Last Updated: June 2026
GyaanBato Community Interest Company
Effective Date: 21 June 2025 | Version: 1.0 | Last Updated: 21 June 2026
GyaanBato is a Community Interest Company (CIC) incorporated in England and Wales, is a private company Limited by Guarantee.
CIC Registration Number: [17347680]
Registered Office: Suite 10, Capital House, 61 Amhurst Road, London, United Kingdom E8 1LL.
Our commitment: GyaanBato CIC is committed to protecting your privacy. This Policy explains our data practices in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We collect only what we need, use it only for stated purposes, and never sell your data.
1. DATA CONTROLLER IDENTITY
GyaanBato Community Interest Company ("GyaanBato", "we", "us") is the data controller for personal data collected through gyaanbato.com. We are incorporated in England and Wales as a Community Interest Company Limited by Guarantee. CIC Registration Number: [To be inserted]. Registered Office: [To be inserted], England and Wales.
Our designated privacy contact is reachable at: info@gyaanbato.com. We do not currently meet the threshold requiring a mandatory Data Protection Officer, but we have designated a responsible person for all data protection matters who can be reached at the above address.
2. DATA WE COLLECT
2.1 Data You Provide Directly
- Registration data: first name, last name, email address, country of residence, password (stored in encrypted form).
- Payment data: processed entirely by our payment provider (Razorpay or Stripe). We receive a transaction reference and confirmation only — never your full card number, CVV or bank details.
- Newsletter subscription: email address and name (optional).
- Community content: debate posts, comments and any other content you submit to the Platform.
- Correspondence: emails, support requests and any other communications you send us.
- Donor wall submissions: name (or "Anonymous"), amount contributed, optional message and date.
2.2 Data Collected Automatically
- Log data: IP address, browser type and version, operating system, pages visited, time and date of access, referral URL, and session duration.
- Usage data: reports viewed, downloaded or accessed, search queries, features used.
- Device data: device type, screen resolution, language settings.
- Cookies and similar technologies: see Section 8.
2.3 Data from Third Parties
We may receive limited data from payment processors confirming successful transactions. We do not purchase data from data brokers or receive personal data from social media platforms.
3. HOW AND WHY WE USE YOUR DATA (LEGAL BASES)
Delivering purchased or downloaded Reports
Legal basis: Article 6(1)(b) — Performance of contract
Data used: Email, transaction reference
Sending newsletter emails
Legal basis: Article 6(1)(a) — Consent
Data used: Email, name
Processing payments
Legal basis: Article 6(1)(b) — Performance of contract
Data used: Transaction data from payment provider
Responding to support and legal enquiries
Legal basis: Article 6(1)(b) contract; or 6(1)(f) legitimate interests
Data used: Email, name, correspondence
Platform improvement and analytics
Legal basis: Article 6(1)(f) — Legitimate interests (anonymised)
Data used: Usage data, log data (anonymised)
Fraud prevention and platform security
Legal basis: Article 6(1)(f) — Legitimate interests
Data used: IP address, log data, device data
Complying with legal obligations
Legal basis: Article 6(1)(c) — Legal obligation
Data used: As required by applicable law
CIC Community Interest Reporting
Legal basis: Article 6(1)(f) — Legitimate interests (aggregate, anonymised)
Data used: Download counts, subscriber numbers (no personal data)
Communicating material changes to Terms
Legal basis: Article 6(1)(c) legal obligation; or 6(1)(f) legitimate interests
Data used: Email address
CIC Note: As a CIC, we process aggregate anonymised data (total downloads, total subscribers, revenue figures) for our annual Community Interest Report to the CIC Regulator. No personal data of individual users is included in or disclosed via this statutory report.
4. DATA SHARING AND PROCESSORS
We do not sell, rent or trade your personal data. We share data only with trusted processors under written Data Processing Agreements, and only to the extent necessary:
Stripe (UK) Ltd / Razorpay Software Pvt Ltd
Purpose: Payment processing
Safeguard: PCI DSS compliance; separate privacy policy
Email delivery provider (Brevo / Mailgun)
Purpose: Transactional and newsletter emails
Safeguard: Data Processing Agreement; EU/UK adequacy
Google Analytics 4 (Google LLC)
Purpose: Anonymised usage analytics; IP anonymisation enabled
Safeguard: Data Processing Agreement; Standard Contractual Clauses
Hotjar Ltd (if enabled)
Purpose: Session recording and heatmaps (with consent only)
Safeguard: Data Processing Agreement
Web hosting provider
Purpose: Platform infrastructure
Safeguard: Data Processing Agreement; UK/EU hosting
UK regulatory authorities (CIC Regulator, ICO, HMRC)
Purpose: Statutory compliance and reporting
Safeguard: Legal obligation under UK law
Law enforcement / courts
Purpose: Where required by valid legal process
Safeguard: Legal obligation under UK law
5. INTERNATIONAL DATA TRANSFERS
Some of our processors operate outside the UK and EEA. Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including: UK adequacy regulations; Standard Contractual Clauses (SCCs) approved by the ICO; or the UK International Data Transfer Agreement (IDTA). Transfers to the United States rely on the UK-US Data Bridge where applicable or on SCCs.
