About us

Aruuri is operated by Somalis in Tech CIC, a community interest company registered in England and Wales under company number 13202400.

In this policy, “Aruuri”, “we”, “us” and “our” refer to Somalis in Tech CIC when it operates the Aruuri platform. For UK data protection law, Somalis in Tech CIC is the data controller for the personal information described in this policy. This means we decide why and how that information is used.

You can contact us with questions or privacy requests at contact@aruuri.so.

What's covered

This policy applies when you:

• Visit or use aruuri.so
• Create or manage an Aruuri account
• Make or manage a contribution
• Receive communications from us
• Apply to become a project or delivery partner
• Work with us as a partner representative
• Otherwise provide personal information to Aruuri

It also explains how we handle photographs, testimonials and other evidence supplied by partners to demonstrate project delivery and impact.

Our principles

We follow six principles when handling personal information.

Be fair, lawful and transparent

We collect and use personal information only when we have a clear and lawful reason, and we explain what we are doing and why.

Collect only what's needed

We do not collect more information than we reasonably need for the purpose we have explained.

Keep it accurate

We take reasonable steps to keep information accurate and correct it when we are told that something has changed.

Store it securely

We use technical and organisational measures designed to protect personal information and limit access to people who genuinely need it.

Don't keep it longer than necessary

We keep personal information only for as long as it is reasonably needed for operational, reporting, security or legal reasons. The public financial ledger is retained indefinitely to preserve Aruuri's transparent financial history.

Respect people's rights

We make it straightforward for people to understand and exercise their data protection rights.

Information we collect

Account and contact information

This may include your name, email address, telephone number, country, organisation, account identifier, authentication information, communication preferences and information you add to your profile.

Contribution and transaction information

This may include:

• The amount and currency of a contribution
• Whether it is one off or recurring
• The date and status of the transaction
• The project or fund it relates to
• Refund information
• Subscription status
• Receipts
• Stripe customer or transaction references
• Your name display preference for the public ledger

Aruuri does not receive or store your full payment card or bank account details. Stripe collects and processes that information directly.

Public ledger information

The open ledger records:

• The date of the transaction
• The transaction amount
• Whether the transaction was a contribution or refund

If you opt in to being named, the ledger also displays your first name and the first initial of your surname. If you do not opt in, the entry is displayed as Anonymous.

We do not publish your email address, account identifier, full surname or payment details.

Communications

We collect messages, enquiries, feedback, newsletter preferences and a record of service communications sent to you. This may include contribution confirmations, receipts, welcome messages, account notices and project updates.

Technical and usage information

When you use Aruuri, we may collect your IP address, browser and device information, pages viewed, referral information, timestamps, cookie choices, authentication and security events, diagnostic information and information about errors affecting the service.

Partner applications and due diligence

When an organisation applies to work with Aruuri, we may collect information about its directors, trustees, owners, employees and other key representatives. This may include:

• Names, roles and contact details
• Identity and verification documents
• Professional history and references
• Governance and safeguarding information
• Financial and banking information
• Declarations and compliance information
• Supporting documents submitted with the application

Due diligence may occasionally identify sensitive information relating to safeguarding concerns, sanctions, alleged wrongdoing, criminal offences or political exposure. We use this only where it is relevant and necessary, and where we have both a lawful basis and any additional legal condition required for that type of information. Access is restricted to people who need it for the assessment or for legal and safeguarding purposes.

Project evidence and impact material

Partners may provide photographs, testimonials, project reports and other evidence showing that support reached the intended beneficiaries.

We do not currently ask partners to provide beneficiary health records or personal case files. We ask partners to minimise personal information, obtain any permissions required and share only material that can be used responsibly.

Information received from other sources

We may receive limited information from Stripe, Clerk and other service providers, from partner organisations, from referees, and from public sources such as official registers and organisational websites when carrying out due diligence.

How and why we use personal information

Operating accounts and providing Aruuri

We use account and contact information to create and secure accounts, authenticate users, manage contributions and preferences, and provide access to Aruuri.

Our lawful basis is normally the performance of a contract or taking steps you request before entering into one.

