Privacy Policy

1. Who we are

Give Time (“we”, “us”, “our”) provides volunteer management software to UK museums and cultural organisations. Give Time is a trading name of B & D Studios Ltd, a company registered in England and Wales (company no. 17370321), registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. In data-protection terms:

• For volunteer data managed on behalf of a museum, Give Time acts as a data processor— we process that data strictly under the museum's instructions.
• The museum or organisation you volunteer with is the data controller for that data — they determine why and how your personal data is used.
• Give Time also acts as a data controller in its own right for a small amount of data: error/diagnostic telemetry (processed on our behalf by Sentry, see the table below), product-usage analytics (which pages and features are used, and whether an outreach email led to a visit — processed by PostHog, see the table below), email delivery-status records with no owning organisation (technical delivery metadata only, not message content), and our own account, billing, and business contact records.

For that controller-role data, our lawful basis is legitimate interest (Article 6(1)(f) UK GDPR) — operating and monitoring the platform, and maintaining our own business records. It is retained no longer than necessary for those purposes (see the retention table in section 5) and you have the same rights over it as set out in section 6.

2. Data we collect

We collect the minimum data necessary to operate the service:

• Identity: your full name and email address
• Volunteering activity: shift bookings, cancellations, and swap requests
• Notifications: in-app notification records and your notification preferences
• Push tokens: device push-notification tokens (if you enable push notifications)
• Cookies: a single session cookie to keep you signed in (see section 7)
• Consent record: timestamp of when you agreed to these terms on application
• DBS clearance (optional): for organisations using our optional DBS tracking feature, the clearance date and expiry date of your Disclosure and Barring Service (DBS) check — we do not store your DBS certificate number or the contents of any certificate

3. Lawful basis for processing

• Legitimate interest (Article 6(1)(f) UK GDPR) — operating the volunteering platform, preventing fraud, and ensuring service security. We have conducted a legitimate-interest assessment balancing our interests against your rights.
• Consent (Article 6(1)(a) UK GDPR) — for push notifications. You may withdraw consent at any time in your profile settings.
• Legitimate interest— when your account is deactivated by an administrator, we process the deactivation notification (including the administrator's name and the list of affected shifts) to inform you of changes to your volunteering status.
• Your DBS check's clearance and expiry dates are processed strictly on the instruction of the museum or organisation you volunteer with, where they choose to use this optional feature. As this is criminal-offence data under Article 10 UK GDPR, that organisation is responsible for ensuring it has an appropriate condition under Schedule 1 to the Data Protection Act 2018 to use them.

4. Sub-processors

We use the following third-party sub-processors to deliver the service:

5. Data retention

When an account is deactivated, all future shift assignments are automatically cancelled and the volunteer is notified by email. The notification includes the volunteer's name, affected shift details, and the deactivating administrator's name. Historical shift records are retained per the schedule above. You may request a full data export or deletion at any time by contacting us at hello@give-time.org.

6. Your rights

Under UK GDPR you have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data (“right to be forgotten”)
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interest

You can download your data directly from your profile page using the “Download my data” feature. To exercise any other right, contact us at hello@give-time.org. We will respond within 30 days.

You may also lodge a complaint with the Information Commissioner's Office (ICO).

7. Cookies

We use a single, strictly necessary session cookie to keep you signed in. This cookie is deleted when you sign out or close your browser. We do not use any tracking cookies, analytics cookies, or third-party advertising cookies.

8. Changes to this policy

We may update this privacy policy from time to time. We will notify you of material changes by email or by posting a notice in the app. The “Last updated” date at the top of this page reflects the most recent revision. Continued use of Give Time after changes take effect constitutes acceptance of the updated policy.