Ggrafthartlepool
sign in
last updated 2 october 2026

privacy policy

what graft collects, why, who sees it, and how to get it back or delete it.

who we are

Graft is run by MATCH Tees Valley CIC ("MATCH", "we"), a community interest company based in Hartlepool. MATCH is the data controller for the personal data on Graft. Contact us about anything on this page at info@matchteesvalley.co.uk.

what we collect

  • Your account: name, email address, a password (stored only as a one-way bcrypt hash), your role, when you agreed to these terms, whether you've confirmed your email, and whether you want notification emails.
  • Volunteers: anything you choose to add: phone, postcode, skills and qualifications, passions, what you would like to learn, whether you would be interested in running a business, and a short "about you". Plus the opportunities and courses you say you're interested in, the hours you log, your points, and rewards you redeem.
  • Organisations: the organisation's name, description, contact phone, logo, projects, and the hours you sign off.
  • Adult-education providers: your provider name and the courses you post.
  • Technical: one cookie (graft.sid) that keeps you signed in. Your IP address is used briefly in memory to stop password-guessing, and appears in short-lived server logs. We do not use analytics, advertising or tracking cookies.

why we use it (and our lawful basis)

  • To run your account and the service you signed up for: matching, logging and signing off hours, points and rewards. Basis: contract.
  • To match people with opportunities, courses and enterprise support in Hartlepool, and to report anonymised totals (for example, hours volunteered) to partners and funders. Basis: legitimate interests, as a community interest company supporting local volunteering, learning and enterprise.
  • If you say you would be interested in running a business, MATCH may contact you about start-up support. You can change this on your profile at any time. Basis: legitimate interests.
  • To email you about your account (confirming your address, password resets) and, unless you turn them off, when something needs you: someone's interested in your project, you've been accepted, hours are signed off, or you're invited to a course. Basis: contract.
  • To keep Graft safe, for example verifying organisations and preventing misuse. Basis: legitimate interests.

who can see what

  • Organisations see your name, postcode district (the first half, like TS24), skills and passions when you say you're in for one of their opportunities. They only see your email and phone once they accept you, and you then see theirs.
  • Adult-education providers can search for learners by interest and see a short name (like "jordan e."), postcode district and interests, but no contact details. They see your email and phone only if you say you're interested in one of their courses.
  • Other volunteers see your short name and approved hours on the monthly leaderboard, if you are in the top five.
  • Your full postcode is only seen by you and MATCH admins.
  • MATCH admins can see everything on Graft, to run and support the platform.
  • Anyone can see open opportunities, the organisation that posted them, and its logo.
  • Our hosting provider, Hetzner Online GmbH, stores the data on servers in the EU on our behalf, and our email provider, 20i (Stackmail), sends Graft's emails from servers in the UK. We do not sell your data or share it with anyone else, unless the law requires it.

how long we keep it

We keep your data while your account is open. When you delete your account, it is removed from Graft straight away and from our backups within 30 days. If you approved hours as an organisation, deleting your account also deletes those hour records, but volunteers keep the points they earned.

your rights

You can see and download your data, correct it, and delete your account at any time from your account page. You also have the right to object to how we use your data, to restrict it, and to ask us anything about it: email info@matchteesvalley.co.uk. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

age

Graft is for people aged 18 and over.

changes

If we change this policy in a way that matters, we will update the date at the top of this page and post a notice on Graft.