Processing contributions and refunds

We use contribution and transaction information to initiate and record payments, manage recurring contributions, issue confirmations and receipts, reconcile funds and respond to payment queries.

Our lawful bases are contract, legal obligation and our legitimate interests in administering contributions properly.

Maintaining the open ledger

We record contribution and refund activity to provide a transparent historical account of Aruuri's funds and show how funds are allocated.

Our lawful basis for maintaining the financial ledger is our legitimate interest in transparency and accountability. We rely on your consent before displaying your abbreviated name.

Sending service communications

We use your contact and account information to send welcome messages, contribution confirmations, receipts, security notices, subscription notices and important changes affecting the service.

Our lawful bases are contract, legal obligation and our legitimate interests in operating the service and keeping you informed about activity affecting your account or contributions.

Sending optional newsletters and updates

We use your contact information to send optional newsletters, fundraising messages, project stories and opportunities to support Aruuri where you have opted in.

Our lawful basis is consent. You can withdraw your consent at any time.

Assessing and managing partners

We use application and due diligence information to review applications, verify organisations and their representatives, prevent fraud, manage funding relationships and monitor delivery.

Our lawful bases may include taking steps before entering into a contract, contract, legal obligation and our legitimate interests in responsible funding, safeguarding and fraud prevention.

Reporting on projects and impact

We review and share photographs, testimonials, progress reports and evidence of delivery to demonstrate how funds have been used and what projects have achieved.

Our lawful basis is normally our legitimate interest in accountability and impact reporting, together with consent or other appropriate permissions where required.

Protecting Aruuri

We use account, transaction and technical information to detect abuse, prevent fraud, investigate incidents, keep audit records and enforce our terms.

Our lawful bases are legal obligation and our legitimate interests in protecting contributors, partners and the platform.

Understanding and improving the service

We use limited usage, analytics and diagnostic information to understand how Aruuri is used, identify where people encounter problems, analyse performance and fix errors.

We rely on consent where it is required for cookies or similar technologies. We may rely on legitimate interests for limited cookie free service measurement, security and diagnostics.

Meeting legal and regulatory duties

We use personal information where necessary to maintain accounting and compliance records, respond to lawful requests and establish, exercise or defend legal claims.

Our lawful bases are legal obligation and legitimate interests.

Where we rely on legitimate interests, we consider whether the use is necessary and balance our interests against the rights and reasonable expectations of the people affected. You can ask us for more information about this assessment.

Payments and Stripe

Payments are processed by Stripe. When you enter payment information, you provide it directly to Stripe under Stripe's own privacy terms.

Aruuri does not store full card numbers, security codes or bank account credentials. Stripe provides us with limited information needed to manage the contribution, such as the amount, currency, date, payment status, customer or transaction reference, subscription status and refund information.

Stripe may act as our service provider for some activities and as an independent controller where it uses information to meet its own legal, regulatory or fraud prevention obligations.

The public ledger

Transparency is a core part of Aruuri. We therefore keep a public record of contribution and refund activity.

• The ledger shows the transaction date and amount, and whether it was a contribution or refund.
• If you opt in to being named, the ledger shows your first name and the first initial of your surname.
• If you do not opt in, the ledger shows the contribution as Anonymous.
• The ledger does not display your email address, account identifier, full surname or payment details.

Ledger transaction information is retained indefinitely to preserve a transparent historical account of Aruuri's funds.

If you withdraw permission for your abbreviated name to be displayed, we will change the public display to Anonymous where reasonably possible. The underlying financial transaction will remain in the ledger.

Emails and communications

Required service emails

Some emails are necessary to operate Aruuri and cannot be switched off while you use the relevant service. These include payment confirmations, receipts, welcome and account messages, security notices, subscription notices and important changes affecting your contributions or the service.

These are not marketing emails. If you no longer want to receive them, you may need to stop a recurring contribution or close your account. We may still send messages needed to complete that request or meet a legal obligation.

Optional newsletters

We send newsletters, fundraising messages and optional impact updates only where you have opted in.

