Privacy Policy

Last updated: 18/09/2026 ·

This policy applies to flowforthefuture.com, our mailing list, our online store (once launched), and our social media accounts where we direct people to this policy.

Flow for the Future (“we”, “us”, “our”) is a not-for-profit organisation working towards registration as a Charitable Incorporated Organisation (CIO) in England and Wales, founded to fight period poverty and reduce the environmental impact of period products. We take your privacy seriously and are committed to handling your personal data lawfully, fairly and transparently, in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

This policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and the choices and rights you have. It's written to be read by anyone who visits our website, joins our mailing list, buys from us, or whose school or institution places an order with us.

1. Who we are

Data controller: Flow for the Future

Correspondence email: flowforthefuture@btinternet.com
Phone: 07485 035040
Website: flowforthefuture.com
Registered address: 14 Alexandria Crescent, Crossgate Moor, Durham, DH1 4EE, United Kingdom
Charity registration number: (tbc)

Until our CIO registration completes, Flow for the Future operates as an unincorporated pre-charity initiative supported through the Enactus Durham program at Durham University.

2. The data we collect

We collect different data depending on how you interact with us.

2.1 Mailing list subscribers

If you sign up to our mailing list (via our website or in person, e.g. at events), we collect:

Your name
Your email address
The date and method of sign-up, and your marketing consent status

We use this to send updates about our mission, campaigns, product launches and how to get involved. You can unsubscribe at any time - every email includes a one-click unsubscribe link.

2.2 Website visitors & contact forms

If you use a contact form, comment on a blog post, or message us on social media, we collect whatever information you choose to give us - typically your name, email address, and the content of your message. We also automatically collect some technical data via cookies and similar technologies (see Section 5), such as your IP address, browser type, device type, and how you use our site.

2.3 Online store customers

Placing an order will involve us collecting:

Name, delivery address, billing address, email address and phone number
Order details (products, quantities, order value)
Payment information — see the important note below on how this is handled

We do not directly collect, see in full, or store your card number, CVV or full payment card details on our own systems. Payments are processed by Wix Payments and/or other payment providers supported on our Wix store (such as PayPal), which are Payment Card Industry Data Security Standard (PCI DSS) Level 1 certified — the highest tier of card-payment security. Card details you enter are encrypted and tokenised by the payment provider; we only receive confirmation that payment succeeded, the last few digits of the card for your reference, and a payment reference number. This means Wix and the applicable payment provider act as independent data controllers (or processors, depending on the service) for your card data, governed by their own privacy and security policies, which we encourage you to read: Wix's Privacy Policy and Wix Payments' terms, and PayPal's Privacy Policy if you pay by PayPal.

2.4 'Pass on Pads' donations & Gift Aid

If you opt in to donate or 'pass on' pads at checkout and are a UK taxpayer, we may ask for your name, home address and confirmation you wish to Gift Aid your donation. This is required by HMRC in order to claim Gift Aid, and we will only use it for that purpose and for our own donation records.

2.5 Schools, universities and institutional customers

If you order on behalf of a school, university, workplace or other institution, we collect the business contact details you provide (name, job title, institution name, work email, phone number, delivery/billing address) to process and fulfil the order and manage the ongoing relationship.

2.6 Cookies and analytics

Our site, built on Wix, uses cookies and similar technologies for essential site functionality and analytics (to understand how visitors use our site). See Section 5 for details.

2.7 Job or volunteer applicants

If you apply to volunteer with us (including through the Enactus Durham programme), we collect the details you provide in your application (name, contact details, CV/experience, and anything else you choose to share) to assess your application and, if successful, to onboard you.

3. Why we use your data and our legal basis

Under UK GDPR, we must have a valid legal basis for each way we use personal data. Here is a summary:

We will never sell your personal data. We will never use special category data (such as health data) that you might disclose to us - for example, in a message about your own experience of periods - for any purpose beyond responding to you, and only ever with appropriate care and confidentiality.

4. Marketing communications

We will only send you marketing emails (newsletters, campaign updates, fundraising asks) if you have opted in, for example by joining our mailing list or ticking a consent box at checkout. In line with PECR, we do not pre-tick marketing consent boxes. You can withdraw consent at any time by clicking 'unsubscribe' in any email, or by emailing flowforthefuture@btinternet.com. Withdrawing consent won't affect any order or transaction you've already made with us.

