1. Introduction

Welcome to Plentii, a platform that connects organisations and individuals for micro-volunteering opportunities. We respect your privacy and are committed to protecting your personal information in accordance with the UK General Data Protection Regulation ("UK GDPR"), the EU General Data Protection Regulation ("EU GDPR") where it applies, and the Protection of Personal Information Act, 2013 ("POPIA") for South African users.

Plentii is operated by Plenti Impact Ltd, a company incorporated in England and Wales (company number 16380277), which is the data controller for personal information processed through the Plentii platform.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our website (plentii.world) and related services.

2. Information We Collect

We may collect the following categories of information:

1. Personal Identification Information

• Name, surname, email address, phone number, or other contact information.

2. Volunteer Profile Information

• Skills, areas of interest, availability, and volunteering history.

3. Organisational Information

• Non-profit/organisation details, contact persons, and volunteer opportunity postings.

4. Technical Information

• IP address, browser type, operating system, and usage data through cookies or analytics tools.
• Request logs: To keep the platform secure and to diagnose technical problems, we automatically record a log of requests made to our servers. Each entry may include your IP address, browser user-agent, the page or path requested, and the response status. These request logs are retained for a maximum of 90 days, after which they are automatically and permanently deleted.

5. Sensitive Information (only where strictly necessary and with your consent)

• For example, background checks if required by an organisation for child-related volunteering.

6. Email Delivery Information

• Email-delivery events: When we send you an email (for example, a sign-in link, booking confirmation, or notification), our email provider reports delivery events back to us. We record these events — including whether a message was delivered, bounced, marked as spam or complained about, or resulted in an unsubscribe — through secure delivery webhooks. We use this information to confirm that important account and service emails reach you and to diagnose delivery problems. See Section 6 (Sharing of Information) for the third-party provider (Mailgun) that processes these events on our behalf.

3. Calendar & Video Conferencing Integrations

Plentii integrates with third-party calendar and video conferencing services to schedule volunteer meetings. When you choose to connect one of these services, the following applies:

a) Google Calendar

When you connect your Google account, Plentii may access the following Google user data:

• Calendar events: We read your calendar events to check availability and prevent double-booking of volunteer meetings.
• Profile information: We access basic profile information (name and email) to identify your account.
• Calendar event creation: We create calendar events for scheduled volunteer meetings, including Google Meet video conferencing links.

We access this data solely for the purpose of scheduling and managing volunteer meetings on your behalf. We do not sell or share your Google data with third parties, and we do not use it for advertising, marketing, or profiling. Your Google data is stored encrypted at rest using industry-standard encryption. We retain this data for as long as your account is active and your calendar remains connected. You may disconnect your Google Calendar at any time via your Settings page, which will revoke our access. You may also request deletion of your stored Google data by contacting us at privacy@plentii.world.

Plentii's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

b) Microsoft Outlook Calendar

When you connect your Microsoft account, Plentii may access the following data:

• Calendar events: We read your Outlook calendar events to check availability and prevent double-booking.
• Profile information: We access basic profile information (name and email) to identify your account.
• Calendar event creation: We create calendar events for scheduled volunteer meetings, including Microsoft Teams video conferencing links.

Your Microsoft data is stored encrypted at rest. We retain this data for as long as your account is active and your calendar remains connected. You may disconnect your Microsoft calendar at any time via your Settings page. Please note that when using Microsoft services, your data may be transferred and processed internationally in accordance with Microsoft's infrastructure. We ensure appropriate safeguards are in place for any such transfers.

c) Zoom

When an organisation host connects their Zoom account to schedule volunteer sessions, Plentii accesses and stores the following data:

• User profile: When you connect, we read your basic Zoom profile once — your Zoom user ID, Zoom account ID, and the display name and email address on your Zoom account — to identify and confirm the account that meetings will be created under.
• Meeting details: When a volunteer books a session set to use Zoom, we create a single scheduled Zoom meeting on your behalf and store that meeting's ID and join link on the booking, so the link can be shown to and emailed to both participants. Cancelling the booking deletes that Zoom meeting.
• Authentication tokens: We store the OAuth access and refresh tokens that allow us to create and manage these meetings on your behalf.

We use this Zoom data solely to create and manage your own meeting links for volunteer sessions. We do not access or store meeting recordings, transcripts, chat messages, participant lists, contacts, or your existing meetings or calendar, and we never join your meetings. We do not sell or share your Zoom data with third parties, and we do not use it for advertising, marketing, or profiling.

Your Zoom OAuth tokens are stored encrypted at rest using industry-standard, non-deterministic AES-256 encryption, and all communication with Zoom takes place over encrypted HTTPS/TLS connections.

