, it would need proper legal groundwork under FERPA, COPPA and UK/EU GDPR first — it is not a setting we would quietly switch on.
- Demographic data about the people your organisation serves. It would not change our decision, so we do not ask.
- Special category data — health, religion, ethnicity, political opinion, sexual orientation, biometrics.
Cookies and analytics
This site sets no analytics cookies, no advertising cookies and no third-party trackers. There is no cookie banner because there is nothing to consent to. If that ever changes we will ask first, and the default will be off.
Our host, Vercel, keeps standard server logs — IP address, user agent, requested URL — for operational and security purposes. We do not use those logs to build a profile of you.
Fonts and third-party requests
Typefaces are served from this domain, not from a font CDN, so loading a page does not tell anyone else that you visited.
Who sees your data
The people assessing your application, and our hosting and email providers acting on our instructions. We do not sell personal data, we do not share it with advertisers, and we do not pass applicant details to the commercial sales side of the business.
Data may be processed outside your country by those providers. Where that involves a transfer out of the UK or EEA, it relies on standard contractual clauses or an adequacy decision.
How long we keep it
- Successful applications: for as long as the organisation is on the programme, plus two years, so we can answer questions about a decision.
- Declined applications: two years, so that if you reapply we can see what we said last time and why.
- Giving-interest emails: until we send the one message, or until you ask us to delete it — whichever is sooner.
Your rights
Depending on where you live, you can ask us for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, or object to it. You can also complain to your national data protection regulator.
Email privacy@irabu.org. We do not charge, and we do not require a particular form of words.
Security
Everything is served over TLS. Access to application data is limited to the people who need it. We have not completed a SOC 2 audit — that is true of the platform and of this programme, and we will not say otherwise until it is done.
The platform is separate
Once your organisation is on the programme, what happens inside your workspace is governed by the platform’s own privacy policy and terms at https://getirabu.com/privacy. In that relationship your organisation is the controller of its own content and we are the processor.
Changes
If we change this policy in a way that affects you, we will date the change at the top and, where it is material, email applicants and recipients directly rather than relying on you to re-read the page.
Related: Terms · Transparency · Contact