Legal

Privacy

Policy.

How we collect, use, and protect your personal data. Last updated: 1 January 2026.

Contents

01 / Data Controller

Who is responsible for your data?

World Merit is the data controller for all personal data collected through our website, platform, and programmes. World Merit is a registered charity in England and Wales (Charity No. 1234567), with our registered address at: 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom.

If you have any questions about how we handle your personal data, please contact our Data Protection Officer at: [email protected]

Data Protection Officer: [email protected]· Response time: within 30 days · Supervisory authority: Information Commissioner's Office (ICO), ico.org.uk

02 / Data We Collect

What information do we collect?

We collect different types of data depending on how you interact with World Merit. We only collect what we need and always with a clear purpose.

Data you provide directly:

Name, email address, and date of birth when you create an account

Profile information including location, biography, and profile photo

Programme application data including essays, references, and project descriptions

Payment information when you make a donation (processed securely by Stripe — we do not store card details)

Communications you send us via email, contact forms, or support tickets

Data we collect automatically:

Device and browser information

IP address and approximate location

Pages visited and time spent on our website

Platform activity including posts, reactions, and course progress

Cookies and similar tracking technologies (see Section 8)

Data from third parties:

Social login data if you sign in via Google or LinkedIn

Partner organisation data where you have consented to data sharing

Publicly available information to verify programme eligibility

03 / Your Rights

Your rights under UK GDPR

Under UK GDPR and the Data Protection Act 2018, you have the following rights regarding your personal data. These rights are not absolute and may be subject to certain exemptions — but we will always respond to your request and explain our reasoning.

Right of Access

You can request a copy of all personal data we hold about you (a Subject Access Request). We will respond within 30 days.

Right to Rectification

You can ask us to correct any inaccurate or incomplete personal data we hold about you.

Right to Erasure

You can ask us to delete your personal data, subject to certain legal obligations we must fulfil.

Right to Restriction

You can ask us to limit how we process your data in certain circumstances, for example while we verify a correction.

Right to Portability

You can request your data in a structured, machine-readable format so you can transfer it to another service.

Right to Object

You can object to processing based on our legitimate interests, including for direct marketing purposes — which will always be honoured immediately.

To exercise any of your rights, email [email protected]with the subject line "Data Rights Request". We will acknowledge your request within 5 working days and respond fully within 30 days. You also have the right to lodge a complaint with the ICO at ico.org.uk.