6. DATA RETENTION
Newsletter subscriber data: Until unsubscribed, plus 30 days
Reason: Contractual / consent
Purchase and transaction records: 7 years from transaction date
Reason: Companies Act 2006; HMRC requirement
Support correspondence: 2 years from last contact
Reason: Legitimate interests (dispute resolution)
Server and access logs: 90 days rolling
Reason: Security and fraud prevention
Analytics data: 26 months (aggregated)
Reason: Legitimate interests (platform improvement)
Account data: Until account deleted, plus 90 days
Reason: Contractual
Debate posts and community content: Until account deleted or content removed
Reason: Legitimate interests
CIC statutory records: Minimum 6 years
Reason: Companies Act 2006 obligation
7. YOUR RIGHTS UNDER UK GDPR
You have the following rights in relation to your personal data. To exercise any right, email privacy@gyaanbato.com. We will respond within one calendar month.
Right of Access (Article 15)
Request a copy of all personal data we hold about you.
Right to Rectification (Article 16)
Request correction of inaccurate or incomplete data.
Right to Erasure (Article 17)
Request deletion of your data ("right to be forgotten"), subject to our legal retention obligations.
Right to Restriction (Article 18)
Request that we pause processing of your data in certain circumstances.
Right to Data Portability (Article 20)
Receive your data in a structured, machine-readable format and transfer it to another provider.
Right to Object (Article 21)
Object to processing based on legitimate interests (including for direct marketing).
Right to Withdraw Consent (Article 7)
Withdraw consent at any time where processing is consent-based (e.g. newsletter). Withdrawal does not affect prior lawful processing.
Rights regarding Automated Decisions (Article 22)
Not to be subject to solely automated decisions that significantly affect you.
If you are dissatisfied with our response to a data rights request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Website: ico.org.uk
Telephone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
8. COOKIES
We use cookies and similar tracking technologies. In summary:
Strictly Necessary (no consent required)
Examples: WordPress session cookies, security nonces, login state
These are essential for the Platform to function and cannot be disabled.
Functional (no consent required)
Examples: gb_currency (remembers your currency choice)
These improve your experience but are not essential.
Analytics (consent required via consent banner)
Examples: Google Analytics 4 (_ga, _gid), Hotjar
These help us understand how the Platform is used. You can refuse these via our cookie consent banner.
Advertising
We do not use advertising or retargeting cookies. None.
You can manage your cookie preferences at any time via the "Cookie Settings" link in the footer of our website. For full details of all cookies, durations and purposes, see our separate Cookie Policy.
9. CHILDREN
The Platform is not directed at children under 13. We do not knowingly collect personal data from children under 13. If we discover that we have inadvertently collected such data, we will delete it promptly. Parents or guardians who believe we may hold data about a child under 13 should contact privacy@gyaanbato.com immediately.
Users aged 13 to 15 may use the Platform with parental or guardian consent. Where consent is required for data processing (e.g. newsletter), we will take reasonable steps to verify that consent is given or authorised by a person with parental responsibility.
10. SECURITY
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or disclosure, including: HTTPS encryption for all data in transit; access controls restricting administrative access; regular security testing; and data minimisation principles. No internet transmission is completely secure, and we cannot guarantee absolute security.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware and will notify affected individuals without undue delay where required.
11. CIC-SPECIFIC DATA PROCESSING
As a Community Interest Company, we are required to file an annual Community Interest Report with the CIC Regulator. This report contains aggregate, anonymised data about our community benefit activities — including total number of reports published, aggregate download figures, and total amounts donated to Causes. No personal data of individual users is included in or disclosed via this statutory report.
Our community interest activities may involve processing data about Cause beneficiaries (partner NGOs and charities). Such processing is governed by separate agreements with those organisations and does not involve Platform user data.
12. CHANGES TO THIS POLICY
We may update this Privacy Policy to reflect changes in our practices, legal requirements or regulatory guidance. Material changes will be notified to Registered Users by email (where held) and by a prominent notice on the Platform for at least 30 days before they take effect. The "Last Updated" date at the top of this Policy reflects the most recent version.
13. CONTACT AND COMPLAINTS
Data rights requests and privacy questions: privacy@gyaanbato.com
Data breach reports (mark URGENT): privacy@gyaanbato.com
General data protection queries: privacy@gyaanbato.com
UK Data Protection Regulator (ICO):
Website: ico.org.uk
Telephone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
---
GyaanBato Community Interest Company | www.gyaanbato.com | Privacy Policy v1.0 | 21 June 2026