Retention and deletion. We retain your Zoom data only for as long as your account is active and your Zoom integration remains connected. It is deleted when you disconnect Zoom from your Settings page, when you remove the Plentii app from your Zoom account (Zoom notifies us, and we delete all Zoom data we hold for you and confirm the deletion back to Zoom), or when you delete your Plentii account. You may also request access to, or deletion of, your stored Zoom data at any time by contacting privacy@plentii.world.

d) General Integration Practices

• Data from a connected calendar or video conferencing service is only accessed on behalf of the authenticated user who connected that service, and only that user's own credentials are used.
• All OAuth tokens are stored encrypted at rest.
• You may disconnect or revoke access to any connected calendar or video conferencing service at any time through your account Settings page.
• Upon disconnection, we cease accessing that service's data. You may request deletion of any previously stored integration data by contacting privacy@plentii.world.
• In the event of a data breach affecting your calendar or meeting data, we will notify affected users promptly in accordance with applicable law.

4. How We Use Your Information

We process your information for the following purposes:

• To create and manage your account on Plentii.
• To match volunteers with relevant opportunities.
• To communicate with you about volunteering opportunities, platform updates, or legal notices.
• To verify your identity, where necessary.
• To comply with legal obligations.
• To improve our website, user experience, and platform functionality.

5. Legal Basis for Processing

Under the UK GDPR, EU GDPR, and POPIA, we rely on one or more of the following grounds to process your information:

• Your consent (e.g., when you sign up or agree to cookies).
• Contractual necessity (to provide you with our services).
• Legal obligations (e.g., verifying information when required by law).
• Legitimate interests (e.g., improving our platform and ensuring security).

6. Sharing of Information

We do not sell your personal data. We may share information with:

• Non-profit organisations or community groups where you express interest in volunteering.
• Service providers who support our operations (e.g., hosting, analytics, email services).
• Legal or regulatory authorities, where required by law.
• Successors/partners in the event of a merger, acquisition, or business transfer (subject to safeguards).

We use Mailgun (Sinch / Mailgun Technologies) as our email delivery sub-processor. Mailgun sends transactional emails on our behalf and reports email-delivery events (delivered, bounced, complained, unsubscribed) back to us, as described in Section 2. We maintain an up-to-date list of the sub-processors that process personal data on our behalf on our Sub-processors page.

7. International Transfers

As Plentii uses third-party service providers, your information may be transferred and processed outside the United Kingdom, the European Economic Area, and South Africa. Where this happens, we ensure appropriate safeguards are in place (such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or equivalent contractual measures that ensure equivalent data protection).

8. Data Retention

We retain personal information only as long as necessary to:

• Provide services,
• Fulfil legal or regulatory requirements, and
• Resolve disputes or enforce agreements.

When data is no longer needed, it will be securely deleted or anonymised.

9. Your Rights

Under the UK GDPR, EU GDPR, and POPIA, you have the right to:

• Access: request a copy of the personal information we hold about you.
• Rectification: correct or update inaccurate or incomplete information.
• Erasure: request deletion of your personal information, where legally permissible (sometimes called the "right to be forgotten").
• Restriction: request that we limit the processing of your information in certain circumstances.
• Data portability: receive your personal data in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
• Objection: object to processing based on legitimate interests, direct marketing, or in certain other cases.
• Withdraw consent: withdraw any consent you previously gave, at any time (this may affect your ability to use some services).
• Automated decision-making: not to be subject to a decision based solely on automated processing, including profiling. Plentii does not currently make any decisions about you using solely automated means.
• Lodge a complaint: with the supervisory authority in your jurisdiction (see Section 14 below for the relevant authorities).

Requests may be submitted to: privacy@plentii.world. We will respond within one month, or sooner where required by applicable law.

10. Security Measures

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse, or disclosure. However, no online service can be completely secure, and you use the platform at your own risk.

11. Children's Privacy

Plentii is not directed at children under 18, except in supervised volunteering programmes with parental/guardian consent. We do not knowingly collect information from minors without proper consent.

12. Cookies and Tracking

Our website uses cookies and similar technologies to:

• Keep you signed in,
• Understand how you use the platform, and
• Improve site performance.

You can control cookies through your browser settings.

13. Changes to this Policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website with the effective date updated.

14. Contact Us

If you have questions or complaints regarding this Privacy Policy or our handling of your data, please contact us at:

Email: privacy@plentii.world

Address: Plenti Impact Ltd, Apt 8 Isis House, Wharf Bridge, Chertsey, England, KT16 8LB, United Kingdom

If your complaint is not resolved, you have the right to lodge a complaint with the supervisory authority in your jurisdiction:

United Kingdom — Information Commissioner's Office (ICO)

• Website: https://ico.org.uk/make-a-complaint/
• Helpline: 0303 123 1113

European Economic Area — your local Data Protection Authority

• List of authorities: https://edpb.europa.eu/about-edpb/about-edpb/members_en

South Africa — Information Regulator

• Website: https://www.justice.gov.za/inforeg/
• Email: inforeg@justice.gov.za