You can unsubscribe using the link in the message or by contacting us at contact@aruuri.so. Withdrawing consent does not affect processing that took place before the withdrawal.

Cookies, analytics and error reporting

We use cookies and similar technologies to operate and improve Aruuri. You can manage non-essential cookies through Cookie settings at the bottom of our website.

Essential cookies

Clerk uses essential cookies to authenticate users, keep you signed in and protect your account. Stripe uses essential technologies where necessary to process contributions and prevent payment fraud. We also use an essential cookie to remember your cookie choices.

These technologies are necessary for the service you request, so we do not ask for permission before using them.

Analytics

PostHog helps us understand how Aruuri is used, including which pages people view, where they arrive from and where they encounter problems.

Analytics cookies are used only after you accept them. Until you accept, and if you refuse, PostHog may run without cookies so that a visit can still be counted. Nothing is stored on your device for this purpose and we cannot recognise you when you return from that cookie free count.

If you accept analytics cookies, the current preference lasts for up to 12 months before we ask again. Refusing analytics cookies does not prevent you from using Aruuri.

Error reporting

Sentry collects diagnostic and technical information when something breaks so that we can investigate and fix the problem. Sentry does not set cookies for this purpose.

Server logs

When you use Aruuri, your IP address and limited technical information may be recorded in server logs. We use this information to operate, protect and secure the service. We do not use server logs to track your behaviour across unrelated websites.

Who we share information with

We share personal information only where necessary for the purposes described in this policy.

Our principal service providers currently include:

• Amazon Web Services (AWS): hosting infrastructure and file storage
• Convex and Neon: database and application data storage
• Clerk: account authentication and identity management
• Stripe: payment and subscription processing
• Resend and Brevo: email delivery and communication management
• PostHog: website and product analytics
• Sentry: error monitoring and diagnostics

We may also share limited information with delivery partners, professional advisers such as accountants, auditors, lawyers and insurers, and courts, regulators, tax authorities or law enforcement where required by law or necessary to protect rights and prevent fraud.

Service providers acting on our behalf are required to use information only for the agreed services and protect it appropriately. Some providers may also act as independent controllers for particular legal or regulatory activities, in which case their own privacy policies apply.

We do not sell personal information.

International use and data transfers

Aruuri may accept contributions from people around the world where our payment and technical systems support them. Our service providers and delivery partners may process information in the United Kingdom, European Economic Area, United States and other countries.

Where personal information is transferred internationally, we use an appropriate legal mechanism where required. Depending on the transfer, this may include:

• An adequacy decision or adequacy regulations recognising the destination as providing an appropriate level of protection
• The UK Extension to the EU-US Data Privacy Framework for appropriately certified recipients
• The United Kingdom's International Data Transfer Agreement
• Approved standard contractual clauses, including the United Kingdom's International Data Transfer Addendum where applicable

We also consider the protections available in the destination country and apply additional safeguards where appropriate.

You can contact us for more information about the safeguard used for a particular transfer. People outside the United Kingdom may also have rights under the laws that apply where they live.

How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and dispute resolution requirements.

Our usual retention approach is:

• Account and profile information: for as long as the account is active, followed by a limited period needed to complete closure, prevent fraud, resolve disputes and meet legal obligations. Information that is no longer required is deleted or anonymised.
• Contribution and accounting records: normally for at least six years from the end of the relevant financial year, and longer where required for a tax enquiry, dispute, legal claim or other legal obligation.
• Public ledger transactions: retained indefinitely to preserve Aruuri's transparent financial history. If permission to show an abbreviated name is withdrawn, the display will be changed to Anonymous where reasonably possible.
• Newsletter consent and preferences: until consent is withdrawn. We may keep minimal suppression information afterwards so that we continue to respect your decision.
• Security, server and diagnostic logs: for the shortest configured period reasonably needed to operate and secure the service, investigate incidents and prevent fraud.
• Unsuccessful partner applications: normally for up to 24 months after the decision, unless a longer period is needed for compliance, safeguarding, fraud prevention or a legal claim.
• Funded partner and due diligence records: for the partnership and normally for at least six years after it ends or after the final related transaction, whichever is later.
• Photographs, testimonials and impact evidence: for as long as they remain relevant to project reporting, accountability and Aruuri's historical record, subject to the permissions given and any valid request to remove personal information.

