Privacy Notice

Who we are

For the personal data described here, MarketImpact Digital Solutions Ltd is the data controller.

What this notice covers

This notice covers the public website at marketimpact.org — the pages you can browse without an account, the contact form, and the mailing list described below.

It does not cover our AidGPT training platform, which has its own privacy policy at aidgpt.org/privacy, or personal data we process under a client contract, where the client is usually the controller and we act as processor under a written agreement.

Personal data we process

• Enquiry data. When you use the contact form we collect your first name, last name, email address, organisation, role, the subject you select, and your message, together with the resulting correspondence.
• Mailing list data. The mailing list is not open yet, so we are not collecting this at the moment. When it opens, subscribing will involve the email address you give us and any name or organisation you choose to supply, plus a record of your subscription and, where our email provider reports it, whether a message was delivered, opened, or clicked.
• Technical data. Our hosting provider and our servers record standard request data such as IP address, user agent, the page requested, and the time of the request, for delivery, reliability, and security purposes.
• Cookie data. Two first-party cookies described in the next section.
• Aggregate usage data. Page-view counts and similar aggregate measures produced by our self-hosted analytics, described below.

We do not ask for special category data through this website, and you should not send it to us through the contact form.

Cookies

marketimpact.org sets two first-party cookies. Both are necessary for the site to work as intended. Neither is used for advertising, ad measurement, profiling, or tracking you across other websites, and neither is shared with an advertising network.

Because both cookies are strictly necessary to deliver the service you asked for, we do not ask for consent to set them. If we ever add a non-essential cookie or a similar technology that requires consent, we will ask for that consent first, make refusing as easy as accepting, and publish a full cookie table before it goes live.

You can delete or block cookies in your browser settings. Blocking the security cookie may stop the contact form from working.

Analytics and performance measurement

We use Umami, an analytics tool we host ourselves on our own server rather than sending data to a third-party analytics company. On this site it is configured so that:

• automatic tracking is switched off and page views are sent explicitly by our code;
• the browser's "do not track" preference is respected (the script is loaded with data-do-not-track set to true);
• query strings and URL fragments are stripped before a page address is recorded, so anything after a ? or # is not stored;
• we do not use the visitor-identification feature, so page views are not tied to you.

We use this to understand which pages are read and to decide what to publish. We do not use it to build a profile of you, and we do not combine it with your enquiry or mailing list record.

Our hosting provider also runs its own aggregate audience and page-performance measurement for sites deployed on its platform. This produces aggregate traffic and load-time figures and is separate from the analytics described above.

Mailing list

We are adding a mailing list to this website. When it is live, it will work as follows.

• Purpose. To send occasional updates about our research, publications, evaluations, and training. That is all it is used for.
• Lawful basis. Your consent, given when you subscribe. You can withdraw it at any time, and withdrawing it does not affect anything we sent before you did.
• Unsubscribing. Every message carries an unsubscribe link. You can also email us and we will remove you.
• Email provider. The mailing list is not open yet. We have not appointed an email service provider, and the signup form on this site does not currently store your address — it tells you the list is unavailable and invites you to email us instead. When the list does open, sending will be handled for us by a provider acting as our processor under a written agreement, and we will name that provider here before the first message goes out.
• No selling or sharing. We do not sell, rent, or trade mailing list addresses, and we do not pass them to third parties for their own marketing.

Why we process it, and on what basis

Who receives personal data

We share personal data only where it is needed for the purposes above: with our hosting, server, database, email, storage, and security providers; with our email service provider for the mailing list; with our professional advisers and auditors; with public authorities where the law requires it; and with a successor organisation if the business is restructured. Each provider acts on our instructions under a written agreement.

We keep a current list of the service providers that process personal data for us. You can ask for a copy at mariejosee@marketimpact.org.

Some of those providers are based outside the European Economic Area, mainly in the United States. Where personal data is transferred outside the EEA we rely on an adequacy decision or on Standard Contractual Clauses, together with the additional safeguards our agreement with the provider requires.

How long we keep it

• Enquiries and the correspondence that follows. Normally up to 3 years after the last meaningful contact, unless a longer period is needed for an active relationship, a dispute, or a legal obligation.
• Mailing list records. The mailing list is not open yet and the signup form on this site does not currently store your address, so there are no mailing list records to keep. When the list opens we will state here, before the first message goes out, how long we keep a record of a subscription after you unsubscribe so that we can show we honoured your request.
• Cookies. As stated in the cookie table above: 90 days for userid and 24 hours for csrf-token.
• Server and security logs. Kept for the shortest practical period, normally up to 12 months, unless a specific record is needed to investigate abuse, fraud, or a security incident.
• Aggregate analytics. The page-view counts described above are not linked to an identified visitor, and we have not set an automatic deletion period for them, so they are kept for as long as we run the analytics service.
• Contracts, invoices, and accounting records arising from work that began with a website enquiry may be kept for up to 7 years, or longer where Cyprus or EU law requires it.

Your rights

Subject to the conditions and limits in data protection law, you can ask us to give you a copy of your personal data, correct it, erase it, restrict how we use it, or provide it in a portable format. You can object to processing we carry out on the basis of legitimate interests, and you can object at any time to direct marketing. Where we rely on your consent, you can withdraw it at any time without affecting processing that already happened.

To exercise any of these, email mariejosee@marketimpact.org or use our contact form. We may need to ask you for enough information to confirm who you are before we act. We will respond within one month, and will tell you if we need longer.

If you are not satisfied with how we have handled your personal data, you have the right to complain to a supervisory authority. In Cyprus this is the Office of the Commissioner for Personal Data Protection. You may also complain to the supervisory authority in the EU country where you live or work.

Automated decisions

We do not use this website to make solely automated decisions that produce legal effects about you or similarly significantly affect you.

Children

This website is aimed at professionals working in the humanitarian and development sector. It is not directed at children, and we do not knowingly collect personal data from them.

Security

We use technical and organisational measures appropriate to the risk, including HTTPS across the site, a content security policy, cross-site request forgery protection on state-changing requests, rate limiting, role-based access control for staff systems, and keeping production credentials out of our source code. No online service can be guaranteed completely secure, and we do not claim otherwise.

Changes to this notice

We will update this notice when our services, our providers, or our legal obligations change. The date at the top of the page shows when it was last revised. Where a change materially affects you, we will do more than change the date — we will say so.