Privacy Policy
Last updated: 7 July 2026 · WeCan CIC Charity
WeCan CIC is committed to protecting your personal data. This policy explains what we collect, why we collect it, how long we keep it, and your rights under UK GDPR. We keep things simple - we only collect what we genuinely need.
1. What we collect
Account information
When you create an account we collect your name (optional), email address, and a securely hashed password. We never store your password in plain text.
Drop-off activity
When you verify a can drop using our QR scanner we record the location, date and time, estimated can count, and EcoPts awarded to your account.
Location data
If you use the 'Find nearest drop-off' feature we request your device's location solely to calculate distance. We do not store or share precise location data.
Communications
If you contact us via the Community Forum or contact form we retain the messages to enable our team to respond. You can request deletion at any time.
Cookies
We use strictly necessary cookies to keep you logged in. With your consent we also use analytics cookies (no advertising or third-party tracking cookies).
2. Why we collect it
To run the service
Your email and password let you log in securely. Your drop history powers EcoPts and badge rewards.
To safeguard drop-off locations
We authenticate users before releasing exact addresses to prevent misuse of collection points - a key security requirement for WeCan CIC.
To communicate with you
We send transactional emails (reward confirmations, account notices). With your opt-in consent we also send news and event updates.
To improve the service
Aggregate, anonymised usage data helps us understand which features are used and where the experience can improve.
3. How long we keep it
Active accounts
We retain your data for as long as your account is active. You can delete your account at any time from Settings → Privacy & Data.
After deletion
When you delete your account we permanently erase your personal data within 30 days, except where we are required to retain limited records for legal or accounting purposes (e.g. gift aid declarations).
Inactive accounts
Accounts with no activity for 36 months will receive an email asking if you wish to keep your account. If no response is received, the account is deleted after a further 90 days.
Communications
Support messages are retained for 12 months after the conversation is closed, then permanently deleted.
4. Your rights
Right of access
You can request a copy of all personal data we hold about you. Use the 'Download my data' button in Settings → Privacy & Data or email us.
Right to rectification
You can update your name and email at any time from your account settings.
Right to erasure
You can permanently delete your account and all associated personal data from Settings → Privacy & Data.
Right to restrict processing
You can withdraw your marketing email consent at any time from Settings → Privacy & Data or by clicking 'unsubscribe' in any email we send.
Right to portability
Your data export (available via 'Download my data') is provided in machine-readable JSON format.
Right to object
You can object to processing based on legitimate interests. Contact us at the address below.
Complaints
If you believe we have handled your data unlawfully you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.
5. Contact
Data controller
WeCan CIC Charity, Shirley, Solihull, West Midlands. Charity number: TBC.
privacy@wecankick.org - we aim to respond to all data requests within 30 days.
Questions about this policy?
Email us at privacy@wecankick.org and we'll get back to you within 30 days as required by UK GDPR.