5. Cookies

Cookies are small text files placed on your device when you visit our website. We only use:

Essential cookies — required for the site and store to function (e.g. remembering your basket); these can't be switched off.
Functional cookies — remember your preferences (e.g. language).

6. Who we share your data with

We share personal data only where necessary, with:

Wix.com Ltd — our website, e-commerce and mailing list platform, which hosts our site and stores relevant data on our behalf as a data processor (and, for payments, in its own right as described in Section 2.3).
Payment providers (Wix Payments, and PayPal if offered) to process transactions securely.
Our manufacturer and delivery/courier partners - to fulfil and ship orders (only the delivery details needed to get your order to you).
HMRC — where required to claim Gift Aid on eligible donations.
Our trustees, and Enactus Durham/Durham University where relevant to our operations as a student-led venture, under confidentiality expectations.
Professional advisers (e.g. accountants, and lawyers if instructed) where needed for legal, accounting or insurance purposes.
Law enforcement or regulators, where we're required to by law, or to protect the rights, property or safety of Flow for the Future, our customers, or others — including, where applicable, in connection with a safeguarding concern (see Section 8).

We do not sell, rent or trade your personal data to third parties for their own marketing purposes.

7. International data transfers

Because we use Wix, some personal data may be stored or processed outside the UK. Wix may store site-visitor data in data centres in the United States, Ireland, South Korea, Taiwan and Israel. Where personal data is transferred outside the UK/EEA, Wix uses recognised legal safeguards such as the UK's International Data Transfer Addendum and the EU Standard Contractual Clauses, alongside technical and organisational security measures, to protect your data to UK standards. You can read more in Wix's own Privacy Policy.

8. Keeping children and young people safe

Our mission means many of the people who benefit from our work and interact with our website, social media, or in-school distribution are under 18, including students who are minors. We take this seriously:

Free pads distributed via school and university bathrooms do not require any individual student to give us their personal data — the institution orders in bulk, so individual students remain anonymous to us.
We do not use any data belonging to a person we know or reasonably believe to be a child for targeted advertising, profiling, or any purpose beyond responding to a specific request they or their guardian has made.
Where a message, form submission, or interaction raises a safeguarding concern about a child or vulnerable person, we follow our separate Safeguarding Policy, which sets out how such concerns are treated. Our Safeguarding Policy is available on request from flowforthefuture@btinternet.com.

9. How long we keep your data

After these periods, we securely delete or anonymise your data unless we're required to keep it for longer for legal, accounting or regulatory reasons.

10. How we keep your data secure

We use reputable, security-accredited platforms to run our operations. Wix (including Wix Payments) holds ISO 27001 certification and, for payment processing, PCI DSS Level 1 accreditation, and uses encryption both in transit (TLS) and at rest. We limit access to personal data to the trustees and volunteers who need it to do their role, use strong passwords and access controls on our own accounts, and will notify the Information Commissioner's Office and affected individuals of any data breach where the law requires us to.

11. Your rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you
Have inaccurate data corrected
Ask us to delete your data ('the right to be forgotten'), where applicable
Restrict or object to certain processing, including direct marketing at any time
Receive your data in a portable format, where technically feasible
Withdraw consent at any time, where we rely on consent
Complain to the Information Commissioner's Office (ICO) if you're unhappy with how we've handled your data

To exercise any of these rights, email flowforthefuture@btinternet.com. We'll respond within one month. You can also complain directly to the ICO at ico.org.uk or by calling 0303 123 1113 — though we'd always appreciate the chance to put things right first.

12. Automated decision-making

We do not currently use any automated decision-making or profiling that produces legal or similarly significant effects on you.

13. Third-party links

Our site may link to other websites (e.g. articles, funders, or social media). We aren't responsible for the privacy practices of those third-party sites, so we'd encourage you to read their own privacy policies.

14. Changes to this policy

We may update this policy as our organisation grows — for example, once we register as a CIO, or if we start using new tools or payment providers. For significant changes affecting mailing list subscribers, we'll let you know by email.

15. Contact us

If you have any questions about this policy or how we handle your data, please contact:

Email: flowforthefuture@btinternet.com
Phone: 07485 035040
Post: 14 Alexandria Crescent, Crossgate Moor, Durham, DH1 4EE, United Kingdom