Backups are protected and overwritten through routine backup cycles. Where immediate deletion from a backup is not technically possible, the information is placed beyond normal use and removed when that backup is overwritten.

Children and younger contributors

Aruuri accounts and contributions are intended primarily for people aged 18 or over.

A person under 18 may contribute only with the knowledge, involvement and consent of a parent or legal guardian, and must use a payment method they are authorised to use. Where possible, the parent or guardian should create or manage the account and make the contribution on the young person's behalf.

We may ask for reasonable evidence of age, authority or parental responsibility. We may restrict an account, decline or refund a contribution, or remove information where we cannot verify that appropriate consent or authority exists.

We do not knowingly seek personal information directly from children under 13 without verifiable permission from a person with parental responsibility. If you believe a child has provided personal information without appropriate permission, contact us so we can review and take suitable action.

Photographs, testimonials and beneficiary evidence

Our delivery partners are responsible for collecting project evidence lawfully and explaining how it may be used. We expect them to obtain appropriate consent or another valid permission before sharing identifiable photographs or testimonials with Aruuri, particularly where children or vulnerable people are involved.

Aruuri reviews this material before publication and aims to use it with dignity, minimise identifying details and avoid exposing people to unnecessary risk.

We do not require partners to provide beneficiary health records, full identity documents or individual case files as proof of delivery.

Security

We use proportionate technical and organisational measures designed to protect personal information against loss, misuse, unauthorised access, alteration and disclosure. These include access controls, authentication safeguards, encryption in transit, secure cloud services, backups, monitoring and limits on who can access information.

No system can be guaranteed completely secure. If we identify a personal data breach, we will investigate it, take steps to reduce harm and notify affected people and regulators where the law requires us to do so.

Your rights

Depending on the circumstances and the law that applies to you, you may have the right to:

• Ask for access to the personal information we hold about you
• Ask us to correct inaccurate or incomplete information
• Ask us to delete information in certain circumstances
• Ask us to restrict how information is used in certain circumstances
• Object to processing based on legitimate interests
• Object to direct marketing at any time
• Receive certain information in a structured, commonly used and machine-readable format, or ask us to transfer it where technically feasible
• Withdraw consent at any time where consent is the basis for processing

These rights are not all absolute and may depend on the lawful basis and circumstances. For example, we may need to retain transaction records to meet legal obligations even if you close your account.

We may ask for information needed to verify your identity and understand your request. We normally respond within one month, although the law allows additional time for particularly complex requests.

To exercise a right, email contact@aruuri.so. You will not be charged unless a request is manifestly unfounded or excessive and the law permits a reasonable fee.

Complaints

We would appreciate the opportunity to resolve a concern directly. Please contact us at contact@aruuri.so.

You also have the right to complain to the UK Information Commissioner's Office. Information about making a complaint is available at ico.org.uk/make-a-complaint.

If you live outside the United Kingdom, you may also be entitled to contact the data protection authority where you live.

Automated decisions

Aruuri does not currently use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects for individuals.

If this changes, we will update this policy and explain the safeguards and rights that apply.

Third-party websites

Our service may contain links to websites operated by other organisations. This policy does not apply to those independent websites, and we are not responsible for their privacy practices.

We recommend reading the privacy information provided by another organisation before giving it personal information.

Training and awareness

We make sure that people working with Aruuri understand their responsibility to handle personal information carefully. People with access to sensitive or higher risk information receive additional guidance appropriate to their role.

Updates to this policy

We may update this policy as Aruuri develops, our providers change or legal requirements evolve. We will update the date at the beginning of the policy and provide an appropriate notice where a change materially affects how we use personal information.

We review this policy regularly to make sure it remains accurate, practical and aligned with our responsibilities.

Contact us

For questions, requests or concerns about this policy or Aruuri's use of personal information, contact:

Organisation: Somalis in Tech CIC, trading as Aruuri
Company number: 13202400
Email: contact@aruuri.so